Login/Register
XSLT stylesheet isn't applied to XML in Firefox. How to fix it?
Asked Answered
Solved xmlfirefoxxsltxslt-1.0
N

3

7

I have no idea why my code isn't cooperating, with me and my xml. I'm sorry for giving pics, but when i'm giving code, site is displaying end result, not the code it self, and I have no idea how to change it.

<?xml version="1.0" encoding="utf-8" ?>
<?xml-stylesheet href="movies.xsl" type="text/xsl" ?>
<collection>
    <movie>
        <title>hasdasd</title>
        <year>1222</year>
        <genre>horror</genre>
    </movie>
    <movie>
        <title>wqw</title>
        <year>1111</year>
        <genre>notporn</genre>
    </movie>
    <movie>
        <title>asdsd</title>
        <year>1444</year>
        <genre>comedy</genre>
    </movie>
</collection>

my XML code

<?xml version="1.0" encoding="utf-8"?>
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
  <xsl:template match="/collection">
      <html>
        <body> <h1>OEIHFWOEFIHEFOI</h1>
        <table border="1">
            <tr>
                <th>title</th>
                <th>Genre</th>
                <th>year</th>
            </tr>
            <xsl:for-each select="movie">
            <tr>
                <td><xsl:value-of select="title" /></td>
                <td><xsl:value-of select="year" /></td>
                <td><xsl:value-of select="genre" /></td>
            </tr>
            </xsl:for-each>
        </table>
        </body>
      </html>
  </xsl:template>
</xsl:stylesheet>

my XSLT code I really don't know whats wrong, it seems like they are connected to each other in a wrong way, but im still clueless.

end result

Nolie answered 2/1, 2021 at 18:12 Comment(5)
Which browser do you use, do you load the XML from the file system or over HTTP(S)? – Echt
Also, do you see any error or warning in the browser console (F12)? – Echt
I just open it with firefox, In f12 it says add title, i tried to add one in html head, but it still doesn't work – Nolie
Do you load the XML from the file system or from a HTTP server? – Echt
From file system, answer from zx485 helped, its working, still thanks – Nolie
B
5

Firstly: I strongly recommend you use a local http server instead of modifying any preferences in Firefox that make you less secure.

Since around Firefox 68 treats local files as always cross-origin. (See "local HTML file can lead to file stealing") This prevents various security and privacy issues such as an attack exfiltrating local data in the same folder as a downloaded HTML file. See also the article "Restrictions on File Urls".

Changing security.fileuri.strict_origin_policy is extremely insecure and should not be done, because it allows access to all files on your computer.

Edit: I previously suggested using privacy.file_unique_origin, which was less insecure, but that preference was removed around two years ago and doesn't work today.

Bobsleigh answered 2/1, 2021 at 23:23 Comment(8)
Thanks for mentioning this. My solution was unsatisfactory, I knew. But restricting a local file from accessing a file in the same directory should not be considered a security risk. This is somewhat a design flaw in Firefox, I assume. – Apivorous
Is it possible to just change the browser where my xml will be working? Which should i choose then? – Nolie
The privacy.file_unique_origin suggestion didn't work for me. I had to use the security.fileuri.strict_origin_policy option. – Fetus
Using a local http server can be very insecure, as if you do not set up authentication or restrictions (e.g. with this insecure suggestion), anyone in the world can read your files on your computer without any action on your side. Setting security.fileuri.strict_origin_policy pref to false is fine as long as you use Firefox with trusted local files (e.g. with a specific profile). – Roup
@Apivorous A "same directory" restriction may still yield security issues, e.g. with the "Downloads" directory. That's why this has been removed, AFAIK. A better solution would be to allow the user to specify "trusted directories". – Roup
@vinc17: Good point. But the current state of affairs is unsatisfactory for many developers as well as users. The devs of Firefox should have thought this through before completely banning this use-case. – Apivorous
Abandoning the XSLT+XML path and not implementing XSLT-2.0 (or even XSLT-3.0) is saddening, to say the least. Evolving HTML to XHTML with XSLT instead of HTML-5.0 would have been a serious improvement, but that's merely my humble opinion. – Apivorous
@Apivorous I don't think that one can say that Firefox abandoned XSLT+XML. AFAIK, there is the same issue with JavaScript. The current solution is to set security.fileuri.strict_origin_policy to false with a specific Firefox profile, and be careful about what one does with this profile. – Roup
A
4

This seems to be the usual problem that newer versions of Firefox apply a stricter policy regarding the source of the XML-XSLT combination. If the XML and XSLT are local files, Firefox will block/ignore the reference to the XSLT.

The solution is changing one setting in about:config: Set

privacy.file_unique_origin

to false. This is the preferred modification, as suggested by @evilpie.

This should make your XML display as desired. It is discussed here: Firefox 68: local files now treated as cross-origin (1558299).

Apivorous answered 2/1, 2021 at 21:4 Comment(1)
Can you please modify your answer. This solution is even less secure than necessary. – Bobsleigh
R
3

Mozilla recommends to run a local server. Just install Python 3.x on your machine and serve your working directory with your XML and XSL by launching a batch file from it, with this line:

cmd.exe /c "\Python38-32\python.exe -m http.server"

With the correct path to your Python, of course. Firefox will find 'your_bewdiful.xml' in http://localhost:8000/your_bewdiful.xml.

Repetitive answered 4/5, 2022 at 15:14 Comment(0)

© 2022 - 2024 — McMap. All rights reserved.