Can I prevent a user from submitting malicious XSL code to hack the server?

Question

In my webpage, I am going allow clients (X)HTML. To avoid XSS, I will use HTML Purifier, and disable the <script> tag (and some other dangerous tags).

Yet I would like to enable designers of those (X)HTML to use certain programming-like features, for example displaying a list of items, which would need a for-loop.

Then I came up with the idea that : users submit the XSL code, I provide the XML with the data required by the users.

As HTML Purifier cannot sanitise XSL code (can it?), my proposed flow would be:

1. User submits a piece of XSL code.
2. In the server, there are some sample data (sample XMLs). PHP is used to do the XSL transform with those sample XML data.
3. Pass the output XHTML to HTML Purifier. If HTML Purifier detects any prohibited elements in the code, stop process and show the errors to user.
4. If it passes HTML Purifier, check it against the W3C validator. (This is just a double check. Outputs from HTML Purifier should be valid.)
5. Save the piece of XSL code into database. Use (include) it whenever needed.

Do you think the flow above can assure the final XSL code saved into the database is clean (given that HTML Purifier is perfect)?

Another concern is that, (this is the main question here), is it safe to accept arbitrary XSL codes, and perform XSL transform by PHP in the server? Could there be any security holes that some XSS, injection, etc being included in the XSL codes, such that being harmful to the server or the PHP programs?

Finally, if there are any other ideas/design to achieve this, any solutions are welcomed!

Answer 1

Absolutely not. XSL is Turing Complete and user-submitted XSL scripts can, at the very least, use up all your CPU, and at the very worst, run code on your server.

And even if the XSL is valid, there is absolutely no indication that a run on a single test input does not mean that the XSL cannot produce XSS output on specially crafted input.

Answer 2

Another thing to consider when allowing users to submit their own XSLT is that XSLT files are XML files themselves and could be open to things like Billion Laughs (XML bomb) attacks.