FIX: XSL Script Can Modify DOM in Internet Explorer (262236)

MORE INFORMATION

Steps to Reproduce Behavior

1. Insert the following code into a new text document and save the document as repro.xml:

   <?xml version="1.0" ?>
   <?xml:stylesheet type="text/xsl" href="repro.xsl"?>
   <doc>
   	<original/>
   	<invokechange/>
   </doc>
   					

2. Insert the following code into a new text document and save the file as repro.xsl in the same location as the previous document:

   <xsl:stylesheet language="JScript" xmlns:xsl="http://www.w3.org/TR/WD-xsl">
     <xsl:template match="/">
   	<B>Behavior Repro Code for Microsoft Knowledge Base Article Q262236</B>
   	<BR/><BR/>
   	<xsl:apply-templates select="//invokechange" />
   	<xsl:apply-templates select="//original" />
   	<xsl:apply-templates select="//changed" />
     </xsl:template>
     
     <xsl:template match="invokechange">
   	Delete original and add changed to DOM =
   	<xsl:eval>ChangeDOM(this);</xsl:eval>
   	<xsl:apply-templates />
   	<BR/>
     </xsl:template>
     
     <xsl:template match="original">
   	Original value =
   	<xsl:value-of />
   	<xsl:apply-templates />
   	<BR/>
     </xsl:template>
     
     <xsl:template match="changed">
   	Changed value = 
   	<xsl:value-of />
   	<xsl:apply-templates />
   	<BR/>
     </xsl:template>
       
     <xsl:script language="JScript">
   	function ChangeDOM(oNode)
   	{
   		oParent=oNode.parentNode
   		oFirstChild=oParent.childNodes[0];
   		oParent.removeChild(oFirstChild);
   		oDoc=oNode.ownerDocument
   		oChanged=oDoc.createElement("changed");
   		oChanged.text="I was added";
   		oParent.insertBefore(oChanged,oNode);
   		return "Success"
   	}
     </xsl:script>
   </xsl:stylesheet>
   					

3. Load the repro.xml file into a Microsoft Internet Explorer Web browser on a computer with MSXML 2.0 installed. The output shows that the "original" node was removed and a new node named changed was added. The XML DOM should not be altered from an XSL script.