Simon Willison's Weblog: xslt

Removing XSLT for a more secure browser

2025-11-05T22:24:57+00:00

Removing XSLT for a more secure browser

Previously discussed back in August, it looks like it's now official:

Chrome intends to deprecate and remove XSLT from the browser. [...] We intend to remove support from version 155 (November 17, 2026). The Firefox and WebKit projects have also indicated plans to remove XSLT from their browser engines. [...]

The continued inclusion of XSLT 1.0 in web browsers presents a significant and unnecessary security risk. The underlying libraries that process these transformations, such as libxslt (used by Chromium browsers), are complex, aging C/C++ codebases. This type of code is notoriously susceptible to memory safety vulnerabilities like buffer overflows, which can lead to arbitrary code execution.

I mostly encounter XSLT on people's Atom/RSS feeds, converting those to a more readable format in case someone should navigate directly to that link. Jake Archibald shared an alternative solution to that back in September.

Via Hacker News

Tags: browsers, chrome, security, web-standards, xml, xslt, jake-archibald

Making XML human-readable without XSLT

2025-09-02T19:32:57+00:00

Making XML human-readable without XSLT

In response to the recent discourse about XSLT support in browsers, Jake Archibald shares a new-to-me alternative trick for making an XML document readable in a browser: adding the following element near the top of the XML:

<script
  xmlns="http://www.w3.org/1999/xhtml"
  src="script.js" defer="" />

That script.js will then be executed by the browser, and can swap out the XML with HTML by creating new elements using the correct namespace:

const htmlEl = document.createElementNS(
  'http://www.w3.org/1999/xhtml',
  'html',
);
document.documentElement.replaceWith(htmlEl);
// Now populate the new DOM

Tags: browsers, javascript, rss, xml, xslt, jake-archibald

XSLT on congress.gov

2025-08-19T20:40:50+00:00

Today I learned - via a proposal to remove mentions of XSLT from the HTML spec - that congress.gov uses XSLT to serve XML bills as XHTML - here's H. R. 3617 117th CONGRESS 1st Session for example.

View source on that page and it starts like this:

<?xml version="1.0"?>
<?xml-stylesheet type="text/xsl" href="billres.xsl"?>
<!DOCTYPE bill PUBLIC "-//US Congress//DTDs/bill.dtd//EN" "bill.dtd">
<bill bill-stage="Introduced-in-House" dms-id="H5BD50AB7712141319B352D46135AAC2B" public-private="public" key="H" bill-type="olc"> 
<metadata xmlns:dc="http://purl.org/dc/elements/1.1/">
<dublinCore>
<dc:title>117 HR 3617 IH: Marijuana Opportunity Reinvestment and Expungement Act of 2021</dc:title>
<dc:publisher>U.S. House of Representatives</dc:publisher>
<dc:date>2021-05-28</dc:date>
<dc:format>text/xml</dc:format>
<dc:language>EN</dc:language>
<dc:rights>Pursuant to Title 17 Section 105 of the United States Code, this file is not subject to copyright protection and is in the public domain.</dc:rights>
</dublinCore>
</metadata>
<form>
<distribution-code display="yes">I</distribution-code> 
<congress display="yes">117th CONGRESS</congress><session display="yes">1st Session</session> 
<legis-num display="yes">H. R. 3617</legis-num> 
<current-chamber>IN THE HOUSE OF REPRESENTATIVES</current-chamber>

Digging into those XSLT stylesheets leads to billres-details.xsl - gist copy here - which starts with a huge changelog comment with notes dating all the way back to 2004!

Tags: html, political-hacking, web-standards, xslt

Matt Webb's Colophon

2024-10-29T04:59:47+00:00

Matt Webb's Colophon

I love a good colophon (here's mine, I should really expand it). Matt Webb has been publishing his thoughts online for 24 years, so his colophon is a delightful accumulation of ideas and principles.

So following the principles of web longevity, what matters is the data, i.e. the posts, and simplicity. I want to minimise maintenance, not panic if a post gets popular, and be able to add new features without thinking too hard. [...]

I don’t deliberately choose boring technology but I think a lot about longevity on the web (that’s me writing about it in 2017) and boring technology is a consequence.

I'm tempted to adopt Matt's XSL template that he uses to style his RSS feed for my own sites.

Tags: blogging, matt-webb, rss, xslt, boring-technology

XSL Flickr

2006-12-01T12:20:21+00:00

XSL Flickr

An XSL interface to the Flickr API. It even does auth!

Tags: flickr, xslt

[xsl] Replace newline characters(\n) with

2006-08-18T10:26:38+00:00

[xsl] Replace newline characters(\n) with <br>

This is why I’m not a fan of XSLT for templating.

Tags: xslt

Microsummaries in Firefox 2

2006-05-13T10:18:50+00:00

Microsummaries in Firefox 2

Neat new feature: short summaries of pages extracted using XSLT.

Tags: firefox, xslt

X2V

2005-07-10T03:21:25+00:00

X2V

XSLT to change hCalendar and hCard in to iCalendar and vCard.

Tags: xslt

Safari 1.3 is out (via Software Update)

2005-04-16T15:51:54+00:00

Safari 1.3 is out (via Software Update)

New features include contenteditable support, XSLT and a major performance improvements.

Tags: safari, xslt, contenteditable

Google Maps and XSL

2005-02-08T14:19:37+00:00

I'll probably write more on this later, but it seems that Google Maps is using XSL. I spotted it loading the following pages while sniffing its activity with LiveHTTPHeaders:

This is in addition to the (now expected) XMLHttpRequest stuff. There even appears to be some of Microsoft's weird VML, although as I'm on a Mac I don't have access to IE/Windows to see what it's doing with it.

The bulk of the Google Maps JavaScript appears to be hidden away in maps.1.js, which becomes a lot more readable if you feed it through PrettyPrinter.de

As for Google Maps itself, it's an amazing piece of work but it's a shame they didn't follow map.search.ch's lead in degrading gracefully to a static version for unsupported browsers.

If anyone has any further insights in to how it all works, please post them in a comment.

Tags: google, google-maps, maps, xslt

XML.com: Automated Tree Drawing: XSLT and SVG

2004-09-09T02:14:53+00:00

XML.com: Automated Tree Drawing: XSLT and SVG

Includes a recursive text parser in XSLT. May cause your brain to melt.

Tags: svg, xslt

IE Objectifier

2004-08-20T22:45:38+00:00

IE Objectifier

mod_action + XSLT + PHP = neat hack.

Via b-links [dive into mark]

Tags: xslt

Introducing dbagg3, an Atom-powered client/server aggregator

2004-08-06T16:08:09+00:00

Introducing dbagg3, an Atom-powered client/server aggregator

Way smart aggregator built on top of Atom and XSLT.

Tags: atom, xslt

Amazon's Web Services and XSLT

2004-08-05T05:43:52+00:00

Amazon's Web Services and XSLT

The Amazonn REST API lets you feed in the URL of an XSLT document.

Tags: xslt

XHTML FAQ: please remove application/xml XSLT hack

2004-07-23T21:29:21+00:00

XHTML FAQ: please remove application/xml XSLT hack

Bjoern Hoehrmann blows it out of the water.

Via paranoidfish.org/links/2004/07/23

Tags: xhtml, xslt

Mark Pilgrim's Atom feed

2004-05-04T17:39:58+00:00

Mark Pilgrim's Atom feed

Atom + XSL + CSS = a self explanatory feed that functions in a browser.

Via Another crack at user-friendly feeds

Tags: atom, mark-pilgrim, xslt

A Transforming Experience for Content Management?

2004-03-08T16:56:51+00:00

A Transforming Experience for Content Management?

Good overview of XSLT 2.0.

Via Column Two

Tags: xslt

Using XPath to mine XHTML

2003-10-21T05:31:23+00:00

This morning, I finally decided to install libxml2 and see what all the fuss was about, in particular with respect to XPath. What followed is best described as an enlightening experience.

XPath is a beautifully elegant way of adressing "nodes" within an XML document. XPath expressions look a little like file paths, for example:

/first/second: Match any <second> elements that occur inside a <first> element that is the root element of the document
//second: Match all <second> elements irrespective of their place in the document
//second[@hi]: Match all <second> elements with a 'hi' attribute
//second[@hi="there"]: Match all <second> elements with a 'hi' attribute that equals "there"

A full XPath tutorial is available.

The Python libxml2 bindings make running XPath expressions incredibly simple. Here's some code that extracts the titles of all of the entries on my Kansas blog from the site's RSS feed:

>>> import libxml2
>>> import urllib
>>> rss = libxml2.parseDoc(
      urllib.urlopen('http://www.a-year-in-kansas.com/syndicate/').read())
>>> rss.xpathEval('//item/title')
[<xmlNode (title) object at 0xb4b260>, <xmlNode (title) object at 0xa99968>, 
<xmlNode (title) object at 0x10dce68>]
>>> [node.content for node in rss.xpathEval('//item/title')]
['Music and Brunch', 'House hunting', 'Arrival']
>>>

Why is this so exciting? I've been saying for over a year that XHTML is an ideal format for storing pieces of content in a database or content management system. Serving content to browsers as HTML 4 makes perfect sense, but storing your actual content as XML gives you the ability to process that content in the future using XML tools.

So far, the best example of a powerful tool for manipulating this stored XML has been XSLT. XSLT has its fans, but is also often criticised as being unintuitive and having a steep learning curve. XPath is a far better example of a powerful, easy to use tool that can be brought to bare on XHTML content.

Enough talk, here's an example of what I mean. The following code snippet creates a Python dictionary of all of the acronyms currently visible on the front page of my blog, mapping their shortened version to the expanded text (extracted from the title attribute):


>>> blog = libxml2.parseDoc(
    urllib.urlopen('http://simon.incutio.com/').read())
>>> ctxt = blog.xpathNewContext()
>>> ctxt.xpathRegisterNs('xhtml', 'http://www.w3.org/1999/xhtml')
0
>>> acronyms = dict([(a.content, a.prop('title')) 
    for a in ctxt.xpathEval('//xhtml:acronym')])
>>> for acronym, fulltext in acronyms.items():
	print acronym, ':', fulltext


DHTML : Dynamic HyperText Markup Language
URL : Universal Republic of Love
HTML : HyperText Markup Language
SIG : Special Interest Group
PHP : PHP: Hypertext Preprocessor
CSS : Cascading Style Sheets
>>>

The above code is slightly more complicated than the first example, as using XPath with a document that uses XML namespaces requires some extra work to register the namespace with the XPath parser. Still, it's a pretty short piece of code considering what it does.

For an example of how powerful XPath can be on a much larger scale, take a look at Sam Ruby's XPath enabled blog search feature.

Tags: libxml2, python, xhtml, xml, xpath, xslt

Moveably Type with XSLT

2003-08-11T19:13:35+00:00

Kevin Davis has set up an impressive demonstration of the power of Moveable Type templates when combined with browser-side XSLT transformations. He's set up MT to output an XML document containing just his entries (similar to an RSS feed), along with a link to an XSLT stylesheet that causes Mozilla and IE 6 to transform the entry and render it as XHTML.

Tags: xslt

Clearout

2003-07-10T13:52:43+00:00

Tristan Louis' RSS to Necho convertor puts paid to the idea that the success of one format will be detrimental to the usefulness of the other.
O'Reilly's RegExp Power series (part one and part two) demonstrate some powerful tricks for use with Perl compatible regular expressions.
Norman Walsh explains Content Negotiation and some of the pitfalls with modern browser implementations.
So that's what happened to Digitiser. See also a Digitiser Tribute and a Mr Biffo interview from 2001 for background information. I cuss you bad.
George Orwell: Politics and the English Language
Clay Shirky: A Group Is Its Own Worst Enemy. The title is misguiding; this is an essay about how online groups behave and how to look after them.
A Java HttpClient Class.
Some good stuff on Boxes and Arrows: Ten Quotable Moments: Challenges and Responses for UI Designers and Views and Forms: Principles of Task Flow for Web Applications (Part 1).
Inside our notions of "document" and Inside our documents II - the Runoff model.
5 days worth of XSLT observations from Simon St. Laurent: One, Two, Three, Four, Five.
Windows programming with open source tools: Minimalist GNU For Windows and Win32 Programming with GNU C and C++.

Tags: clay-shirky, digitiser, george-orwell, httpclient, java, open-source, perl, regular-expressions, rss, simon-st-laurent, tristan-louis, windows, xslt

XHTML is still great for content

2003-01-08T22:34:19+00:00

In response to Mark Pilgrim's Poisoning the envelope, Brian Donovan has expanded upon his opinion that long term web facing content should not be stored as (X)HTML:

Do everything "right" (proper DTD's, validating all of your HTML, etc.) and, assuming that browser makers don't chuck backwards compatibility (about as reasonable as deciding not to pay for medical insurance because of your past track record of good health) and you will still either (1.) be locked into circa 2002 XHTML forever / until you find yourself with an extra month or two (or more) of free time and get the itch to go through several years of accumulated content to bring it up to spec or (2.) find yourself building a patchwork site because you've been incorporating recent developments as they've come along (i.e. all of the entries after 2006 use XForms where appropriate after MSIE 9, Opera 11, Moz3/NS 10 support finally solidified, but earlier entries using plain old (X)HTML forms).

Patching your cms (or getting/paying a someone to do it for you) from time to time could be (by far) preferable to and cheaper than periodically hand-editing several years' worth of articles stored in HTML format.

Again, I agree with Brian's points with respect to HTML. His argument fails however when you consider XHTML. The beautiful thing about (valid) XHTML is that it can be processed by any tool capable of processing XML. No hand editing is required - if you later need to convert your content to a newer standard (and personally I see XHTML 1.0 as a pretty stable horse) it takes a simple XSLT stylesheet, or possibly a short Python script. You have created future proof content without having to reinvent the wheel.

Tags: xhtml, xslt

Excellent introduction to XSLT

2002-11-02T20:31:08+00:00

Rescuing XSLT from Niche Status is A Gentle Introduction to XSLT through HTML Templates. It is something of a hybrid article, consisting of a discussion of the problems involved with both teaching and learning XSLT followed by an excellent (if somewhat brief) tutorial covering the most important XSLT tags and concepts and how they can be used to convert a simple XML document in to XHTML.

Tags: xslt

Generating HTML with XQuery

2002-10-20T13:57:31+00:00

Generating XML and HTML using XQuery (via More Like This). I had been confusing XQuery with XPath - it turns out XQuery is a fully featured scripting language which can be used to do all kinds of things with data from XML documents. The article explains how XQuery can be used to build a web photo gallery application and compares XSLT and XQuery using a Docbook transformation example.

Tags: xslt

50 XSLT tips

2002-10-17T14:04:09+00:00

50 XSLT Tips. I particularly like Tip 13, whish shows how you can use a recursive template call to print things out multiple times (for example, 5 asterisks for something with a 5 star rating).

Tags: xslt

Installing PHP and XSL on Windows

2002-06-24T23:16:54+00:00

I'm currently reinstalling PHP on my Windows machine, and in doing so I came across this tutorial: Installing XSL and PHP on Windows. The tutorial provides all the necessary files and instructions to get XSL working with minimum hassle. I've been meaning to play with XSL for some time, and this has provided me with just the boost I needed to give it a go.

Tags: php, xslt