XSD Validator

// npm i libxml2-wasm, the same engine this page runs.
import { XmlDocument, XsdValidator, ParseOption, XmlValidateError } from 'libxml2-wasm';

// NO_XXE blocks external DTDs and entities. Leaving HUGE unset is what keeps
// libxml2's depth, entity-nesting and amplification limits switched on.
const SAFE = ParseOption.XML_PARSE_NO_XXE | ParseOption.XML_PARSE_NONET;

export function validateXsd(xmlText, xsdText) {
  let xsd = null;
  let validator = null;
  let doc = null;
  try {
    xsd = XmlDocument.fromString(xsdText, { option: SAFE });
    validator = XsdValidator.fromDoc(xsd);
    doc = XmlDocument.fromString(xmlText, { option: SAFE });
    validator.validate(doc);
    return { valid: true, errors: [] };
  } catch (err) {
    if (err instanceof XmlValidateError) {
      // Each detail is { line, col, level, message, xpath }.
      return { valid: false, errors: err.details };
    }
    throw err;
  } finally {
    // dispose() is mandatory: these are WebAssembly heap allocations.
    doc?.dispose();
    validator?.dispose();
    xsd?.dispose();
  }
}

# pip install lxml
from lxml import etree

parser = etree.XMLParser(
    resolve_entities=False,   # no entity substitution
    no_network=True,          # never fetch a schema or DTD
    load_dtd=False,
    huge_tree=False,          # keep the depth and expansion limits
)

schema = etree.XMLSchema(etree.parse('schema.xsd', parser))
doc = etree.parse('document.xml', parser)

if schema.validate(doc):
    print('valid')
else:
    for e in schema.error_log:
        print(f'{e.line}:{e.column} {e.message}')

# lxml wraps libxml2, so this is XSD 1.0. For xs:assert and xs:alternative use
# the pure-Python implementation instead:
#   import xmlschema
#   xmlschema.XMLSchema11('schema.xsd').validate('document.xml')

import javax.xml.XMLConstants;
import javax.xml.transform.stream.StreamSource;
import javax.xml.validation.Schema;
import javax.xml.validation.SchemaFactory;
import javax.xml.validation.Validator;
import org.xml.sax.SAXParseException;
import org.xml.sax.helpers.DefaultHandler;

SchemaFactory factory = SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI);
// With Xerces on the classpath, XSD 1.1 is one string away:
//   SchemaFactory.newInstance("http://www.w3.org/XML/XMLSchema/v1.1");

// "file" allows xs:import of a schema next to this one; http is refused.
// Pass "" instead to block every external reference, local ones included.
factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "file");
factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");

Schema schema = factory.newSchema(new StreamSource(new java.io.File("schema.xsd")));
Validator validator = schema.newValidator();
validator.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
validator.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");

// Without an ErrorHandler the first error throws and you see one problem.
// With one, Xerces carries on and reports the lot.
validator.setErrorHandler(new DefaultHandler() {
    @Override public void error(SAXParseException e) {
        System.out.printf("%d:%d %s%n", e.getLineNumber(), e.getColumnNumber(), e.getMessage());
    }
    @Override public void fatalError(SAXParseException e) throws SAXParseException {
        throw e;
    }
});

validator.validate(new StreamSource(new java.io.File("document.xml")));

using System;
using System.Xml;
using System.Xml.Schema;

var schemaSettings = new XmlReaderSettings
{
    DtdProcessing = DtdProcessing.Prohibit,
    XmlResolver = null,          // no xs:import over the network
};

var schemas = new XmlSchemaSet { XmlResolver = null };
using (var schemaReader = XmlReader.Create("schema.xsd", schemaSettings))
{
    schemas.Add(null, schemaReader);   // null: take targetNamespace from the file
}

var settings = new XmlReaderSettings
{
    ValidationType = ValidationType.Schema,
    Schemas = schemas,
    DtdProcessing = DtdProcessing.Prohibit,
    XmlResolver = null,
};
// Never follow xsi:schemaLocation from the instance document.
settings.ValidationFlags &= ~XmlSchemaValidationFlags.ProcessSchemaLocation;
// Without a handler the first error throws; with one, validation continues.
settings.ValidationEventHandler += (_, e) =>
    Console.WriteLine($"{e.Exception.LineNumber}:{e.Exception.LinePosition} {e.Message}");

using var reader = XmlReader.Create("document.xml", settings);
while (reader.Read()) { }    // validation happens as the document is read

// System.Xml.Schema is XSD 1.0, and Microsoft has said it is not moving past it.

<?php
// DOMDocument is libxml2, so this is the same engine and the same XSD 1.0.
libxml_use_internal_errors(true);

$doc = new DOMDocument();
if (!$doc->loadXML($source, LIBXML_NONET)) {
    fwrite(STDERR, "The document is not well-formed.\n");
    exit(1);
}

// schemaValidateSource() takes the XSD as a string if you already have it.
if (!$doc->schemaValidate('schema.xsd')) {
    foreach (libxml_get_errors() as $e) {
        fprintf(STDERR, "%d:%d %s\n", $e->line, $e->column, trim($e->message));
    }
    libxml_clear_errors();
    exit(1);
}

echo "valid\n";

# xmllint ships with libxml2 and is the same engine as this page.
# --nonet stops it fetching anything the document or the schema references.
xmllint --noout --nonet --schema schema.xsd document.xml

# Exit status is 0 when the document is valid, non-zero otherwise, and the
# diagnostics go to stderr in file:line: form.

# A schema split across xs:import files works here, because xmllint reads the
# sibling files from disk. That is the one thing a browser cannot do.

# No widely installed command-line tool does XSD 1.1; for that you need
# Xerces-J or Saxon-EE, driven from code.