Let's say I want to set up a sandbox or playground in PHP that users can use to create (or paste in) XML and XSLT, then transform the XML via the XSLT (by means of PHP 5's DOMDocument and related objects).
So, in a simple example, we'd have a form with two textareas - one for XML and one for XSLT. The user would enter his XML and XSLT and hit a button. The XSLT and XML would be posted to my server, where I'd transform the XML using the XSLT, then return the result to the user.
In some ways, this is like an
eval(), but I have the feeling that the risks in this scenario are minimal, or much lower than if I put up a form with a textarea for PHP and just
eval()ed that code.
Is my hunch correct, or are there hidden security issues here? If so, what are they, and what sort of precautions should I look into in order to secure my theoretical application.