[XSL-LIST Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Can an XSLT document invoke arbitrary extension funct

Subject: Can an XSLT document invoke arbitrary extension functions?
From: "Costello, Roger L." <costello@xxxxxxxxx>
Date: Mon, 26 Oct 2009 16:40:21 -0400
 Can an XSLT document invoke arbitrary extension  funct
Hi Folks,

Below is an XSLT transform that - supposedly - opens a DOS command prompt. I
saw the XSLT transform in this [1] briefing (slide 132). I ran it. It doesn't
work; it just produces an error.

The briefing seems to suggest that XSLT is riddled with security leaks, as any
XSLT transform can invoke pretty much any arbitrary function (apparently
including, as the below XSLT transform shows, any arbitrary Windows function).


1. Should the below XSLT Transform work? (i.e. is there simply a minor bug in
it, that when fixed, would make it operate as desired?)

2. Is there any control over the set of extension functions provided by XSLT

3. How do you respond to the briefing's suggestions that XSLT is riddled with
security leaks? (I realize this is a broad question; any thoughts you have
would be appreciated)

<?xml version="1.0"?>
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
                extension-element-prefixes="rt ob"

    <xsl:template match="/">
        <xsl:variable name="runTimeObject" select="rt:getRuntime()"/>
        <xsl:variable name="command"
        <xsl:variable name="commandAsString" select="ob:toString($command)"/>
        <xsl:value-of select="$commandAsString"/>




Current Thread


Purchasing Stylus Studio from our online shop is Easy, Secure and Value Priced!

Buy Stylus Studio Now

Download The World's Best XML IDE!

Accelerate XML development with our award-winning XML IDE - Download a free trial today!

Don't miss another message! Subscribe to this list today.
First Name
Last Name
Subscribe in XML format
RSS 2.0
Atom 0.3
Site Map | Privacy Policy | Terms of Use | Trademarks
Free Stylus Studio XML Training:
W3C Member
Stylus Studio® and DataDirect XQuery ™are products from DataDirect Technologies, is a registered trademark of Progress Software Corporation, in the U.S. and other countries. © 2004-2013 All Rights Reserved.