Parser for XML namespaces in xml rules is too restrictive #2358

**Parser for XML namespeces in XML rules is too restrictive **

We encountered a bug when porting mod_security from version 2 to version 3.
The parser, that parses the XML-namespace in XML rules is too restrictive.
It allows only namespaces beginning with http://

Burt the specification from https://www.w3.org/TR/1999/REC-xml-names-19990114
states:

2. Declaring Namespaces

.....

[Definition:] The attribute's value, a URI reference, is the namespace name identifying the namespace. The namespace name, to serve its intended purpose, should have the characteristics of uniqueness and persistence. It is not a goal that it be directly usable for retrieval of a schema (if any exists). An example of a syntax that is designed with these goals in mind is that for Uniform Resource Names [RFC2141]. However, it should be noted that ordinary URLs can be managed in such a way as to achieve these same goals.

Thus, namespaces do not always start with http://, but may also start with e.g. uri:

We got the rules loaded and working by just removing the check for http:// in src/actions/xmlns.cc

--- src/actions/xmlns.cc        Thu Jul  9 13:38:37 2020
+++ src/actions/xmlns.cc        Thu Jul  9 13:41:00 2020
@@ -27,7 +27,6 @@
 
 bool XmlNS::init(std::string *error) {
     size_t pos;
-    std::string http = "http://";
 
     pos = m_parser_payload.find("=");
     if (pos == std::string::npos) {
@@ -46,12 +45,6 @@
     if (m_href.at(0) == '\'' && m_href.size() > 3) {
         m_href.erase(0, 1);
         m_href.pop_back();
-    }
-
-    if (m_href.compare(0, http.length(), http) != 0) {
-        error->assign("XMLS: Missing xmlns href for prefix: " \
-            "`" + m_href + "'.");
-        return false;
     }
 
     return true;