Closed Bug 650844 Opened 13 years ago Closed 13 years ago

Does not load XML stylesheet from a parent directory

Categories

(Firefox :: File Handling, defect)

Product:
Firefox
Component:
File Handling
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED DUPLICATE of bug 397894

People

(Reporter: mhedblom, Unassigned)

Details

User-Agent:       Mozilla/5.0 (Windows NT 5.1; rv:2.0) Gecko/20100101 Firefox/4.0
Build Identifier: Mozilla/5.0 (Windows NT 5.1; rv:2.0) Gecko/20100101 Firefox/4.0

The XML stylesheet is not used when it is located in a parent directory.  Such as in this example:

<?xml version="1.0" encoding="utf-8"?>
<?xml-stylesheet type="text/xsl" href="../parent_stylesheet.xsl"?>
<catalog>
  <cd>
   ...
  </cd>
</catalog>

However, when the stylesheet is in the local directory, it is used.

<?xml-stylesheet type="text/xsl" href="local_stylesheet.xsl"?>

Note that MS IE correctly loads and uses stylesheets in the parent directory.


Reproducible: Always

Steps to Reproduce:
1. Create a XML file in a subdirectory, like this:

<?xml version="1.0" encoding="utf-8"?>
<?xml-stylesheet type="text/xsl" href="../parent_stylesheet.xsl"?>
<catalog>
  <cd>
    <title>King of California</title>
    <artist>Dave Alvin</artist>
  </cd>
</catalog>

2. In the parent directory, create the XSL:

<?xml version="1.0" encoding="ISO-8859-1"?>
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
<xsl:template match="/">
  <html>
  <body>
  <table border="0">
    <tr bgcolor="#ffffcc">
      <th>Title</th>
      <th>Artist</th>
    </tr>
    <tr>
      <td><xsl:value-of select="catalog/cd/title"/></td>
      <td><xsl:value-of select="catalog/cd/artist"/></td>
    </tr>
  </table>
  </body>
  </html>
</xsl:template>
</xsl:stylesheet>

3. Load the XML file into FireFox.

However, if you move the XSL into the local directory, and change the reference, it loads correctly.

<?xml-stylesheet type="text/xsl" href="parent_stylesheet.xsl"?>

Actual Results:  
The stylesheet is not interpreted when it is in the parent directory.

Expected Results:  
The stylesheet should be interpreted.  (MS IE correctly uses it.)
This is for privacy reasons. Unrestricted access would allow one file owned by the user (but which came from some website) to read some other file owned by the user (that the website isn't supposed to have access to) and then phone the contents home.
Status: UNCONFIRMED → RESOLVED
Closed: 13 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.