search

musescore / MuseScore

MuseScore is an open source and free music notation software. For support, contribution, bug reports, visit MuseScore.org. Fork and make pull requests!
https://musescore.org
Other
12.36k stars 2.67k forks source link

MusicXML is not validated against schema anymore since Qt 6 #23726

Open cbjeukendrup opened 4 months ago

cbjeukendrup commented 4 months ago

The MusicXML import code doesn't contain a lot of error handling, because before any reading is done, the XML file was validated against the MusicXML schema. That gave guarantee that the input is sane, so not much further error handling was necessary.

But in Qt 6, the XmlPatterns module, which contained the XML schema validator, was inexplicably removed. It is not immediately clear what to use as a replacement, as there are many XML libraries of differing sizes and qualities, and only few of them contain schema validation functionality. And extra work will be necessary to make these libraries fit into our code.

As a result, there is no validation at all, so insane MusicXML files will just be passed to the MusicXML importer which is not necessarily prepared for that.

To be clear, this issue does not affect valid MusicXML files in any way; it only affects how robust MuseScore is against invalid MusicXML files.

jeetee commented 4 months ago

I had a coworker that fell back to https://xerces.apache.org/xerces-c/ early last year because of this when moving from Qt5 to Qt6. No idea on the complexity or ease of use of that library though.

EDIT: the project seems to lack maintenance though, so I've mentioned it more as a "look at it possibility" than a serious immediate solution. XERCESC-1800 seems a bit worrying, for example..

igorkorsukov commented 1 month ago

I think we should solve this not by validating the schema, but by detecting errors and reporting them during the import of MusicXml files. Moreover, a valid schema does not mean that there are no errors, it only means that the file structure is as we expect (but for example, the content may be incorrect)

Jojo-Schmitz commented 1 month ago

Schema validation does a good part of the error detection, but indeed not all. It still is usefull, and prevents is from having to reinvent the wheel, instead we'd just need to make it a bit rounder

igorkorsukov commented 1 month ago

It just used to be out of the box, and it was easy to check the scheme. Not anymore. It's a difficult task now... so the question arises, what other options are there...