If you downloaded microsoft’s security updates with trust in your hearts and found that your nice xml xslt transforms no longer functioned correctly, you’re not alone. Nothing quite like watching a perfect build fail only on your build server, whilst working fine on your development machines, to really brighten up your day.
Jscript scripts can be used to apply xsl transforms to xml files, and is a good way to manage generation of interop info for a project. KB936021 contains a fairly important change to the Msxml2.DOMDocument.3.0 active x object that doesn’t seem to matter anywhere. It’s probably not their fault, but it’s irritating none the less. When it comes to security updates, Microsoft subscribes to a less is more philosophy information-wise. Very little concrete information about what was changed in a security fix is released, which made this particular bug a pain to track down. The fix works, the reasoning behind it is speculation.
It seems that the msxml object has a property called resolveExternals. This property determines whether or not to allow the includes and imports inside an xsl to take place, or whether just to ignore them. You can guess the consequences of the latter.
It would also appear that originally the default value for this property was true, which makes sense as it’s a way many people use xsl. As the focus has switched more towards security in recent years, this default was changed to false for later versions (though it was retained as true for a long time for backwards compatibility.) At least, that was the intention – turns out, it was never changed to false. An oversight, perhaps.
Obviously with KB936021 they’ve discovered this oversight and changed it – so now it is false by default. As our scripts expected the (old) behaviour of true, and no notices was given that this was changing, they all broke.
The way you manage transforms using this activex component is to load both the xml and the xsl document as dom docuemnts and make the following call:
var output = doc.transformNode(xsl);
This will still work, just include the following line before it if you have includes in your xsl document.
xsl.resolveExternals = true;
Powered by ScribeFire.