439924 - Relative path for xml-stylesheet doesn't support more than 3 backward steps

Status: RESOLVED INVALID

(Firefox :: File Handling, defect)

Description

[tonttuh]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.9) Gecko/2008052906 Firefox/3.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.9) Gecko/2008052906 Firefox/3.0

xml-stylesheet href location doesn't support more than 3 backward steps in the relative path (backward step here meaning "..\" components in the path).

Reproducible: Always

Steps to Reproduce:
1. create valid xml file and stylesheet
2. create a directory structure where the stylesheet is at the bottom of hierarchy and the xml file is in a path eg a/b/c/d/g/style.xslt
3. open the xml file in firefox
Actual Results:  
Stylesheet is not found

Expected Results:  
Stylesheet would have been found and used in rendering the page

Tested only with xml and xslt stylesheets and using file:// protocol.

Comment 1

[Johnathan]

In addition, it appears that you cannot specify an absolute file:// xml-stylesheet tag and have it work without the stylesheet being in a subdirectory. 

Ex:

/path/to/xml/something.xml 

with xml-stylesheet of /path/to/xsl/something.xsl

will not work. 

However, any depth of /path/to/xml/a/b/d/something.xsl will work! No indications in error console to suggest its a security issue and RFC states this should be allowed.

Tested on Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.5) Gecko/2008121622 Ubuntu/8.10 (intrepid) Firefox/3.0.5

Comment 2

[Nicholas Smethurst]

Attachment: Example of stylesheet in parent directory bug.

Comment 3

[Nicholas Smethurst]

I tested this on a webserver.. the problem only occurs on local files.

On my version of Firefox (3.05, Ubuntu 8.10), a stylesheet in the immediate parent directory does not work. I've attached an example.

This bug effectively prevents Firefox from being used to display translated local XML (docbook for example).. very irritating.

Comment 4

[Jochem Heicke]

Any absolute referenced local style-sheet will be ignored if the referencing file is not on the same filesystem.

The problem appeared and was checked with German Tax program ELSTER.
The user receives a responding file when sending his tax data.
If the responding file is not stored on the same drive, it can not displayed with Firefox. (Seamonkey is ok!!!, Opera too, but needs non-DOS path delimiters)


<?xml version="1.0"  ?>
<?xml-stylesheet type="text/xsl" href="file:///E:/Programme/ElsterFormular/2008-2009/stylesheet/ustva.xsl" ?>
<Elster xmlns="http://www.elster.de/2002/XMLSchema">

Comment 5

[Tim (fmdeveloper)]

Reporter -> Are you still experiencing this issue with the latest version of Firefox 3.6.15? Does the issue occur with the latest nightly? http://nightly.mozilla.org/

Comment 6

[Tim (fmdeveloper)]

Closing bug as Incomplete - if you are still experiencing this issue or have more information to provide feel free to post back here and we can re-open the bug. You can also get assistance by visiting the Firefox help site -> http://support.mozilla.com/en-US/kb/Ask+a+question

Comment 7

[Peter Lyons Kehl]

I can still replicate this bug with Firefox 32.0.

I use file:// protocol. As stated above, Firefox doesn't load .xsl files unless they are in a subdirectory. It doesn't follow any ../ links, no matter whether 3 or less or more levels up. As stated by Johnathan, it doesn't load .xsl files from the same folder as .xml file, either.

In addition to the above:

On filesystems that support symlinks (Fedora 20), Firefox doesn't follow symlinks for .xsl files. If you have .xsl which is a symlink to a folder outside of .xml's folder, then Firefox doesn't apply that .xsl.

Also, it ignores relative references like above in xsl:include and xsl:import:

<?xml version='1.0' encoding="UTF-8"?>
<xsl:stylesheet
    version="1.0"
    xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
<xsl:include href="../../../../../selenese_reference_to_html.xsl" />
</xsl:stylesheet>

Please re-open and investigate.

Comment 8

[Jochem Heicke]

(In reply to Peter Kehl from comment #7)
> I can still replicate this bug with Firefox 32.0.
> 
> I use file:// protocol. As stated above, Firefox doesn't load .xsl files

Not supporting the file protocol makes a browser less useful.
And ignoring symlinks makes it impossible to have a workaround for this bug.

I consider this a mayor bug

Comment 9

[Peter Lyons Kehl]

Please re-open this issue, as per comment #7 and comment #8.

Comment 10

[Masatoshi Kimura [:emk]]

Flip the "security.fileuri.strict_origin_policy" pref in about:config at your own risk.

Comment 12

[Peter Lyons Kehl]

Again, please re-open this issue, as per comment #6: "...if you are still experiencing this issue or have more information to provide feel free to post back here and we can re-open the bug"

See my explanation in comment #7 and by Johnathan. Changing "security.fileuri.strict_origin_policy" is not a solution, since this should work as per RFC.

Comment 13

[Masatoshi Kimura [:emk]]

We have to intentionally violate RFC for the security reason. Comment #6 was posted before the problem is investigated.