RE: About xsl:scripts

Subject: RE: About xsl:scripts
From: "Didier PH Martin" <martind@xxxxxxxxxxxxx>
Date: Wed, 14 Apr 1999 09:38:17 -0400
Hi Jonathan,

<Comment>
	Except that you can create objects client side using JavaScript embedded in
HTML documents. On the client side, they need to be marked "Safe For
Scripting" to enable this...
</comment>

<reply>
It seems that objects even marked "safe to script" are not instantiated. So
the CreateObject function seems to be removed from the script language. I
didn't made any test with PythonScript or PerScript if that would be the
case with these script language too. If yes, this means that the
CreateObject function is part of the interface given by the script host to
the script engine. As you know, a script host can provide a default
interface to the script engine and that interface contains default member,
objects available to the script language. I thought up to now that
CreateObject was part of the language, but maybe it is part of the default
interface given by the script host. Anyway it would make sense if it is that
way. Did you made any test on this? do you have more info that may help?
</reply>


<Comment>
	I'm hazy on the exact details, but the gist is that IE implements something
like the IServiceProvider interface which 'filters' the creation of objects
using the CATID_SafeForScripting...

	I'd suspect that the problem is that the XSL embedded script does not get
hooked into the containing service provider interface as it would in an HTML
page... just some wild guesses...
<Comment>

<reply>
in that case we won't have the same type of error. You are right, within the
browser context (and not in other script host context - this is specific to
the browser) the browser ask for the interface IObjectSafety and the object
can then say to the host if it is safe in the browser environment. I created
a Script engine for the MCF/MCL language (a language co designed with RV.
Guha before Netscape took the name for something else at the same time they
hired RV. Guha ;-), I noticed that within the ASP environment, this
interface is never called, Within the Windows Script Host environment this
interface is not called either. Only in the browser we get a query interface
to call this interface. So, only the browser host ask for this interface.
But in the case of the script contained in XSL it does not seems to be the
case. I think that this interface is not even called. Therefore, the host
(i.e. the XSL script engine) do not allow object creation and do not ask for
this interface too. However, I am not 100% sure of this, we would have to
trace, or that somebody from Microsoft just tell us the real mechanism.
</reply>

regards
Didier PH Martin
mailto:martind@xxxxxxxxxxxxx
http://www.netfolder.com


 XSL-List info and archive:  http://www.mulberrytech.com/xsl/xsl-list


Current Thread