kafsemo.org

Browser XSLT going away

2026-11-06

Following a Google proposal in 2025, XSLT is being removed from the web platform. As Mozilla say:

While it's important to not break existing web content, it's also important to prevent security vulnerabilities. XSLT has been in maintenance mode in browsers and has been an ongoing source of security issues.

I’m a little nostalgic for the xml-stylesheet processing instruction. At the same time, the frozen 1.0 version of XSLT ignores all the improvements in 2.0 and 3.0, leaving it fairly literally stuck in the ’90s.

Outside a reference in my modest proposal for XML+Data, I used it to present some RDF for a blog post.

Existing behaviour

Currently, a file served as data.rdf starts with:

<?xml-stylesheet type='text/xsl' href='data-presentation.xsl'?>

That means:

  1. A browser requesting the RDF file applies the transformation and presents it as HTML.
  2. For other clients, the underlying data is RDF/XML.

Preserving behaviour

I’d like to preserve this behaviour, ideally under the existing URL, with Apache. I created a type map that points to underlying files with an additional suffix:

URI: data.rdf.rdf
Content-type: application/rdf+xml

URI: data.rdf.html
Content-type: text/html

Serve that map under the existing URL:

RewriteRule ^data.rdf$ data.rdf.var

and process the file server-side so there’s an HTML version:

xsltproc data-presentation.xsl data.rdf >data.rdf.html

Now:

  1. A browser requesting that URL will announce that it prefers HTML and get the HTML version.
  2. A client that prefers RDF/XML, or has no opinion, will get the RDF.

Ironically, the graphical representation of the data is more interesting.

(Music: The Hives, “Bogus Operandi”)
(More from this year, or the front page? [K])