Re: XSL Injection, is it possible?

But I do wonder, how would you circumvent an XPath expression such as
this?

select="//page[@name = $pagename]/content[@lang = $lang]/block[@id =
$block_id]"

This expression:


//page[@name = $pagename and anInterestingXPathExpression]

will produce the page with name given by $pagename only when the
"anInterestingXPathExpression" is true.

In this way I could test whether certain elements have certain values, ..., etc.

In case the dynamically generated XPath expression is evaluated within
an XSLT processor, then the document() function is very likely to be
referenced within the injected part of the expression.

The same goes for any extension functions that might be supported.