Re: XSLT style sheets from Brian Smith on 2011-06-14 (public-web-security@w3.org from June 2011)

From: Brian Smith <bsmith@mozilla.com>
Date: Tue, 14 Jun 2011 12:16:34 -0700 (PDT)
To: Brad Hill <bhill@paypal-inc.com>
Cc: public-web-security@w3.org, Brandon Sterne <bsterne@mozilla.com>, Adam Barth <w3c@adambarth.com>
Message-ID: <974507233.204431.1308078994148.JavaMail.root@zimbra1.shared.sjc1.mozilla.com>

Brad Hill wrote:
> I'm also concerned here that the XSLTProcessor.importStylesheet()
> appears to allow the stylesheet to be loaded from any DOM node,
> including in the current document? This is equivalent to an inline
> <script> block and would also have to be subject to the same CSP
> restrictions that inline script is.

JavaScipt can pull out any content from the DOM and eval() it, which seems like basically the same problem. With eval(), you are using the JavaScript interpreter; with importStylesheet(), you are using the XSLT processor. The directive that restricts eval() should restrict importStylesheet().

Cheers,
Brian

Received on Tuesday, 14 June 2011 19:17:07 UTC