Post #2751717
2025-08-17 19:05 UTC
@oblomov@sociale.network can't you load XML in a language of your choice (e.g. a JavaScript application) and process and output whatever you like?
Browsers making a trade-off between potential vulnerabilities for billions vs a feature used by a small minority seems like reasonable behavior.
Replies (1)
-
@oblomov@sociale.network 2025-08-17 19:10
@rumpel@chaos.social the whole point of XSLT is that it allows direct view of the XML in browser, *without* wrapper HTML and *without* JavaScript, which is a *much* higher security risk than XSLT. If browsers have a security issue in their XSLT implementation, the solution is to fix the implementation, not to remove XSLT.