Re: XSLT style sheets

Brad Hill wrote:
> I'm also concerned here that the XSLTProcessor.importStylesheet()
> appears to allow the stylesheet to be loaded from any DOM node,
> including in the current document? This is equivalent to an inline
> <script> block and would also have to be subject to the same CSP
> restrictions that inline script is.

JavaScipt can pull out any content from the DOM and eval() it, which seems like basically the same problem. With eval(), you are using the JavaScript interpreter; with importStylesheet(), you are using the XSLT processor. The directive that restricts eval() should restrict importStylesheet().


Received on Tuesday, 14 June 2011 19:17:07 UTC