[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

RE: What the .... ? Referencing XSL stylesheets across domains

• To: jim@a..., xml-dev@l...
• Subject: RE: What the .... ? Referencing XSL stylesheets across domains
• From: "Wayne Steele" <xmlmaster@h...>
• Date: Wed, 14 Aug 2002 12:23:03 -0700
• Bcc:
• Cc: schnitz@m...

I just verified the behaviour you're reporting (in IE6).
But if I add markuplanguage.oss4u.de to the "Trusted Sites" zone in IE, and 
allow cross-domain scripting for these sites, everything works fine.

I don't think there's a problem here.

-Wayne Steele

>From: Jim Ancona <scarhill@y...>
>Reply-To: jim@a...
>To: xml-dev@l...
>CC: Sebastian Schnitzenbaumer <schnitz@m...>
>Subject: RE:  What the .... ? Referencing XSL stylesheets across 
>domains
>Date: Thu, 8 Aug 2002 09:10:05 -0700 (PDT)
>
>--- Sebastian Schnitzenbaumer <schnitz@m...> wrote:
> > http://markuplanguage.oss4u.de/test3.xml
> > references http://www.w3.org/Style/XSL/stylesheets/public2html.xsl
> >
> > This works in Mozilla (the result looks bogus, I'm just testing), my IE6
> > says access denied. I just want to hear from someone "yes, this is true,
> > we've known this for years, or, no, actually it does work, you must
> > have some other bug". Please let me know...
>
>Note that MSDN[1] says the URI in the xsl-stylesheet PI "is the Uniform
>Resource Identifier (URI) of the style sheet. This URI is relative to the
>location of the XML document itself." The W3C REC that defines the PI[2] 
>has no
>such restriction.
>
>Since Microsoft allows the <msxsl:script> extension which permits embedded
>script code in stylesheets, it might be that this behavior is designed to
>prevent some kind of cross-site scripting exploit.
>
>Jim
>
>[1] -
>http://msdn.microsoft.com/library/default.asp?url=/library/en-us/xmlsdk/htm/xml_concepts_369f.asp
>
>[2] - http://www.w3.org/TR/xml-stylesheet/
>
>=====
>Jim Ancona
>jim@a...                     jancona@x...


_________________________________________________________________
Send and receive Hotmail on your mobile device: http://mobile.msn.com

• Prev by Date: SLAIX (was: Can XLink be fixed)
• Next by Date: Re: SLAIX (was: Can XLink be fixed)
• Previous by thread: RE: What the .... ? Referencing XSL stylesheets across domains
• Next by thread: RE: What the .... ? Referencing XSL stylesheets across domains
• Index(es):
  • Date
  • Thread