Finding:

- From the CDA book:

Do Not Use the schemaLocation Attribute

While the XML Schema Language allows a schema location to be associated with an XML

document by including a schemaLocation attribute associated with the http://www.

w3.org/2001/XMLSchema-instance namespace, this is explicitly PROHIBITED

by [ITS§1.4], and thus by the CDA standard.

Systems validating a CDA document are expected to provide their own schemas to use

during validation. This rule is sometimes broken by CDA implementers. Applications

receiving CDA documents should at the very least REMOVE the schemaLocation

attribute

from the document before processing it, if not rejecting documents containing

them completely. Downloading schema resources from arbitrary URLs or file locations for

validation can at the very least slow down your system, and could crash it or even worse,

cause a security breach. I have seen a number of different systems crash at testing events

upon seeing an otherwise valid CDA document containing a schemaLocation attribute

pointing to a file that does not exist.

Suggestion:

- Add a schematron rule to avoid the use of the schemaLocation attribute. Has to be added to every CDA Document Level Template.
JIRA issue has been created for this: https://ec.europa.eu/cefdigital/tracker/browse/EHSEMANTIC-385

Further explanation:

-