Mark Fletcher wrote:
> My custom stylesheet uses the document() function. After much trial and
> error, I've found that the PUBLIC ID in the document's DOCTYPE
> identifier is not being used to find its dtd; only the system path is
> used, so XXE complains with: "Warning: Failure reading file: ...". If I
> change the system path to a full path to the dtd, or if I remove the
> DOCTYPE declaration altogether, the problem goes away.
>  
> Is this expected behavior? Is there any way to configure XXE to get
> around this issue, ie. turn off validation during transform, or map
> Saxon's resolver to the XXE catalogs?
>  

I'm sorry but I don't understand.

* If you use the document() function in xpath() expressions in a CSS
style sheet, you'll automatically use XXE catalogs.

* If you use the document() in XSLT style sheets invoked using the
<transform> element of a <process> command, you'll automatically use XXE
catalogs.


Reply via email to