Validation

Validators

DOMDocumentValidationStack

Kitodo\Dlf\Validation\DOMDocumentValidationStack implementation of Kitodo\Dlf\Validation\AbstractDlfValidationStack for validating DOMDocument against the configurable validators.

The configuration is an array validator configurations each with following entries:

className	Fully qualified class name of validator class derived from `Kitodo\Dlf\Validation\AbstractDlfValidator`
configuration	Specific configuration of validator

XmlSchemasValidator

Kitodo\Dlf\Validation\XmlSchemasValidator combines the configured schemes into one schema and validates the provided DOMDocument against this.

The configuration is an array validator configurations each with following entries:

Key	Description
namespace	Specifies the URI of the namespace to import
schemaLocation	Specifies the URI to the schema for the imported namespace

SaxonXslToSvrlValidator

Kitodo\Dlf\Validation\SaxonXslToSvrlValidator validates the DOMDocument against an XSL Schematron and converts error output to validation errors.

To use the validator, the XSL Schematron must be available alongside the XSL processor as a JAR file, and the required Java version of the processor must be installed.

Key	Description
jar	Absolute path to the Saxon JAR file
xsl	Absolute path to the XSL Schematron

DOMDocumentValidation Middleware

Kitodo\Dlf\Validation\DOMDocumentValidation middleware must be used by setting the middleware parameter to dlf/dom-document-validation. Additionally, the url parameter must contain the URL of the DOMDocument content to be validated, and the validationType parameter must specify the corresponding validation configuration type.

Note

The middleware must not be invoked with the type parameter. In the TYPO3 frontend, type is a reserved parameter that selects the page type (typeNum), so a non-numeric type value causes a "No page configured for type=..." error before the middleware is even reached.

Configuration

The validation middleware can be configured via a YAML file located within any extending extension at the path EXT:<my_extension>/Configuration/Kitodo/Validation/. The name of the configuration file must match the configured validation type, allowing you to define different validation rules. When directly referencing the middleware or using the Validation, this identifier must be provided as the validationType parameter.

Validators derived from Kitodo\Dlf\Validation\AbstractDlfValidator can be configured here. This also includes the use of validation stack implementations derived from Kitodo\Dlf\Validation\AbstractDlfValidationStack, which use DOMDocument as the valueClassName for validation. This allows for multiple levels of nesting.

In the background of the middleware, the Kitodo\Dlf\Validation\DOMDocumentValidationStack is used, to which the configured validators are assigned.

Server-Side Request Forgery Protection

The url parameter is fetched server-side. To prevent the middleware from being abused for server-side request forgery (SSRF) or local file inclusion, only http and https URLs are accepted, and the host of the URL must be a public one by default. Hosts that resolve to private or otherwise reserved address ranges (loopback, RFC 1918, link-local, CGNAT, etc.) are rejected, as are unresolvable hosts.

Optionally, a validation configuration may define a hostAllowList key (a comma-separated string or a YAML list of hostnames or subdomain wildcards such as *.example.org). If it is set, only the listed hosts may be fetched; an entry for a host that would otherwise be rejected (for example an internal service) explicitly allows it. Unlike the extension configuration setting general.urlAllowList, this list is exclusive and also blocks public hosts that are not listed.

hostAllowList: 'web, *.example.org'
1:
  title: 'LLL:EXT:.../locallang.xlf:title'
  ...

For each validator, the title and description can be defined as XLF labels and are returned in the response according to the selected site language.

The description label can include placeholders. The syntax changes slightly in this case: a separate block is used for the description, consisting of the XLF label as the key and an additional block containing arguments. These arguments are then inserted into the placeholders within the label in the given order. The EXT: prefix can also be used as an argument value, which will be replaced with the corresponding extension path.

1:
  title: 'LLL:EXT:.../locallang.xlf:title'
  shortDescription: 'LLL:EXT:.../locallang.xlf:description'
  description: 'LLL:EXT:.../locallang.xlf:description'
2:
  title: 'LLL:EXT:.../locallang.xlf:title'
  description:
    key: 'LLL:EXT:.../locallang.xlf:description'
    arguments:
      0: 'EXT:...'
      1: 'Test'
  className: '...\ApplicationProfileValidationStack'

YAML Example

1:
  title: 'LLL:EXT:dfgviewer/Resources/Private/Language/locallang_validation.xlf:validator.xmlschemas.title'
  shortDescription: 'LLL:EXT:dfgviewer/Resources/Private/Language/locallang_validation.xlf:validator.xmlschemas.shortdescription'
  description:
    key: 'LLL:EXT:dfgviewer/Resources/Private/Language/locallang_validation.xlf:validator.xmlschemas.description'
    arguments:
      0: 'EXT:dfgviewer/Resources/Public/Xsd/Mets/1.12.1.xsd'
      1: 'METS 1.12.1'
      2: 'EXT:dfgviewer/Resources/Public/Xsd/Mods/3.8.xsd'
      3: 'MODS 3.8'
  className: 'Kitodo\Dlf\Validation\XmlSchemasValidator'
  configuration:
    mets:
      namespace: 'http://www.loc.gov/METS/'
      schemaLocation: 'EXT:dfgviewer/Resources/Public/Xsd/Mets/1.12.1.xsd'
    mods:
      namespace: 'http://www.loc.gov/mods/v3'
      schemaLocation: 'EXT:dfgviewer/Resources/Public/Xsd/Mods/3.8.xsd'
2:
  title: 'LLL:EXT:dfgviewer/Resources/Private/Language/locallang_validation.xlf:validator.metsapplicationprofile.title'
  shortDescription: 'LLL:EXT:dfgviewer/Resources/Private/Language/locallang_validation.xlf:validator.metsapplicationprofile.shortdescription'
  description:
    key: 'LLL:EXT:dfgviewer/Resources/Private/Language/locallang_validation.xlf:validator.metsapplicationprofile.description'
    arguments:
      0: '/fileadmin/groups/dfgviewer/METS_application_profile_2.4.pdf'
      1: 'METS Application Profile version 2.4'
  className: 'Slub\Dfgviewer\Validation\Mets\ApplicationProfileValidationStack'
3:
  title: 'LLL:EXT:dfgviewer/Resources/Private/Language/locallang_validation.xlf:validator.modsapplicationprofile.title'
  shortDescription: 'LLL:EXT:dfgviewer/Resources/Private/Language/locallang_validation.xlf:validator.modsapplicationprofile.shortdescription'
  description:
    key: 'LLL:EXT:dfgviewer/Resources/Private/Language/locallang_validation.xlf:validator.modsapplicationprofile.description'
    arguments:
      0: '/fileadmin/groups/dfgviewer/MODS_application_profile_2.4.pdf'
      1: 'MODS Application Profile version 2.4'
  className: 'Slub\Dfgviewer\Validation\Mods\ApplicationProfileValidationStack'
4:
  title: 'LLL:EXT:dfgviewer/Resources/Private/Language/locallang_validation.xlf:validator.metsurlexistence.title'
  shortDescription: 'LLL:EXT:dfgviewer/Resources/Private/Language/locallang_validation.xlf:validator.metsurlexistence.shortdescription'
  description: 'LLL:EXT:dfgviewer/Resources/Private/Language/locallang_validation.xlf:validator.metsurlexistence.description'
  className: 'Slub\Dfgviewer\Validation\MetsUrlExistenceValidator'
  configuration:
    excludeHosts: 'dfg-viewer.de,www.loc.gov,id.loc.gov,www.openarchives.org,purl.org,www.w3.org'
  disabled: true