Re: [xsl] HTML5 semantics and XSLT

Subject: Re: [xsl] HTML5 semantics and XSLT
From: "Piez, Wendell A. (Fed) wendell.piez@xxxxxxxx" <xsl-list-service@xxxxxxxxxxxxxxxxxxxxxx>
Date: Wed, 23 Feb 2022 19:33:52 -0000
Hi Liam,

Okay, this is fair enough, but what exactly is the XSLT developer to do?

Here, after all, we have a case of a supposed security vulnerability that is
arguably less likely than a dozen or a hundred others, which is being
attributed to the deployment of a transformation that is working as designed,
on inputs that must be maliciously contrived and do not ordinarily appear in
the wild.

The reporter of the weakness in question seems to have gone to some trouble to
find a way to get a script to execute outside one of those sandboxes. It
appears that one way is to worm it in through OpenOffice using an email
client's "preview" feature. Yet the capability, once the worm is in, is to
work just like a web page. This looks like it shouldn't be our problem. Yet
somehow it is.

David C has helped a little with the question of how to defend against this
kind of thing but in the air is still the question of whether we do or why we
should. I'm afraid we don't have much choice.

Cheers, Wendell

-----Original Message-----
From: Liam R. E. Quin liam@xxxxxxxxxxxxxxxx
Sent: Wednesday, February 23, 2022 2:04 PM
To: xsl-list@xxxxxxxxxxxxxxxxxxxxxx
Subject: Re: [xsl] HTML5 semantics and XSLT

On Wed, 2022-02-23 at 18:37 +0000, Piez, Wendell A. (Fed)
wendell.piez@xxxxxxxx wrote:
> Hi again,
> To Mike's question "And presumably any harm that can be done using
> this exploit could equally be done by executing untrusted HTML in the
> browser directly?"
> Indeed it could.

This is why there are sandbox facilities in HTML, in which you can say,
"beneath this element, no scripting is allowed and any additional CSS rules
will be ignored". The mechanism gives separate control over script, style,


Available for XML/Document/Information Architecture/XSLT/ XSL/XQuery/Web/Text
Processing/A11Y training, work & consulting.
Barefoot Web-slave, antique illustrations:;

Current Thread