[XSL-LIST Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message] RE: xsl processors turn off extension functions
Saxon provides this capability, but I don't know of any others. You are right to highlight the importance of this feature. It's surprisingly common to find sites that are prepared to execute untrusted stylesheets, which can cause arbitrary havoc if extension functions are not disabled. Even with extension functions disabled, there's a denial-of-service risk. Michael Kay > -----Original Message----- > From: bry@xxxxxxxxxx [mailto:bry@xxxxxxxxxx] > Sent: 28 June 2004 19:22 > To: xsl-list@xxxxxxxxxxxxxxxxxxxxxx > Subject: xsl processors turn off extension functions > > Anyone know of a resource giving details of different > processors handling of > security for stylesheets containing extension functions, for > example which > processors it is possible to turn off extension function > support when calling an > individual stylesheet. > > If not, what extra security functionality can you think of > that various > processors you work with provide? > > > > > > > --+------------------------------------------------------------------ > XSL-List info and archive: http://www.mulberrytech.com/xsl/xsl-list > To unsubscribe, go to: http://lists.mulberrytech.com/xsl-list/ > or e-mail: <mailto:xsl-list-unsubscribe@xxxxxxxxxxxxxxxxxxxxxx> > --+-- >
|
PURCHASE STYLUS STUDIO ONLINE TODAY!Purchasing Stylus Studio from our online shop is Easy, Secure and Value Priced! Download The World's Best XML IDE!Accelerate XML development with our award-winning XML IDE - Download a free trial today! Subscribe in XML format
|