XSL not working in Google Chrome XSL not working in Google Chrome google-chrome google-chrome

XSL not working in Google Chrome


The reason this doesn't work is due to a security concern that Chrome has addressed in a controversial way[1][2][3][4], by blocking XML files from accessing local XSLT files in the same directory, while HTML files can access .CSS files in the same directory just fine.

The justification given by the Chrome team in 2008 was this:


Imagine this scenario:

  1. You receive an email message from an attacker containing a web page as an attachment, which you download.

  2. You open the now-local web page in your browser.

  3. The local web page creates an whose source is https://mail.google.com/mail/.

  4. Because you are logged in to Gmail, the frame loads the messages in your inbox.

  5. The local web page reads the contents of the frame by using JavaScript to access frames[0].document.documentElement.innerHTML. (An Internet web page would not be able to perform this step because it would come from a non-Gmail origin; the same-origin policy would cause the read to fail.)

  6. The local web page places the contents of your inbox into a and submits the data via a form POST to the attacker's web server. Now the attacker has your inbox, which may be useful for spamming or identify theft.

There is nothing Gmail can do to defend itself from this attack.


I do agree it's annoying, as a fix you've got 2 solutions:

  1. Try running chrome with the --allow-file-access-from-files switch (I've not tested this myself)

  2. Upload it to a host, and everything will be fine.


Uploading to host soves problem for me. --allow-file-access-from-files switch solution did not work for me.


In older version of Chrome, if you don't output a proper document with a known vocabulary (HTML, XHTML, SVG, etc.) you will not get a rendered page.

In modern version (I have 10.0.612.3 dev installed), you get an styleless XML document (with a parsing error in your case because of the more than one root element result).

Solution: Output a proper (with all the mandatory elements) HTML 4.0 document, or a proper (also with correct namespace) XHTML 1.0 document.