[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

RE: What the .... ? Referencing XSL stylesheets across domains

• To: schnitz@m..., jim@a..., xml-dev@l...
• Subject: RE: What the .... ? Referencing XSL stylesheets across domains
• From: "Wayne Steele" <xmlmaster@h...>
• Date: Wed, 14 Aug 2002 17:40:00 -0700
• Bcc:

1. XSL Stylesheets can (in IE's implemetation) execute Javascript and 
VBScript code.

2. There is a bunch of literature on "Cross Site Scripting" attacks. see 
http://www.google.com/search?q=cross+site+scripting
I don't really understand the problem, but I do know that it's real.

3. Are you even allowed to load CSS from any arbitrary URL, or does it give 
you the same errors?

4. Why can't just you put the XSL on the same domain?
<aside>I wonder what would happen if you put it there as an HTTP redirect to 
the "real one" out on the web?</aside>

-Wayne Steele


>From: "Sebastian Schnitzenbaumer" <schnitz@m...>
>To: "Wayne Steele" 
><xmlmaster@h...>,<jim@a...>,<xml-dev@l...>
>Subject: RE:  What the .... ? Referencing XSL stylesheets across 
>domains
>Date: Thu, 15 Aug 2002 01:07:42 +0200
>
>Wayne,
>
>thanks for checking.
>
>I have my blog in RSS. I want to see the RSS file
>with an XSL stylesheet from somewhere else
>on the web and allow other people to see this too.
>(ie. a XSL for printing as a web service)
>
>I have to expect IE users won't see this page
>until they add my site to the trusted zone. I do
>see a problem here. They don't understand why all this
>is necessary, it's supposed to be a stylesheet
>and just work over the web, like CSS does.
>Instead it seems like it is being handled as a
>program that needs local quarantine. Why is it
>dangerous to load an XSL from somewhere else?
>
>- Sebastian
>
>
>
>	-----Ursprüngliche Nachricht-----
>	Von: Wayne Steele
>	Gesendet: Mi 14.08.2002 21:23
>	An: jim@a...; xml-dev@l...
>	Cc: Sebastian Schnitzenbaumer
>	Betreff: RE:  What the .... ? Referencing XSL
>stylesheets across domains
>
>
>
>	I just verified the behaviour you're reporting (in IE6).
>	But if I add markuplanguage.oss4u.de to the "Trusted Sites" zone
>in IE, and
>	allow cross-domain scripting for these sites, everything works
>fine.
>
>	I don't think there's a problem here.
>
>	-Wayne Steele
>
>	>From: Jim Ancona <scarhill@y...>
>	>Reply-To: jim@a...
>	>To: xml-dev@l...
>	>CC: Sebastian Schnitzenbaumer <schnitz@m...>
>	>Subject: RE:  What the .... ? Referencing XSL
>stylesheets across
>	>domains
>	>Date: Thu, 8 Aug 2002 09:10:05 -0700 (PDT)
>	>
>	>--- Sebastian Schnitzenbaumer <schnitz@m...> wrote:
>	> > http://markuplanguage.oss4u.de/test3.xml
>	> > references
>http://www.w3.org/Style/XSL/stylesheets/public2html.xsl
>	> >
>	> > This works in Mozilla (the result looks bogus, I'm just
>testing), my IE6
>	> > says access denied. I just want to hear from someone "yes,
>this is true,
>	> > we've known this for years, or, no, actually it does work,
>you must
>	> > have some other bug". Please let me know...
>	>
>	>Note that MSDN[1] says the URI in the xsl-stylesheet PI "is the
>Uniform
>	>Resource Identifier (URI) of the style sheet. This URI is
>relative to the
>	>location of the XML document itself." The W3C REC that defines
>the PI[2]
>	>has no
>	>such restriction.
>	>
>	>Since Microsoft allows the <msxsl:script> extension which
>permits embedded
>	>script code in stylesheets, it might be that this behavior is
>designed to
>	>prevent some kind of cross-site scripting exploit.
>	>
>	>Jim
>	>
>	>[1] -
>
> >http://msdn.microsoft.com/library/default.asp?url=/library/en-us/xmlsdk
>/htm/xml_concepts_369f.asp
>	>
>	>[2] - http://www.w3.org/TR/xml-stylesheet/
>	>
>	>=====
>	>Jim Ancona
>	>jim@a...                     jancona@x...
>
>
>
>_________________________________________________________________
>	Send and receive Hotmail on your mobile device:
>http://mobile.msn.com
>
>
>




_________________________________________________________________
Join the world’s largest e-mail service with MSN Hotmail. 
http://www.hotmail.com

• Prev by Date: RE: SLAIX (was: Can XLink be fixed)
• Next by Date: Re: Re: Can XLink be fixed?
• Previous by thread: RE: What the .... ? Referencing XSL stylesheets across domains
• Next by thread: RE: What the .... ? Referencing XSL stylesheets across domains
• Index(es):
  • Date
  • Thread