If HTTP requesting:
- a dynamically composed .anx file
- with "Accept: text/x-cmml" in the HTTP request header,
then mod_annodex spits out the original CMML, presumably as an optimisation. However, if the original CMML contains a <stream> tag, that is copied verbatim into the resulting output. I think this is invalid, for two reasons:
- No Annodex file (which is what the requested resource is) should ever contain a <stream> tag, because it's normally eliminated in the muxing stage from CMML into Annodex
- It's a potential security risk: the <import> tag in the <stream> tag directly references the original media, which means that it's possible for clients to HTTP request the original (e.g. theora/vorbis) media directly, rather than grabbing the Annodex version.
