<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
http://www.w3.org/1999/XSL/Transform ever actually fetched over HTTP (as opposed to being bundled with web browsers, for instance), making XSL style sheets vulnerable to a man-in-the-middle attack? If so, how should this attack be countered?
(I checked with a packet sniffer and found no such request, but I do not consider that completely conclusive, since there might be some caching involved.)
Setup: A (trusted) web server is serving the following two files over HTTPS:
<?xml version="1.0" encoding="utf-8" ?> <?xml-stylesheet type="text/xsl" href="style.xsl"?> <root> </root>
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"> <xsl:template match="/"> Output </xsl:template>
A client (using for instance a modern web browser) accesses the data.xml file.
If/when the web browser accesses
http://www.w3.org/1999/XSL/Transform, an attacker substitutes something malicious, which transforms the XML into whatever the attacker wants, thereby bypassing the HTTPS authentication.