Re: Can an XSLT document invoke arbitrary extension f

Play the video

Subject: Re: Can an XSLT document invoke arbitrary extension functions?
From: Wendell Piez <wapiez@xxxxxxxxxxxxxxxx>
Date: Mon, 26 Oct 2009 18:15:12 -0400

Hi,

I scanned the slides cited and I actually found nothing to disagree with (though it's not my area of expertise). The author is clearly talking about XSLT being used for things it wasn't primarily intended for by developers who are in over their heads and haven't come to terms with what XSLT or XSLT engines can do. If this makes it a security hazard in that application context, that's not really about XSLT but about the way it's being used.

As I see it, that kind of problem actually goes with the territory of its being a powerful and capable technology, not something always to be avoided on principle.

I agree that the particular example of a Xalan extension supposedly being used to execute arbitrary code is over the top; but the argument being made in the slides doesn't actually depend on this example.

Cheers,
Wendell

At 04:40 PM 10/26/2009, Roger wrote:

Hi Folks,

Below is an XSLT transform that - supposedly - opens a DOS command prompt. I saw the XSLT transform in this [1] briefing (slide 132). I ran it. It doesn't work; it just produces an error....

======================================================================
Wendell Piez                            mailto:wapiez@xxxxxxxxxxxxxxxx
Mulberry Technologies, Inc.                http://www.mulberrytech.com
17 West Jefferson Street                    Direct Phone: 301/315-9635
Suite 207                                          Phone: 301/315-9631
Rockville, MD  20850                                 Fax: 301/315-8285
----------------------------------------------------------------------
  Mulberry Technologies: A Consultancy Specializing in SGML and XML
======================================================================

Current Thread

Re: Can an XSLT document invoke arbitrary extension functions?, (continued)
- Michael Kay - 26 Oct 2009 20:59:27 -0000
- Florent Georges - 26 Oct 2009 21:07:45 -0000
- Dimitre Novatchev - 26 Oct 2009 21:42:57 -0000
- Message not available
  - Wendell Piez - 26 Oct 2009 22:43:42 -0000 <=
- Message not available
  - Mark Wilson - 27 Oct 2009 18:00:59 -0000
    - Martin Honnen - 27 Oct 2009 18:09:18 -0000
    - Mark Wilson - 27 Oct 2009 19:08:06 -0000
    - Mark Wilson - 27 Oct 2009 20:10:04 -0000

<- Previous	Index	Next ->
Re: Can an XSLT document invo, Dimitre Novatchev	Thread	XSL-FO group by problem, Mark Wilson
Re: Can an XSLT document invo, Dimitre Novatchev	Date	FOP transform region issue, mark bordelon
	Month

PURCHASE STYLUS STUDIO ONLINE TODAY!

Purchasing Stylus Studio from our online shop is Easy, Secure and Value Priced!

Download The World's Best XML IDE!

Accelerate XML development with our award-winning XML IDE - Download a free trial today!

Subscribe in XML format

RSS 2.0
Atom 0.3

XML Editor - Download a 15 Day Free Trial Now >

See What's New in Stylus Studio >

Buy Stylus Studio - XML Editor - Now >