443459 - FF does not report missing XSL file and renderes unexpected output

Status: NEW

(Core :: XSLT, defect)

Description

[timothy truckle]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9) Gecko/2008052906 Firefox/3.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9) Gecko/2008052906 Firefox/3.0

In case the XML file has an XSL reference to the local file system which does not exist FF renderes the XML file as continous Text stripping all tags.


Reproducible: Always

Steps to Reproduce:
1. add (or replace existing stylesheet tabg with) the tag 
  <?xml-stylesheet type="text/xsl" href="file://non-existing.xsl"?> 
  to any XML file.

Actual Results:  
FF renderes the XML file as continous Text stripping all tags.

Expected Results:  
There should be an errormessage displayed (like any other XSL error) or the XML structure should be rendered as is if there was no 
<?xml-stylesheet type="text/xsl" href="file://non-existing.xsl"?>
Tag at all.

Additionally the problem should be reportet in the error console.

Comment 1

[timothy truckle]

Attachment: xml with a reference to an nonexisting XSL

download this file to your local file system and be sure NOT to have a file names 'non-existing.xsl' in the same folder.

Comment 2

[Ria Klaassen (not reading all bugmail)]

Regression range:
http://bonsai.mozilla.org/cvsquery.cgi?module=PhoenixTinderbox&date=explicit&mindate=1189057260&maxdate=1189062779
-> Bug 230606 or Bug 209234.

Comment 3

[timothy truckle]

@Ria Klaassen:
This bug is NOT about security issues related to "same origin policy"! 
This bug just renders unexpected output.

Also FF misses to give an errormesage (in error console) as it does when "same origin policy" prevents loading the XSL.

Comment 4

[Ria Klaassen (not reading all bugmail)]

The bug is that you should see something like:

Error loading stylesheet: A network error occurred loading an XSLT stylesheet:file://non-existing.xsl/

and not:

This is a test case.

One of those two bugs caused this.

Comment 5

[timothy truckle]

> The bug is that you should see something like:
> [...]
Yes.
But when loading the attached xml file directly from the link you see a message in the error console. In case you first download it to your local file system the error console does not show any message.

> One of those two bugs caused this.
Both bugs deal with the "same origin policy" security issue. I think this one is a more general case and it's solution also should be somehow more general than a special exception to the "same origin policy".

Comment 6

[Mats Palmgren (inactive)]

Firefox 3.0 on Linux, Error Console when loading from local file system:
Security Error: Content at file:///usr/local/test/443459.xml may not load data from file://non-existing.xsl/.

From attachment URL:
Security Error: Content at https://bugzilla.mozilla.org/attachment.cgi?id=328014 may not load or link to file://non-existing.xsl/.

in both cases I see the text "This is a test case."

I get the same results on Windows XP.

Comment 7

[timothy truckle]

@Mats
In case you turn off "strict same origing policy" you'll not get a message in error console when loading from local file system but a warning when loading directly from website. 

And the second issue with this bug is: Why is there some kind of translation at all? I'd expect to see either the the structure of the XML file in any of this cases or an XSL-error message (e.g. as you would see if the xsl was not valid xml).

Comment 8

[Boris Zbarsky [:bzbarsky]]

This probably needs to depend on the bug about nsFileChannel throwing from AsyncOpen if there is no file.

Comment 9

[Boris Zbarsky [:bzbarsky]]

That said, if twiddling the strict origin flag "fixes" this behavior (it's not clear to me from the comments whether it does), then disregard comment 8.

Comment 10

[timothy truckle]

> That said, if twiddling the strict origin flag "fixes" this behavior
No it does not.
Toggeling the "strict origin" flag only affects the error message in the console. 

The test case is, that a resource in the same location on the local file system is missing. In that case the "same origin" policy does not apply. So I see no reason why logging to error console depends on the "strict origin" flag.

And again: FF3 should show the file structure as if there was no 
<?xml-stylesheet type="text/xsl" href="file://non-existing.xsl"?>
tag at all insted of stripping all XML tags.

bye
TT

Comment 11

[Michelle Funches - QA]

Reproducible in Nightly. Displays as if all XML tags were stripped.
Version 	48.0a1
Build ID 	20160314030215
User Agent 	Mozilla/5.0 (Windows NT 5.1; rv:48.0) Gecko/20100101 Firefox/48.0
However I.E. displays message that the XML page cannot be displayed.
The XML page cannot be displayed 
Cannot view XML input using XSL style sheet. Please correct the error and then click the Refresh button, or try again later. 
--------------------------------------------------------------------------------
Access is denied. Error processing resource 'file://non-existing.xsl/'.