XSLT-Transformer

// Native first, WebAssembly fallback. A probe, not a feature check:
// after Chrome 158 the constructor is gone, but a constructor that
// exists and fails is the case that actually misleads you.
function nativeXsltWorks() {
  if (typeof XSLTProcessor === 'undefined') return false;
  try {
    const p = new DOMParser();
    const xsl = p.parseFromString(
      '<xsl:stylesheet version="1.0" ' +
      'xmlns:xsl="http://www.w3.org/1999/XSL/Transform">' +
      '<xsl:template match="/"><ok/></xsl:template></xsl:stylesheet>',
      'application/xml');
    const proc = new XSLTProcessor();
    proc.importStylesheet(xsl);
    const out = proc.transformToDocument(
      p.parseFromString('<a/>', 'application/xml'));
    return out?.documentElement?.nodeName === 'ok';
  } catch {
    return false;
  }
}

async function transform(xmlText, xslText) {
  // xslt-polyfill is libxslt compiled to WebAssembly. Importing it
  // installs a replacement XSLTProcessor on globalThis.
  if (!nativeXsltWorks()) await import('xslt-polyfill');

  const p = new DOMParser();
  const xml = p.parseFromString(xmlText, 'application/xml');
  const xsl = p.parseFromString(xslText, 'application/xml');
  if (xml.querySelector('parsererror') || xsl.querySelector('parsererror')) {
    throw new Error('one of the two inputs is not well-formed');
  }

  const proc = new XSLTProcessor();
  proc.importStylesheet(xsl);
  proc.setParameter(null, 'lang', 'en');   // (namespaceURI, name, value)

  // Returns null rather than throwing. Do not skip this check.
  const out = proc.transformToDocument(xml);
  if (!out) throw new Error('no template matched the document root');

  return new XMLSerializer().serializeToString(out);
}

from lxml import etree

# lxml wraps libxslt, the same engine Chrome and Safari use.
parser = etree.XMLParser(resolve_entities=False, no_network=True, load_dtd=False)
xml = etree.fromstring(xml_bytes, parser)
xsl = etree.fromstring(xsl_bytes, parser)

# DENY_ALL blocks document(), xsl:include, xsl:import and every EXSLT
# file or network operation. Without it a stylesheet is a file-read
# primitive that runs whatever its author wrote.
transform = etree.XSLT(xsl, access_control=etree.XSLTAccessControl.DENY_ALL)

try:
    result = transform(xml, lang="'en'")   # params are XPath: quote strings twice
except etree.XSLTApplyError as e:
    raise SystemExit(f'transform failed: {e}')

# xsl:message output and warnings land here, not in the result.
for entry in transform.error_log:
    print(f'{entry.line}: {entry.message}')

print(str(result))   # honours xsl:output method, encoding and indent

import javax.xml.XMLConstants;
import javax.xml.transform.*;
import javax.xml.transform.stream.StreamResult;
import javax.xml.transform.stream.StreamSource;

TransformerFactory factory = TransformerFactory.newInstance();
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);

// An empty string means "no protocol is permitted", which blocks
// document(), xsl:import and xsl:include of anything outside the
// stylesheet you handed in. Neither is restricted by default.
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");

// Without a listener, compilation warnings go to stderr and are lost.
factory.setErrorListener(new ErrorListener() {
    public void warning(TransformerException e) {
        System.err.println("warning: " + e.getMessageAndLocation());
    }
    public void error(TransformerException e) throws TransformerException {
        throw e;
    }
    public void fatalError(TransformerException e) throws TransformerException {
        throw e;
    }
});

// Templates is compiled once and is thread-safe; Transformer is not.
Templates templates = factory.newTemplates(new StreamSource(stylesheetStream));
Transformer transformer = templates.newTransformer();
transformer.setOutputProperty(OutputKeys.INDENT, "yes");
transformer.setParameter("lang", "en");
transformer.transform(new StreamSource(xmlStream), new StreamResult(System.out));

// The JDK's built-in processor is Xalan, XSLT 1.0. For 2.0 or 3.0 put
// Saxon-HE on the classpath; it registers itself as the factory.

using System.Xml;
using System.Xml.Xsl;

var readerSettings = new XmlReaderSettings
{
    DtdProcessing = DtdProcessing.Prohibit,
    XmlResolver = null,
};

var transform = new XslCompiledTransform();

// XsltSettings.Default disables both the document() function and
// embedded <msxsl:script>. XsltSettings.TrustedXslt enables both and
// should never be used on a stylesheet from outside your codebase.
// The null resolver blocks xsl:import and xsl:include as well.
using (var xslReader = XmlReader.Create(stylesheetPath, readerSettings))
{
    transform.Load(xslReader, XsltSettings.Default, null);
}

var args = new XsltArgumentList();
args.AddParam("lang", "", "en");

using var xmlReader = XmlReader.Create(inputPath, readerSettings);
using var writer = XmlWriter.Create(Console.Out, transform.OutputSettings);
transform.Transform(xmlReader, args, writer);

// XslCompiledTransform is XSLT 1.0. Microsoft never shipped 2.0 for
// .NET; Saxonica's Saxon-HE has a .NET build if you need it.

<?php
// Requires ext-xsl, which wraps libxslt.
$xml = new DOMDocument();
$xml->loadXML($xmlSource, LIBXML_NONET);

$xsl = new DOMDocument();
$xsl->loadXML($xslSource, LIBXML_NONET);

$proc = new XSLTProcessor();

// Block every filesystem and network operation a stylesheet can reach
// for. Only the write prefs are blocked by default.
$proc->setSecurityPrefs(
    XSL_SECPREF_READ_FILE
    | XSL_SECPREF_WRITE_FILE
    | XSL_SECPREF_CREATE_DIRECTORY
    | XSL_SECPREF_READ_NETWORK
    | XSL_SECPREF_WRITE_NETWORK
);

$proc->importStylesheet($xsl);
$proc->setParameter('', 'lang', 'en');

$result = $proc->transformToXml($xml);
if ($result === false) {
    fwrite(STDERR, "transformation failed\n");
    exit(1);
}
echo $result;

# xsltproc ships with libxslt: the same engine Chrome and Safari use,
# and the same one this page falls back to in WebAssembly.
# --nonet stops it fetching anything the stylesheet references.
xsltproc --nonet style.xsl doc.xml > out.html

# --stringparam passes a string. --param takes an XPath expression, so
# a literal string needs its own quotes inside the shell quotes.
xsltproc --nonet --stringparam lang en style.xsl doc.xml
xsltproc --nonet --param year "'2026'" style.xsl doc.xml

# xsl:message output goes to stderr, so separate it before piping.
xsltproc --nonet style.xsl doc.xml 2> messages.log | xmllint --format -

# XSLT 2.0 and 3.0 need Saxon. libxslt will never implement them.
java -cp saxon-he.jar net.sf.saxon.Transform \
  -s:doc.xml -xsl:style.xsl -o:out.html lang=en