Re: XPath/XQuery and all that - ACTION-3

> Right. So the possibly-just-about-relevant concern here would
> be that WSC does such a fine job on the lower-hanging fruit
> that bad actors move to (ab-)using these less well known
> "advanced" XML technologies. (I have a general concern that
> many of these XML technologies are being developed with no or
> few accompanying security considerations, but that's not a WSC
> thing.)

It doesn't sound like it's in charter, unless it can be used to subvert 
the robustness of mechanisms that present sec ctx info to the end user. As 
future looking examples, if we recommending blocking visual or chrome 
areas, then XPath could only be a concern if it could overwrite those. Of 
if there were "shared secrets" in memory, XPath would only be a concern if 
they leaked those secrets to someone who shouldn't share them. 

        Mez