RE: XSLT 2.0: Security concerns

> Yet another.  Long running stylesheets or infinite loops.  
> That's easy just kill the thread if it doesn't terminate 
> after a certain amount of time, say, 100 milliseconds.

One way of handling this in Saxon is by writing a TraceListener that
monitors execution. It may be possible to write a loop that doesn't generate
any calls on the TraceListener, but you would have to try quite hard. You
would certainly catch the people who have written long-running stylesheets
as a result of stupidity rather than out of deliberate malice.

Michael Kay
http://www.saxonica.com/