0

I am using saxonica EE (trial version) for xslt transformation in java application, need a help on handling infinite loop while transforming a payload using XSLT. Is there any timeout we can configure for transformation so that if it goes to infinite loop we can timeout the request and it should not bring down the application?

I read that infinite loop will not cause stack-overflow in saxonica parser, so was time-out is better option to stop the transformation and throw an error.

kantesh
  • 61
  • 1
  • 6
  • What kind of XSLT code exactly do you have that you consider a loop or even an infinite loop? As for breaking out after certain processing, the closest in XSLT 3 (i.e. Saxon 9.8 or later) is `xsl:iterate` with `xsl:break`. – Martin Honnen Jun 21 '21 at 16:04
  • i do not have a control over the xslt or the payload, wanted check if there is any standard of way of handling infinite loop in saxonica xslt transformation – kantesh Jun 22 '21 at 17:34

1 Answers1

0

As with other programming languages, limiting the resources used by a program is a matter for the execution framework, not for the language processor itself. For example, you can find some ideas here: https://www.baeldung.com/java-stop-execution-after-certain-time

and here: How to properly stop the Thread in Java?

Interrupting threads, however, can be problematic if the thread is in a tight CPU loop.

It's actually quite hard to construct an infinite loop in XSLT, it requires some ingenuity. But writing code that takes a very long finite time is quite easy, it just needs three or four nested xsl:for-each statements and a large source document.

The practical answer, I think, is to not let untested code run in a production environment. Always test it in an IDE first. That's why, for example, use of xsl:evaluate can be disabled.

Michael Kay
  • 156,231
  • 11
  • 92
  • 164
  • Thanks Michael, will look into the options, we don't have control over the xslts which user will be uploading to our application. – kantesh Jun 22 '21 at 17:32
  • In that case be very careful about security. Take care to disable use of extension functions and any attempts to access local file store using file: URIs with the document() function. Running someone else's untrusted code on your server without verification is a pretty scary thing to do. – Michael Kay Jun 22 '21 at 17:41