[Owasp-esapi-c++] Logger (C++ XML Library)

[Jeffrey Walton]

On Tue, Aug 16, 2011 at 1:33 PM, Kevin W. Wall <kevin.w.wall at gmail.com> wrote:
> On Tue, Aug 16, 2011 at 10:48 AM, Daniel Amodio
> <dan.amodio at aspectsecurity.com> wrote:
>> Jeff Walton wrote:
>>>
>>> Currently (and in the past), Xerces has cropped up as a [recommended]
>>> C++ XML parser.
>>>
>>> Does anyone have any experience with the library (specifically, will it
>>> meet production quality)? Does anyone have any recommendations for a C++
>>> XML parser?
>>
>> Have not looked to deeply at it, but this may do what is needed:
>> http://www.boost.org/doc/libs/1_43_0/doc/html/property_tree.html
>>
>> Alternatively, I hear pugixml is good http://code.google.com/p/pugixml/
>>
>> If boost can do it, we should use boost (since it's already a moderate
>> overhead of a library)
>
> Jeff,
>
> I've never personally used the C++ version of Xerces, but we have used
> the Java version and it works great and appears to be very stable. It
> also performs well. One could only hope that the C++ version does as
> well.
>
> Were you looking for a SAX-based rather than DOM-based parser? I think
> Xerces (at least the Java version) supports both, although we've only used
> the SAX APIs in Xerces (for XML Encrypt).
>
> What do you plan on using it for? Some of the encoders?
Reading properties.

> I don't quite
> understand what logging has to do with it; log4j used log4j.xml for
> it's configuration, but having an XML-based config file should not
> be a requirement.
Yep, logging has nothing to do with it. My bad - I'm not sure
where/how I crossed those wires.

> I think I'd agree with Daniel, if the Boost XML library works and
> isn't a royal pain in the butt, probably makes sense. But it would
> help if we knew what you intended it for as well as to whether you
> are leaning toward SAX or DOM approach.
Yes, I suspect logging will be under Boost's purview. I believe DA
will make the final recommendations.

Jeff