How can I make XSLT work in chrome?

xslt google-chrome
Eric picture Eric · Jun 5, 2010 · Viewed 104.9k times · Source

I have an XML document here that is served with a corresponding XSL file. The transformation is left to be executed client-side, without JavaScript.

This works fine in IE (shock horror), but in Google Chrome, just displays the document's text nodes.

I know that it is possible to do client-side XSL in Chrome, as I have seen examples of it, but I am yet to be able to replicate this success myself

What am I doing wrong?

Answer

Pacerier picture Pacerier · Jun 6, 2011

The other answer below by Eric is wrong. The namespace declaration he mentioned had nothing to do with the problem.

The real reason it doesn't work is due to security concerns (cf. issue 4197, issue 111905).

Imagine this scenario:

  1. You receive an email message from an attacker containing a web page as an attachment, which you download.

  2. You open the now-local web page in your browser.

  3. The local web page creates an <iframe> whose source is https://mail.google.com/mail/.

  4. Because you are logged in to Gmail, the frame loads the messages in your inbox.

  5. The local web page reads the contents of the frame by using JavaScript to access frames[0].document.documentElement.innerHTML. (An online web page would not be able to perform this step because it would come from a non-Gmail origin; the same-origin policy would cause the read to fail.)

  6. The local web page places the contents of your inbox into a <textarea> and submits the data via a form POST to the attacker's web server. Now the attacker has your inbox, which may be useful for spamming or identify theft.

Chrome foils the above scenario by putting restrictions on local files opened using Chrome. To overcome these restrictions, we've got two solutions:

  1. Try running Chrome with the --allow-file-access-from-files flag. I've not tested this myself, but if it works, your system will now also be vulnerable to scenarios of the kind mentioned above.

  2. Upload it to a host, and problem solved.

Related questions

Can Chrome be made to perform an XSL transform on a local file?

I was looking into xslt and started testing with the examples on w3schools. However, when I save the xml and xsl in files and try opening them locally, chrome won't perform the xsl transform. It just shows a blank …

Read More
Check if a string is null or empty in XSLT

How can I check if a value is null or empty with XSL? For example, if categoryName is empty? I'm using a when choosing construct. For example: <xsl:choose> <xsl:when test="categoryName !=null"> <xsl:…

Read More
How to implement if-else statement in XSLT?

I am trying to implement an if -else statement in XSLT but my code just doesn't parse. Does anyone have any ideas? <xsl:variable name="CreatedDate" select="@createDate"/> <xsl:variable name="IDAppendedDate" select="2012-01-01" /> <…

Read More