Mozilla

mozilla

Mozilla Foundation Security Advisory 2005-20

XSLT can include stylesheets from arbitrary hosts

Announced
February 24, 2005
Reporter
Georgi Guninski
Risk
High
Impact
Low
Products
Firefox, Mozilla Suite
Fixed in
  • Firefox 1.0.1
  • Mozilla Suite 1.7.6

Description

xsl:include and xsl:import can include XSLT stylesheets from arbitrary domains including those behind the user's firewall. This at least allows for existence checking of these files; it's not clear how much, if any, data could be extracted from arbitrary XML files.

Workaround

Upgrade to a fixed build.

References