RE: [xsl] The evaluate function

[Joerg Pietschmann <joerg.pietschmann@xxxxxx>]

Apart from all the issues mentioned by Mr.Kay, an eval()
function makes it rather easy to open security holes in
a style sheet.
For example, once you figured out you can put a XPath into
the nice "Enter your query here" field which is passed
directly to an eval() function, what will stop you from
entering
 document("file:///C/Documents and Settings/Administrator/preferences.xml")?
 :-)
Or, if extension functions may be called indiscriminately:
 mswin:delete("C:\*.*","recursive")

Regards
J.Pietschmann

 XSL-List info and archive:  http://www.mulberrytech.com/xsl/xsl-list