Comment Comment by zgk7iqea Very interesting, thanks.One point from one of the linked threads I find particularly puzzling:> I think the issue with XSLT isn't necessarily the size of the attack surface, it's the lack of attention and usage.> I.e. nearly 100% of sites use JS, while 1/10000 of those use XSLT. So all of the engineering energy (rightfully) goes to JS, not XSLT.XSLT is a finished standard. Not everything needs to evolve. If the implementation works and is safe, what speaks against keeping it? parent zgk7iqea 11 months ago
One point from one of the linked threads I find particularly puzzling:
> I think the issue with XSLT isn't necessarily the size of the attack surface, it's the lack of attention and usage.
> I.e. nearly 100% of sites use JS, while 1/10000 of those use XSLT. So all of the engineering energy (rightfully) goes to JS, not XSLT.
XSLT is a finished standard. Not everything needs to evolve. If the implementation works and is safe, what speaks against keeping it?