xml not formatted when in a different path of xsl file

Question

I am trying to open an xml file with firefox. This file contains the line

<?xml-stylesheet type='text/xsl' href='/home/myname/myfolder/Template.xsl'?>

and Template.xsl is a file in the same folder of the xml file. In this way I can correctly display the xml but I need to move it in a different folder. The problem is that if I move the xml into a different folder and try to open it, it doesn't seem to read the xsl file anymore (except if the new folder is one of: /home, /home/myname/ or /home/myname/myfolder). I can't understand this behaviour, because in the href option I am writing the absolut path of the xsl file. Is there any way to visualize the xml if I move it in different path from the xsl file?

Any help is appreciated! Thanks in advance.

Check the console of Firefox for error messages, it will probably tell you that the access was denied. — Martin Honnen, Mar 17 '17 at 18:42

score 0 · Answer 1 · edited Jun 20 '20 at 09:12

IIRC the security measures of FireFox (and even more Chrome) will prevent opening a local file from anywhere but the current directory (of the XML file).

So - if using the XML+XSLT combination for creating your website - keep your XML and your XSLT always in the same directory.

Update:

Chrome: See this SO answer which states that Chrome "has addressed in a controversial way [...] blocking XML files from accessing local XSLT files [even] in the same directory[...]"
FireFox: The general rules concerning the XML+XSLT situation do apply. (Also have a look a the (absolute/relative) filenames in the question of this answer.)

In general, the following comment seems to describe the current state concerning Chrome very well:

XML has different security properties than CSS or JavaScript. In the web security model, CSS and JavaScript are publicly executable, but XML is private. For example, you can run a JavaScript library from another web site, but you can't read their XML. Unfortunately, XSLT has a security flaw where applying an XSLT to your document allows you to read the contents of the XML that makes up the XSLT. That means a malicious document can apply an XSLT (e.g., an file saved by your word processor to your local file system) and steal information from it.

Given his situation, we're faced with a trade-off. We can allow local XSLT, which is a feature that some fraction of the audience will enjoy, but doing so opens a security hole. In this case, we've weighed the alternatives and decided that the security of the many out weighs supporting this feature for the few.

So, FireFox is better than Chrome - but both suck in that regard.

Thanks... So you are telling me that there is no solution to my problem... Unfortunately I can't keep xml and xsl files in the same directory. My xmls are generated by a C++ script and I need to organize them in folders with the daily date — fool, Mar 18 '17 at 16:17
@fool: I extended my answer. You can try relative path's to solve your problem, but I cannot give you any guarantee that this would work. — zx485, Mar 18 '17 at 16:35

xml not formatted when in a different path of xsl file

1 Answers1