Will Firefox do XSLT on external entities?

Question

What I'm trying to do is take an XML document, let's say http://example.org/data.xml and show it with an XSL stylesheet applied. (I cannot modify the document itself and add a directive)

So there are a couple of utility XML files like this:

wrapper.xml:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE wrapper [
  <!ENTITY content SYSTEM "http://example.org/data.xml"&gt;
]>
<?xml-stylesheet type="text/xsl" href="unwrap.xsl" ?>
<wrapper>
  &content;
</wrapper>

unwrap.xsl:

<?xml version="1.0" encoding="utf-8"?>
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"&gt;
  <xsl:import href="stylesheet.xsl"/>

  <xsl:template match="/wrapper/node()[1]">
    <xsl:apply-imports/>
  </xsl:template>
</xsl:stylesheet>

So to summarize: stylesheet.xsl is written for http://example.org/data.xml, the browser is pointed to wrapper.xml and the user should see the transformed http://example.org/data.xml.

This is one of those rare cases where things work as expected in IE (and Chrome) but not Firefox.

AFAIK Firefox supports external XML entities, but it seems like they are invisible in XSL code. I found this article from 2006, it describes this problem in Firefox 1.5 (I'm using 3.5.3)

Is there any workaround for this?

Answer 1

That XML looks familiar ;)

Currently, FireFox will not load external DTD's and entity references, because of security and Denial of Service concerns. For example: http://en.wikipedia.org/wiki/Billion_laughs

There is an open Mozilla bug describing the reasons why and lengthy debate about whether or not to make it something that is configurable: https://bugzilla.mozilla.org/show_bug.cgi?id=22942

There does appear to be one workaround to loading DTDs, but I'm guessing that probably isn't a viable solution for you.

Firefox will load local DTD files

if you put them in this directory for Windows:

C:\Program Files\Mozilla Firefox\res\dtd\...

The directory for Linux:

/**mileage may vary**/MozillaFirefox/lib/res/dtd/

One idea to get around using the entity reference: If you can control the content of the wrapper.xml, then you could fetch the contents of http://example.org/data.xml (server side) and echo it out as the full contents of the wrapper file, with the addition of the Stylesheet Processing Instruction(assuming you have some dynamic server-side capabilities).