Re: document() function query

Steve Benner wrote:

> At 12:58 pm +0100 5/2/05, Martin Honnen wrote:
> 
>>
>> The FAQ
>>   <http://www.mozilla.org/projects/xslt/faq.html>
>> says that a stylesheet is not loaded from a different domain for 
>> security reasons, from what you describe the same seems to apply for 
>> any attempt to load a secondary XML input from a different domain.
>>
> 
> Yes, I'd seen that and wondered whether my problem was related in some 
> way to it.  While it makes perfect(ish) sense to apply this restriction 
> to stylesheets, I can see no justification for constraining datasources 
> in this way, as it represents a major reduction in the function's 
> usefulness.  The XSLT specs certainly suggest it should operate across 
> domains.  I can't see any appropriate Bugzilla entries but am sorely 
> tempted to raise one.

I have tried an example (XML and XSLT stylesheet on localhost, secondary 
XML input on internet host) with Firefox 1.0, it is intentionally not 
allowing the access, the JavaScript console (which despite its name is 
now used for all kinds of messages) shows a message

Security Error: Content at 
http://localhost/javascript/test2005020501.xml may not load data from 
http://home.arcor.de/martin.honnen/xslt/test2005020502.xml.

so while you can of course file a bug I don't think it will be fixed. It 
is simply inside a browser a security risk if data from other domains 
can be loaded by tools like script or XSLT which can manipulate it and 
incorporate it into context of a different domain.

Even IE (well at least IE 6 on Windows XP SP 2 here) when I try my test 
page from localhost first informs me that there is an attempt to access 
data from a different domain and asks me to confirm or deny that. And IE 
has a special security zone for localhost (intranet), I guess if you 
tried the same with XML and a stylesheet on a normal internet host then 
with the normal security settings for the internet zone IE would 
disallow the access without asking the user.

But maybe one of the Mozilla XSLT guys can tell you more.


-- 

	Martin Honnen
	http://JavaScript.FAQTs.com/