Oxygen XML Forum

Posted: **Mon Mar 07, 2022 2:02 pm**

Hello,

From javascript, I tried to perform an XSLT action:

TransformToOlAction.prototype.actionPerformed = function (callback) {
   this.editor.getActionsManager().invokeOperation(
      'ro.sync.ecss.extensions.commons.operations.XSLTOperation', {
      action: 'Replace',
      script: '${framework}/lib/element-to-ol.xsl'
   }, callback);
};

But I have the following message:

For security reasons, the execution of ro.sync.ecss.extensions.commons.operations.XSLTOperation with user-provided parameters is blocked. If the operation is safe, consider annotating it with ro.sync.ecss.extensions.api.webapp.WebappRestSafe.

Is it possible to resolve this problem directly in javascript code?
Or, do I have to implement a specific action in Java with @WebappRestSafe annotation?

Thanks.

Posted: **Mon Mar 07, 2022 3:57 pm**

Hello,

This restriction is put in place as a security control to avoid running untrusted XSLT code provided by an user. You will need to implement your own operation that will load the XSLT script from a trusted location (e.g. a JAR file in the classpath) and only receive a couple of params from client-side code.

Best,
Cristian

Posted: **Mon Mar 28, 2022 12:36 pm**

Thanks Cristian for these information.
Regards,
Nicolas

Oxygen XML Forum

XSLTOperation in javascript

XSLTOperation in javascript

Re: XSLTOperation in javascript

Re: XSLTOperation in javascript