This is an archived snapshot of W3C's public bugzilla bug tracker, decommissioned in April 2019. Please see the home page for more details.

Bug 30109 - [xslt30] Sticky disable-output-escaping revisited
Summary: [xslt30] Sticky disable-output-escaping revisited
Status: RESOLVED FIXED
Alias: None
Product: XPath / XQuery / XSLT
Classification: Unclassified
Component: XSLT 3.0 (show other bugs)
Version: Proposed Recommendation
Hardware: PC All
: P2 normal
Target Milestone: ---
Assignee: Michael Kay
QA Contact: Mailing list for public feedback on specs from XSL and XML Query WGs
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-05-09 14:17 UTC by Michael Kay
Modified: 2017-06-01 20:58 UTC (History)
0 users

See Also:


Attachments

Description Michael Kay 2017-05-09 14:17:53 UTC
Section 26.2 carries forward the following text unchanged from XSLT 2.0:

<quote>
If output escaping is disabled for an xsl:value-of or xsl:text instruction evaluated when temporary output state is in effect, the request to disable output escaping is ignored.
</quote>

The intent of this rule was to disallow d-o-e except for text nodes written directly to a final result tree (i.e. text nodes that are capable of being sent immediately to the serializer).

However, the rules on when temporary output state is set have changed, so that this rule no longer achieves the required effect. For example, in XSLT 2.0 instructions such as xsl:attribute, xsl:comment, and xsl:processing-instruction would set temporary output state, but in XSLT 3.0 they do not. This means that we have unintentionally opened the door to use of d-o-e while writing attributes or comments.
Comment 1 Michael Kay 2017-05-10 11:02:49 UTC
Looking at this more closely, I've come to the conclusion that it's not actually a problem. Although the statement that "when temporary output state is in effect, the request to disable output escaping is ignored" no longer applies to constructs such as

<xsl:attribute name="x">
  <xsl:value-of select="&lt;" disable-output-escaping="yes"/>
</xsl:attribute>

the effect of the rules is that disable-output-escaping has no effect here anyway. The constructs that no longer set temporary output state, like xsl:attribute, generally invoke the rules of "Constructing Simple Content" (CSC). So the semantics here are:

(a) xsl:value-of creates a text node, in which the DOE bit is set on every character.

(b) the input sequence supplied to CSC comprises this singleton text node.

(c) CSC causes the text node to be atomized

(d) the resulting string is used as the string value of the attribute node.

Since the rules for atomizing a text node say nothing about how the DOE bit might influence the process, we can safely conclude that the DOE bit has no effect, and that the disable-output-escaping attribute has therefore been effectively ignored.

Proposal: after the paragraph stating:

<quote>
If output escaping is disabled for an xsl:value-of or xsl:text instruction evaluated when temporary output state is in effect, the request to disable output escaping is ignored.
</quote>

add a Note:

<quote>
Note: Furthermore, a request to disable output escaping has no effect when the newly constructed text node is used to form the value of an attribute, comment, or processing instruction. This is because the rules for constructing such nodes (defined in [5.7.2 Constructing Simple Content]), cause the text node to be atomized, and the process of atomizing a text node is not affected by the disable-escaping property.
</quote>

There is one case this does not cover. XSLT 2.0 set temporary output state during evaluation of xsl:message; XSLT 3.0 does not. So whereas 2.0 said that d-o-e while writing xsl:message was definitely ignored, 3.0 has no such statement; but since serialization of xsl:message results is entirely implementation-defined, I think we can live with that.
Comment 2 Michael Kay 2017-05-12 10:30:06 UTC
Revisiting disable-output-escaping and writing a few more tests, I have discovered a couple of cases where it's not working in my implementation. There are a couple of situations where output is buffered before being sent to the serializer:

(a) try/catch

(b) xsl:fork in streaming mode

and in these cases the DOE bit is not being maintained.

Although disable-output-escaping is deprecated it seems that a 3.0 processor wanting to implement it in a conformant way has to make it work in these situations as well as the situations where it is needed for backwards compatibility.
Comment 3 Michael Kay 2017-06-01 20:58:03 UTC
The WG agreed to add the Note proposed in comment 2, and this has been done.

Regarding comment #3, the WG resolved to take no action. 

Note that the sentence "It is implementation-defined whether (and under what circumstances) disabling output escaping is supported." could be interpreted as allowing implementations to support d-o-e in particular circumstances while not supporting it within xsl:try or xsl:fork.