Deprecate inline XSLT for production of SVG #1356
Description
Specification title
XSLT deprecation
Specification or proposal URL (if available)
Explainer URL (if available)
No response
Proposal author(s)
No response
MDN URL
No response
Caniuse.com URL
No response
Bugzilla URL
No response
Mozillians who can provide input
No response
WebKit standards-position
WebKit/standards-positions#615
Other information
WHATWG discussion on XSLT deprecation
In improving security of XML parsing in Chrome and moving to Rust based XML parsing, we found that there is a niche option to generate SVG from raw XML data by means of inline XSLT.
Examples:
https://rtsh.es/test/xml/svg_xslt_img.html
https://rtsh.es/test/xml/svg_xslt.svg
At the moment, WebKit supports both. So does Chrome, but plans to deprecate it. Firefox supports the XSLT processing only for the SVG standalone case, not for the externally referenced image.
In Chrome, we are planning to deprecate this before deprecating XSLT as a whole, as usage seems virtually non-existant.
Chrome previously deprecated usage of external XSLT referenced from SVG images.
We started tracking telemetry metrics for when we discover an XSLT processing instruction in SVG image, or in an SVG standalone document (loaded as main document):
https://chromestatus.com/metrics/webfeature/timeline/popularity/5777
https://chromestatus.com/metrics/webfeature/timeline/popularity/5778
The graphs show 0 data.