W3C home > Mailing lists > Public > public-qt-comments@w3.org > May 2012

[Bug 16151] Security concern about xsl:evaluate

From: <bugzilla@jessica.w3.org>
Date: Thu, 10 May 2012 16:43:23 +0000
To: public-qt-comments@w3.org
Message-Id: <E1SSWSZ-0006xM-Kl@jessica.w3.org>
https://www.w3.org/Bugs/Public/show_bug.cgi?id=16151

--- Comment #5 from Michael Kay <mike@saxonica.com> 2012-05-10 16:43:23 UTC ---
Corrected version of the proposed note:

I have drafted the following (non-normative) Note which I propose adding to the
spec:

<note><p>Stylesheet authors need to be aware of the security risks associated
with the  use of <elcode>xsl:evaluate</elcode>. The instruction should not be
used to execute  code from an untrusted source. To avoid the risk of code
injection,
user-supplied data should never be inserted into the expression using string
concatenation, but  should always be referenced by use of parameters.
Implementations
<rfc2119>should</rfc2119> provide mechanisms allowing calls on
<elcode>xsl:evaluate</elcode> to be disabled.</p></note>

-- 
Configure bugmail: https://www.w3.org/Bugs/Public/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug.
Received on Thursday, 10 May 2012 16:43:29 UTC

This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 16:57:38 UTC