Subject: RE: XSLT 2.0: Security concerns
From: "Michael Kay" <mike@xxxxxxxxxxxx>
Date: Wed, 18 Jul 2007 20:26:24 +0100
|
> Yet another. Long running stylesheets or infinite loops.
> That's easy just kill the thread if it doesn't terminate
> after a certain amount of time, say, 100 milliseconds.
One way of handling this in Saxon is by writing a TraceListener that
monitors execution. It may be possible to write a loop that doesn't generate
any calls on the TraceListener, but you would have to try quite hard. You
would certainly catch the people who have written long-running stylesheets
as a result of stupidity rather than out of deliberate malice.
Michael Kay
http://www.saxonica.com/
|