Re: document() function query

At 4:01 pm +0100 5/2/05, Martin Honnen wrote:
>
>I have tried an example (XML and XSLT stylesheet on localhost, 
>secondary XML input on internet host) with Firefox 1.0, it is 
>intentionally not allowing the access, the JavaScript console (which 
>despite its name is now used for all kinds of messages) shows a 
>message
>
>Security Error: Content at 
>http://localhost/javascript/test2005020501.xml may not load data 
>from http://home.arcor.de/martin.honnen/xslt/test2005020502.xml.
>
>[snip]
>
>But maybe one of the Mozilla XSLT guys can tell you more.



Thanks for taking the time to experiment, Martin and thanks too for 
the tip about the javascript console; it had just never occurred to 
me to look there for XSLT error messages!  I'm certainly very 
grateful for that info! :)

And yes, I can now see that this is more of a feature than a bug, 
though I have to say I consider that it is an unnecessarily 
restrictive one and one that is likely to have profoundly limiting 
effect on current inter-site cooperative working.  I'd certainly 
welcome a chance to debate the logic of this with the Mozilla XSLT 
guys.

My own particular interest arises as follows: as an Amazon.com (and 
amazon.co.uk) associate site, Amazon make available to me information 
from within their on-line catalog in order that I can enrich my own 
site with information drawn from theirs.  (Works both ways of course, 
by my site referring customers to amazon to make purchases.)  No 
doubt many others on this list use the same service.  Now, the thing 
is, I could do all of the necessary calls to Amazon from my own 
server, and then massage the resulting XML feeds (from my database 
and theirs) prior to delivery.  But to do that requires a level of 
XML parsing in my server-side code that is non-trivial and would, in 
fact, be much better done using XSLT at the browser end, with an XSLT 
stylesheet from my site simply notifying the browser what info to 
collect from Amazon and how to incorporate that info into my page. 
This reduces the load on my server and reduces the overall amount of 
network traffic involved in delivering the page.  Which strikes me as 
good thing all round, no?  I'd be interested to know just what 
particular security issue this restriction addresses that cannot be 
fairly easily circumvented by server-side code of some kind or 
another.   To my mind, I am doing nothing different from, say, 
incorporating img tags that reference images from other domains.  The 
web is all about interconnectivity; it seems silly to me to limit the 
document() function in this way by sacrificing much of its power and 
usefulness simply because it offers scope for abuse.

-Steve