BUG: XML Context Method Can Traverse Out of Xsl:template Element (284453)

SYMPTOMS

When you use the context method of the "http://www.w3.org/TR/WD-xsl" namespace, it is possible to use a negative value for the index parameter from an xsl:template element, effectively navigating the context out of the template. It should not be possible to do this because the template can be called from more than one location, which means that the value of context(-n) changes depending on how the template is called.

RESOLUTION

This problem is discussed here for reference purposes only, because the context method has been superceded by the current method of the "http://www.w3.org/1999/XSL/Transform" namespace.

Use the current method and its corresponding namespace instead of the context method.

MORE INFORMATION

Steps to Reproduce Behavior

Insert the following code into a new text document, and save the file as repro.xml:

<?xml version="1.0" ?>
<?xml-stylesheet type="text/xsl" href="repro.xsl" ?> 
<Data>
   <StudentBody>
      <Student name="Jon Burchel">
      </Student>
   </StudentBody>
</Data>

Insert the following text into another new document, and save the file as repro.xsl in the same location as the XML file you just created:

<xsl:stylesheet xmlns:xsl="http://www.w3.org/TR/WD-xsl">

<xsl:template match="/">
   <HTML>
      <BODY>
         <xsl:apply-templates select = "Data/StudentBody/*" />
      </BODY>
   </HTML>
</xsl:template>

<xsl:template match="Student">
   <!-- context() is OK -->
   <LI><xsl:value-of select = "@name" /></LI><BR/>
   <xsl:if test="context()[$not$ end()]"><BR/></xsl:if>

   <!-- context(-2) should not be possible -->
   <B>This should not work!!!</B><BR/>
   <LI><xsl:value-of select = "@name" /></LI><BR/>
   <xsl:if test="context(-2)[$not$ end()]"><BR/></xsl:if>
</xsl:template>

</xsl:stylesheet>