Summary: As has been described through other channels, XSLT is a rarely-used feature with a track record of being the source of many security issues. Most of its features have been directly superseded by other web platform functionality, and it’s lingering at a sub 0.1% use count. There are of course risks with removing a web feature but the arguments that the benefits outweigh the risk is exceptionally strong. For web developers, an option to mitigate breakage can be to use a polyfill[1], and for users an extension[2].
Removal would follow the conservative approach of: 1. Offer an Enterprise Policy and a pref to disable XSLT support. (Already done.) 2. Disable in Nightly as soon as possible. 3. Disable in all channels in August 2027. This is when Chromium plans to remove their deprecation trial and enterprise policy (so that XSLT is disabled for all users). 4. After that, entirely purge the code base of XSLT and corresponding tests. Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1990759 Specification: https://www.w3.org/TR/xslt-10/ Standards Body: W3C Platform Coverage: Initially this will ship to Nightly in https://bugzilla.mozilla.org/show_bug.cgi?id=2028408, for all platforms. Deprecation for all channels through https://bugzilla.mozilla.org/show_bug.cgi?id=2066712, and removal https://bugzilla.mozilla.org/show_bug.cgi?id=1990759. Preference: Deprecation is done through the pref “dom.xslt.enabled” DevTools Bug: None. Extensions Bug: None Use Counter: use.counter.page.xsltprocessor_constructor Standards-Positions Discussion: https://github.com/mozilla/standards-positions/issues/1287 Other Browsers: - Blink: intent emailed https://groups.google.com/a/chromium.org/g/blink-dev/c/CxL4gYZeSJA/m/yNs4EsD5AQAJ - WebKit: cautiously supportive https://github.com/whatwg/html/issues/11523#issuecomment-3149280766 web-platform-tests: https://wpt.fyi/results/xml/xslt [1] https://github.com/mfreed7/xslt_polyfill [2] https://addons.mozilla.org/firefox/search/?q=xslt+polyfill -- You received this message because you are subscribed to the Google Groups "[email protected]" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/a/mozilla.org/d/msgid/dev-platform/CACvK8H%2BwWOyW%2BsKK1RbEgaL4r%2BnQqnW6ib9fFiRNTg%2BS3jy7cQ%40mail.gmail.com.
