first_page the funky knowledge base
personal notes from way, _way_ back and maybe today

XSLT in .NET: Default Security Used for xsl:include Element; XmlUrlResolver

The xsl:include include element needs no special security procedure associated with it. It should behave as expected when an XSLT file is including another file on the same server---especially one in the same application domain.

'No special security procedure' essentially means using XslTransform.Load() to load an XSLT file without providing a XmlUrlResolver as a parameter. According to the MSDN documentation, "For overloads of XslTransform.Load() that do not take a resolver parameter, a default XmlUrlResolver with no credentials is created for the user by XslTransform." More information is here:

"Secure XSL Transformations in Microsoft .NET"
http://msdn2.microsoft.com/en-us/library/ms950792.aspx
mod date: 2007-05-03T23:34:01.000Z