[xsl] XSLT programs that blur the distinction between program and data?

["Roger L Costello costello@xxxxxxxxx" <xsl-list-service@xxxxxxxxxxxxxxxxxxxxxx>]

Michael Kay wrote this on March 29, 2022:

> we're using operating systems whose security model is
> 50 years out of date. Where there's a strong distinction
> between "programs" and "data" that's unrealistic in
> today's world

Fascinating!

What are the ways that XSLT programs blur the distinction between program and
data?

I think there are two ways:

(1) An XSLT program may have some embedded XML that the program uses. That
embedded XML is both part of the program and it is data for the program; so it
is both program and data. That is definitely blurring the distinction between
program and data!

(2) An XSLT program can modify itself at runtime. [Is this possible? Can one
part of XSLT program treat another part of the program as data, modify it, and
then continue running but with the modified program?]

What other ways do XSLT programs blur the distinction between program and
data?

Is there a classic use case for (1)? That is, is there a classic use case for
an XSLT program that uses embedded XML data?

Is there a classic use case for (2)?

/Roger