[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

RE: What the .... ? Referencing XSL stylesheets across domains

• To: xml-dev@l...
• Subject: RE: What the .... ? Referencing XSL stylesheets across domains
• From: Jim Ancona <scarhill@y...>
• Date: Thu, 8 Aug 2002 09:10:05 -0700 (PDT)
• Cc: Sebastian Schnitzenbaumer <schnitz@m...>
• In-reply-to: <D0F1529EE943B3449F755CA1A40887465B4083@w...>
• Reply-to: jim@a...

--- Sebastian Schnitzenbaumer <schnitz@m...> wrote:
> http://markuplanguage.oss4u.de/test3.xml
> references http://www.w3.org/Style/XSL/stylesheets/public2html.xsl
>  
> This works in Mozilla (the result looks bogus, I'm just testing), my IE6
> says access denied. I just want to hear from someone "yes, this is true,
> we've known this for years, or, no, actually it does work, you must 
> have some other bug". Please let me know...

Note that MSDN[1] says the URI in the xsl-stylesheet PI "is the Uniform
Resource Identifier (URI) of the style sheet. This URI is relative to the
location of the XML document itself." The W3C REC that defines the PI[2] has no
such restriction.

Since Microsoft allows the <msxsl:script> extension which permits embedded
script code in stylesheets, it might be that this behavior is designed to
prevent some kind of cross-site scripting exploit. 

Jim

[1] -
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/xmlsdk/htm/xml_concepts_369f.asp

[2] - http://www.w3.org/TR/xml-stylesheet/

=====
Jim Ancona
jim@a...                     jancona@x...

__________________________________________________
Do You Yahoo!?
HotJobs - Search Thousands of New Jobs
http://www.hotjobs.com

• References:
  • RE: What the .... ? Referencing XSL stylesheets across domains
    • From: "Sebastian Schnitzenbaumer" <schnitz@m...>

• Prev by Date: RE: What the .... ? Referencing XSL stylesheets across domains
• Next by Date: IE6, XSL and The Web (was: RE: What the .... ? Referencing XSL stylesheets across domains)
• Previous by thread: RE: What the .... ? Referencing XSL stylesheets across domains
• Next by thread: RE: What the .... ? Referencing XSL stylesheets across domains
• Index(es):
  • Date
  • Thread