Embedded script blocks and the XSLT document() function are optional features on the XslCompiledTransform class. These features are disabled by default. The XsltSettings class specifies which of these optional features to support. Features are enabled or disabled using the class properties. The XsltSettings object is then passed to the XslCompiledTransform..::.Load method.

Security Note:

XSLT style sheets can include references to other files and embedded script blocks. A malicious user can exploit this by supplying you with data or style sheets that when executed can cause your system to process until the computer runs low on resources. Do not enable scripting or the document() function unless the style sheet comes from a trusted source. If you cannot verify the source of the style sheet, or if the style sheet does not come from a trusted source, use the default XSLT settings.

The following example loads a style sheet and enables XSLT script support.

' Create the XsltSettings object with script enabled.
Dim settings As New XsltSettings(False, True)

' Create the XslCompiledTransform object and load the style sheet.
Dim xslt As New XslCompiledTransform()
xslt.Load("sort.xsl", settings, New XmlUrlResolver())

// Create the XsltSettings object with script enabled.
XsltSettings settings = new XsltSettings(false,true);

// Create the XslCompiledTransform object and load the style sheet.
XslCompiledTransform xslt = new XslCompiledTransform();
xslt.Load("sort.xsl", settings, new XmlUrlResolver());

Windows 7, Windows Vista, Windows XP SP2, Windows XP Media Center Edition, Windows XP Professional x64 Edition, Windows XP Starter Edition, Windows Server 2008 R2, Windows Server 2008, Windows Server 2003, Windows Server 2000 SP4, Windows Millennium Edition, Windows 98

.NET Framework

Reference

Other Resources