Hmm. Well, something's not working as expected. The public ID in the
file referenced by document() is valid and is recognized by XXE. (I can
open the file in XXE without a problem.) But, as I said, the XSLT
process can't resolve the public ID.

Can I send you some sample files to try and reproduce?



-----Original Message-----
From: Hussein Shafie [mailto:[email protected]] 
Sent: Wednesday, August 09, 2006 2:39 AM
To: Mark Fletcher
Cc: xmleditor-support at xmlmind.com
Subject: Re: [XXE] Trying to use document() in a transform command

Mark Fletcher wrote:
> My custom stylesheet uses the document() function. After much trial 
> and error, I've found that the PUBLIC ID in the document's DOCTYPE 
> identifier is not being used to find its dtd; only the system path is 
> used, so XXE complains with: "Warning: Failure reading file: ...". If 
> I change the system path to a full path to the dtd, or if I remove the

> DOCTYPE declaration altogether, the problem goes away.
>  
> Is this expected behavior? Is there any way to configure XXE to get 
> around this issue, ie. turn off validation during transform, or map 
> Saxon's resolver to the XXE catalogs?
>  

I'm sorry but I don't understand.

* If you use the document() function in xpath() expressions in a CSS
style sheet, you'll automatically use XXE catalogs.

* If you use the document() in XSLT style sheets invoked using the
<transform> element of a <process> command, you'll automatically use XXE
catalogs.





Reply via email to