Q. about 'DOM-Hash-total'

Hi all!

A question concerning security, I hop it is 'on topic' for this list ...

Recently I have been playing around a bit with the Security Suite from
IBM-Alphaworks called XSS4J. One of the tools I tested was the GetDigest
method. This method gives you a kind of hash-total of a DOM object.

Now as I understood, whitespace is insignificant, provided there is DTD to
specify to the Parser that there aren't any mixed content elements.
 
Yet the following two documents yield different hash-totals, can anybody
explain why?


Document 1:

<!DOCTYPE foo SYSTEM "E:\My Documents\xml\voorbeelden\DOMHash\foobar.dtd">
<foo>
	<bar>blablabla</bar>
</foo>

Document 2:

<!DOCTYPE foo SYSTEM "E:\My Documents\xml\voorbeelden\DOMHash\foobar.dtd">
<foo><bar>blablabla</bar></foo>

DTD:

<!ELEMENT foo (bar)>
<!ELEMENT bar (#PCDATA)>