[xsl] XSLT extensions and how to disable them

["Costello, Roger L." <costello@xxxxxxxxx>]

Hi Folks,

I examined two popular XSLT processors for the purpose of determining what
extensions they support and whether they provide the ability to turn off the
extensions:

    1. SAXON, version 9.2.0.3, Java edition.

    2. XALAN, version 2.7.0.1, Java edition.

Below is the result of my analysis.

I have a question for you. With regard to the specific XSLT processors I
analyzed:

       Is my analysis complete, i.e., do these XSLT processors
       provide extensions that I have not shown?


------------------------------------------------
                 SAXON
------------------------------------------------

SAXON supports four kinds of extensions:

    1. A stylesheet can invoke Java methods.

    2. A stylesheet can invoke functions in the EXSLT library [1].

    3. The SAXON processor comes equipped with its
       own built-in extension functions and elements [2];
       a stylesheet can invoke any of these.

    4. A developer can implement a Java function and
       then register it with the SAXON processor. This
       is called an integrated extension function [3].
       A stylesheet can invoke the developer-created
       function.


I created a stylesheet to illustrate the use of three kinds of extensions (I
do not show the use of an integrated extension function):


<?xml version="1.0"?>
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform";
                xmlns:java="java:java.lang.Math"
                xmlns:exslt="http://exslt.org/math";
                xmlns:saxon="http://saxon.sf.net/";
                extension-element-prefixes="java exslt"
                version="2.0">

    <xsl:template match="/" >

            <xsl:value-of select="java:sqrt(2)" />
            <xsl:value-of select="exslt:abs(8 - 12)" />
            <xsl:value-of select="saxon:is-whole-number(1.23)" />

    </xsl:template>

</xsl:stylesheet>


The first value-of element outputs the result of invoking the Java square root
method. The second value-of element outputs the result of invoking the EXSLT
absolute value function. The third value-of element outputs the result of
invoking the SAXON-built-in is-whole-number function.


DISABLING EXTENSIONS

SAXON provides an "ext" flag for turning on or off access to extensions.

When a stylesheet is run with the ext flag on:

    -ext:on

then all four kinds of extensions are enabled.

When a stylesheet is run with the ext flag off:

    -ext:off

then the Java and EXSLT extensions are disabled; any attempt to use these
extensions results in this error message:

    external function calls have been disabled

The SAXON built-in extensions and the integrated extension functions remain
enabled regardless of whether -ext is on or off. The integrated extension
functions can be disabled by unregistering them with SAXON.


ANALYSIS OF SAXON

1. SAXON supports four kinds of extensions: Java, EXSLT, SAXON-native, and
developer-created (integrated) extensions.

2. The -ext:off flag disables Java and EXSLT extensions; however, the
SAXON-native and integrated extensions remain enabled.

3. With -ext:on then all four kinds of extensions are enabled.

4. The integrated extensions can be disabled by unregistering them with
SAXON.


------------------------------------------------
                 XALAN
------------------------------------------------

XALAN supports three kinds of extensions:

    1. A stylesheet can invoke Java methods

    2. A stylesheet can invoke functions in the EXSLT library

    3. A stylesheet can invoke JavaScript functions

I created a stylesheet to illustrate the use of the three kinds of extension
functions:

<?xml version="1.0"?>
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform";
                xmlns:java="http://xml.apache.org/xalan/java";
                xmlns:exslt="http://exslt.org/math";
                xmlns:xalan="http://xml.apache.org/xalan";
                xmlns:javascript="ext1"
                extension-element-prefixes="exslt java javascript"
                version="2.0">

    <xalan:component prefix="javascript" functions="getDate">
        <xalan:script lang="javascript">

          function getDate()
          {
            var d = new Date();
            return d.toString();
          }

        </xalan:script>
    </xalan:component>

    <xsl:template match="/" >

            <xsl:value-of select="java:java.lang.Math.sqrt(2)" />
            <xsl:value-of select="exslt:abs(8 - 12)" />
            <xsl:value-of select="javascript:getDate()" />

    </xsl:template>

</xsl:stylesheet>

The first value-of element outputs the result of invoking the Java square root
method. The second value-of element outputs the result of invoking the EXSLT
absolute value function. The third value-of element outputs the result of
invoking a JavaScript function, which is defined in the stylesheet.


DISABLING EXTENSIONS

Using JavaScript requires the Apache Bean Scripting Framework (BSF) library
[4], the Apache Commons Logging library [5], and the Rhino JavaScript for Java
library [6]. Thus, to disable JavaScript functions from being used, simply
don't provide these libraries.

There is no mechanism for disabling access to Java or EXSLT.


ANALYSIS OF XALAN

1. XALAN supports three kinds of extensions: Java, EXSLT, and JavaScript.

2. JavaScript can be disabled by simply not providing the required libraries.

3. Access to Java and EXSLT cannot be disabled.


/Roger


[1] http://www.exslt.org/download.html

[2] http://www.saxonica.com/documentation/extensions/intro.html

[3]
http://www.saxonica.com/documentation/extensibility/integratedfunctions.html

[4] http://jakarta.apache.org/site/downloads/downloads_bsf.cgi

[5] http://commons.apache.org/downloads/download_logging.cgi

[6] http://www.mozilla.org/rhino/download.html