This Bugzilla instance is a read-only archive of historic NetBeans bug reports. To report a bug in NetBeans please follow the project's instructions for reporting issues.

Bug 31990 - Kill disable-output-escaping in XSLT
Summary: Kill disable-output-escaping in XSLT
Status: RESOLVED FIXED
Alias: None
Product: www
Classification: Unclassified
Component: Builds & Repositories (show other bugs)
Version: 3.x
Hardware: PC Linux
: P4 blocker (vote)
Assignee: nbbuild-issues@ide
URL:
Keywords:
Depends on:
Blocks: 25251
  Show dependency tree
 
Reported: 2003-03-13 19:56 UTC by Jesse Glick
Modified: 2005-02-10 17:31 UTC (History)
2 users (show)

See Also:
Issue Type: DEFECT
Exception Reporter:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Jesse Glick 2003-03-13 19:56:40 UTC
This option to <xsl:text> and <xsl:value-of> in
stylesheets is a real hack and should be avoided
whenever possible. I see it used in NB stylesheets:

core/www/plans/plan-index.xsl
core/www/qa/testspecs/testspec2html.xsl
java/www/plans/build/common.xsl
java/www/plans/build/plan-documents.xsl
java/www/plans/build/plan-owners.xsl
java/www/plans/build/plan-preprocess.xsl
javacvs/changelog/src/org/netbeans/modules/changelog/xml/xml2html_sample.xsl
mdr/api/doc/changes/apichanges.xsl
nbbuild/plans/features-module.xsl
nbbuild/plans/features-overview.xsl
nbbuild/changelog/changelog_html.xsl
nbbuild/javadoctools/apichanges.xsl
openide/www/qa/testspecs/testspec2html.xsl
performance/www/plans/plan.xsl
qa/izquery/src/org/netbeans/iz/xslt/simple-html.xsl
qa/izquery/qb_report/index-xml.xsl
qa/izquery/qb_report/qbuild-html.xsl
qa/izquery/qb_report/qbuild-xml.xsl
xtest/xslt/unit/toolkit.xsl
xtest/xslt/summary-html.xsl

At least nbbuild/javadoctools/apichanges.xsl uses
it semi-legitimately - as a workaround for the
lack of a first-class sort-with-grouping construct
in XSLT (hard to work around cleanly without
taking a big performance hit).
mdr/api/doc/changes/apichanges.xsl is just a copy
of that.

More commonly it is abused. At least the
nbbuild/**/*.xsl cases should be corrected so that
people will not copy bad examples. Bad effects of
disabling output escaping: (1) typos in stylesheet
or input can lead to malformed output, sort of
like reflection in Java. (2) Input data that
happens to contain '&', '<', etc. may lead to
malformed or inaccurate output (e.g. the common
symptom is that these characters are invisible in
the generated HTML).

E.g.

<xsl:text
disable-output-escaping="yes">features.html</xsl:text>

Quite useless here of course.

<xsl:text
disable-output-escaping="yes"><![CDATA[&nbsp;]]></xsl:text>

Yuck. Use

<xsl:text> </xsl:text>

or if the browser really cannot handle e.g. a
table cell without a non-breaking space, use

<xsl:text>&#160;</xsl:text>

<xsl:template name="makeLink">
    <xsl:param name="name"  select="''"/>
    <xsl:param name="title" select="''"/>
    <xsl:text disable-output-escaping="yes">&lt;A
name="</xsl:text>
    <xsl:value-of select="$name"/>
    <xsl:text
disable-output-escaping="yes">"&gt;</xsl:text>
    <xsl:value-of select="$title"/>
    <xsl:text
disable-output-escaping="yes">&lt;/A&gt;</xsl:text>
</xsl:template>

This is the worst. Not only is this template quite
unsafe - any special characters in the link will
corrupt the output - but it is hard to read and
completely unnecessary. It can be deleted and
usages like this:

<xsl:call-template name="makeLink">
    <xsl:with-param name="name"><xsl:value-of
select="$category-link"/>
    </xsl:with-param>
    <xsl:with-param name="title"><xsl:value-of
select="$category-name"/>
    </xsl:with-param>
</xsl:call-template>

replaced with normal style:

<a href="{$category-link}">
    <xsl:value-of select="$category-name"/>
</a>

or if more flexibility is needed:

<a>
    <xsl:attribute name="href">
        <!-- more complex stuff here - call
templates etc. -->
    </xsl:attribute>
    <xsl:value-of select="$category-name"/>
</a>
Comment 1 rbalada 2005-02-10 12:06:57 UTC
Is this still an issue?
Comment 2 rbalada 2005-02-10 17:31:24 UTC
nbbuild's part of this issue has been fixed or faded-out