I've been working on a little demo for how to avoid copy-pasting header/footer boilerplate on a simple static webpage. My goal is to approximate the experience of Jekyll/Hugo but eliminate the need for a build step before publishing. This demo shows how to get basic templating features with XSL so you could write a blog post which looks like
<?xml version="1.0"?>
<?xml-stylesheet type="text/xsl" href="/template.xsl"?>
<page>
<title>My Article</title>
<content>
some content
<ul>
<li>hello</li>
<li>hello</li>
</ul>
</content>
</page>
- no build step (no need to setup Jekyll on the client or configure Github/Gitlab actions)
- works on any webserver (e.g. as opposed to server-side includes, actions)
- normal looking URLs (e.g. `example.com/foobar` as opposed to `example.com/#page=foobar`)
[0]: https://news.ycombinator.com/item?id=44952185
See also: grug-brain XSLT https://news.ycombinator.com/item?id=44393817
Google have also asked for it to be removed from the standard [0].
This looks like as good a place as any to show the XML/XSLT code that I've been tinkering with for the last couple of years: https://github.com/zmodemorg/wyrm.org
All this has also reignited my idea for a compile-to-XSLT templating language, too – maybe I’ll get to it finally this time; definitely if XSLT 3.0 gets into web standards: https://github.com/whatwg/html/issues/11578, https://news.ycombinator.com/item?id=44987552
Also, I’ve put together a simple XSLT playgroung a while ago! https://xsltbin.ale.sh/
Even single page app frameworks have mostly solved this by doing the rendering on the server instead of making multiple round trips from the client. This feels like the no-JavaScript version of Spinnergeddon.
Does the browser wait for all the includes to resolve before showing the page or does it flicker in?
Unsurprisingly the idea did not take off, but I did find the XML/XSLT combination to be very interesting.
Partly, there's increasing attacks against XML.
And also, libxml2 has said "no" to security embargoes altogether. [0]
They might well consider there to be 0-days waiting in XSLT.
Citation? That would greatly surprise me in its abruptness and severity (they only just started talking about it this month, and acknowledge it’s particularly risky for enterprise) and https://chromestatus.com/feature/4709671889534976 gives no such indication.
The origin story of whatwg is that Apple, Mozilla and Opera decided that W3C wasn't making specs that they wanted to implement, so they created a new working group to make them.
I’ve seen a lot of eye-batting about this. Although Google, Mozilla and Apple are all in favour of removing it, there’s been a lot of backlash from developers.
https://bawolff.net/css-website/index.xml is Evidlo's example but using a css stylesheet instead of xslt. I changed some of the text to explain what i was doing, but otherwise the XML is unchanged with one exception. Unfortunately you do have to put the <a> tags in the xhtml namespace to make them clickable. Other than that no changes to the xml.
Obviously there is a lot that xslt can do that css cannot, but when it comes to just display, CSS is an option here.
- Custom HTML elements
- Shadow DOM
- HTML imports
- HTML templates
Eventually it became clear some browsers were not going to implement and the design of HTML imports was better handled be ES modules.
https://webmasters.stackexchange.com/questions/127482/on-wha...
Also, while this is certainly Google throwing their weight around, I don’t think they are doing it for monetary advantage. I’m not sure how removing XSLT burnishes their ad empire the way things like nerfing ManifestV3 have. I think their stated reasons - that libxslt is a security disaster zone for an obscure 90s-era feature - is earnest even if its not actually in the broader web’s best interests. Now that Safari is publicly on board to go second, I suspect it’s an inevitability.
panos: next item, removing XSLT. There are usage numbers.
stephen: I have concerns. I kept this up to date historically for Chromium, and I don't trust the use counters based on my experience. Total usage might be higher.
dan: even if the data were accurate, not enough zeros for the usage to be low enough.
mason: is XSLT supported officially?
simon: supported
mason: maybe we could just mark it deprecated in the spec, to make the statement that we're not actively working on it.
brian: we could do that on MDN too. This would be the first time we have something baseline widely available that we've marked as removed.
dan: maybe we could offer helpful pointers to alternatives that are better, and why they're better.
panos: maybe a question for olli. But I like brian's suggestion to mark it in all the places.
dan: it won't go far unless developers know what to use instead.
brian: talk about it in those terms also. Would anyone want to come on the podcast and talk about it? I'm guessing people will have objections.
emilio: we have a history of security bugs, etc.
stephen: yeah that was a big deal
mason: yeah we get bugs about it and have to basically ignore them, which sucks
brian: people do use it and some like it
panos: put a pin in it, and talk with olli next time?
panos: next thing is file upload control rendering
[0] https://github.com/whatwg/html/issues/11146#issuecomment-275...
https://meyerweb.com/eric/thoughts/2025/08/22/no-google-did-...
This latter part is why I've reached for XSLT in the past. Most recently was to convert an RSS feed into a styled page with instructions at the top. Templates and xpath can really transform a document.
At least the browser has to load template.xsl before it can know it has to load the css file though, right? And this is just a simple demo page.
Did what? The GP asked for a citation for XSLT support going behind a flag in the next version of Chrome, but you forgot to add that. As best as I can tell, the GP is right and you're confused.
They were advocating for removing it. And it was specific. And is labelled by the Chromium report you mentioned as the cause.
It wasn't "this month".
I think rejecting that proposal was the right thing to do. What disappoints me is that there hasn't been a more declaritive, simpler proposal that has gotten anywhere.
[0] https://github.com/Evidlo/xsl-website/blob/0dda1d82ce1eb01b7... [1] https://en.wikipedia.org/wiki/Identity_transform
Possible names: Client Side Includes (CSI): Like Server Side Includes (SSI) in Apache IHTML (inline html): Like the iframe tag, but for html instead of whole page.
If course XSLT can also be used server-side (which is probably a good idea if you want access to the latest features and not some ancient, frozen version of the spec), but browsers aren't the reason that that didn't take off. My guess there is that it's just not an intuitive way of manipulating and templating data in comparison to more traditional HTML templating libraries.
Now you can imagine with a real site, you will have many includes per page, each one perhaps using includes of it's own. You end up with a really bad waterfall where it can take a long time for a page to load because it's going back to the server constantly, whereas if you did it on the server it would be a single round trip.
Early SPA's did this, they would load a shell and then begin fetching from the client. Some still do but we know better than to do this for things that aren't web apps.
HTML Imports was part of the initial set of the web components specs, there's no "cabal" or whatever that got its hands on it, and it didn't rely on JavaScript, not in the way you're probably referring to.
It was only opposed because it was separate from the JS module system, not because it relied on JS.
It's replacement: The HTML Modules proposal has general support from all vendors, just no one has put together a complete proposal yet.
HTML Imports were shelved because they didn't integrate with the JS module graph. HTML Modules will do that someday.
Thanks for the playground! I'll check it out.
It is not quite a templating engine. XSLT is a part of a semantic engine. Content is written in the way that fits the content. E. g. I write about some language and invent tags and notations that best fit what I am talking about: grammar, sounds, wrtiting. Or I write about chess and say something like (party id=abc move=15w). Then I make it available in HTML by providing a transform from my tags to HTML tags. My notation is rendered as a bunch of divs, ps and spans. This is merely a temporary rendering; other renderings may be possible.
A templating engine is the final document with placeholders for variable parts. XSLT can do that too, but this is less than its vision.
Then another few months pass, and one of the agitators goes about formally proposing removing it, so that finally it isn’t just murmurings more or less behind closed doors, but out in public for the developers to clamour about. That’s where we are this month.
// XSL $xsl_doc = new DOMDocument(); $xsl_doc->load("file.xsl");
// Proc $proc = new XSLTProcessor(); $proc->importStylesheet($xsl_doc); $newdom = $proc->transformToDoc($xml_doc);
// Output print $newdom->saveXML();
XSLT lacks functionality? No problem, use php functions in xslt: https://www.php.net/manual/en/class.xsltprocessor.php
These are all static file downloads, though. The first page load will take long, but if these are header/footer type includes, every subsequent page will use the cached file.
It's a trade-off between longer times for landing page and shorter times for every other page. The developer will decide whether or not to make the trade-off.
<!doctype html [
<!entity e system "e.html">
]>
<html>
<title>Hello, world!</title>
<p>The content of e is: &e;</p>
</html>
There really never had been a need or call for browser devs to come up with idiosyncratic and overcomplicated solutions relying on JavaScript for such a simple and uncontroversial facility as a text macro which was part of every document/markup language in existance since the 1960s.
XSLT is also big in the TEI community in digital humanities. TEI gives a structured markup for reproducing printed volumes, which is important when you are dealing with variants of the same text, like revised editions of a text. XSLT lets you turn your TEI file into a web page for humans to read.
It is 2025 and now we've got LLMs to write our code - that may actually be a strong argument in favor of keeping XSL(T): It is a useful browser mechanism and LLMs makes it easier to harvest.
Does anybody have experience with LLM-generated XSL(T)?
HTML Imports didn't need JS to work: they used link tags and could transitively import HTML files without any JS.
You only needed JS because the wasn't anything you could do with the HTML yet because declarative custom elements don't exist yet.
HTML Imports were rejected because they created a parallel module graph to the JS module graph.
I think they could have been made to share the same graph, but that's basically what HTML modules are anyway.
> build step with React and webpack and javascript absolutely required on the client-side
This was a false statement.
both XSLT and React can be used for this except React can additionally do a bunch of other stuff that does use JS and that XSLT can't do.
Add flag to disable XSLT: https://chromium-review.googlesource.com/c/chromium/src/+/68...
It's approved, I don't know which release it will be.
Additionally, quote from the GitHub discussion:
--- start quote ---
Q: why has Chrome already started working on removing the feature from the browser?
A: To explore the effects of removal. It's hard to tell what will break without being able to turn it off and see.
https://github.com/whatwg/html/issues/11582#issuecomment-320...
--- end quote ---
In the OP scenario, it would provide possibility to have header/footer/stylesheet content in separate files and get system working that does not rely on absolute path of the CSS.
(*) Naturally, just with few minimal directory traversal precautions; basically anything like "no ../" and even restriction like "referenced resource filename must begin with referencing XSL filename" would be fine for me.
curl --head --silent --url https://xsl-website.widloski.com/template.xsl | grep modified
last-modified: Thu, 13 Feb 2025 07:11:02 GMT
[1] at 09:11:48, according https://web.archive.org/web/*/http://xsl-website.widloski.co... [2] https://github.com/Evidlo/xsl-website/commits/master/templat...
> Add flag to disable XSLT
Two very different things. OP is talking about XSLT support going behind a flag, you’re citing XSLT deprecation going behind a flag. The default state matters (and the default state is undeprecated)
It makes sense that the Chrome team would do what they’re doing, otherwise it’s very difficult for anyone to assess the impact of XSLT deprecation.
https://www-archive.mozilla.org/projects/intl/iuc15/paper/iu...
My previous change in this file was in 2017 when I replaced xalan by the xslt processor built in java. I was very surprised I had to make the following changes:
-<xsl:if test="string(serverName)=$sName">
+<xsl:if test="string(serverName)=string($sName)">
-<xsl:for-each select="attributeList/attribute[self::attribute!='']">
+<xsl:for-each select="attributeList/attribute[text()!='']">
-<xsl:if test="preceding-sibling::Connection[featureType='Receptacle'][position() = 1]/@Name!=@Name or not(preceding-sibling::Connection[featureType='Receptacle'][position() = 1]/node()) ">
+<xsl:if test="preceding-sibling::Connection[position() = 1]/@Name!=@Name or position()=1">
My impression of XSLT's design is that there were partisan representatives from every popular programming language paradigm on the XSLT standard committee, and each one of them was able to get just enough to showcase what was special about their own paradigm into the standard, while strategically sabotaging all the other competing paradigms to undermine and beclown each other, but not enough for practical coherency, or lord forbid neatly dovetailing together into a synergistic design.
When the Lisp faction evals and applies their functional paradigm, the BASIC faction runs to goto their imperative paradigm, and the Prolog faction is horny and unified that its logical paradigm makes the cut, the result is dysfunctional emparitive illogical programming.
Jeff Atwood points out that "Martin Fowler hates XSLT too":
https://blog.codinghorror.com/martin-fowler-hates-xslt-too/
I have no problem with XML. It’s a fine way to store hierarchical data in a relatively simple, mostly human-readable format. But I’ve always disliked its companion technology, XSLT. While useful in theory – “using a simple XSLT transform, XML can be converted into anything!”– in practice, it takes painful contortions to do anything practical. Evidently I’m not alone; Martin Fowler hates XSLT too:
>All of this site is written in simple XML documents and transformed to HTML. I find this works really well, and means I never have to worry about dealing with HTML formats. (Not that fancy layout is my style, as you can tell.) I’ve even written a whole book that way.
>For most of this time I’ve used XSLT as my transformation language. I’ve got pretty good with slinging XSLT around and getting it to do what I want.
>But no more.
>When I wrote the software for this Bliki (on a long flight) I did it in Ruby. Prior to that I used Ruby to do a new version of my home page. My conclusion from this exercise was that using Ruby for XML transforms was much easier than using XSLT.
I’ve had almost the same exact argument with a few developers I used to work with. After working through a bit of the XSLT necessary to accomplish something, I concluded that it was easier and simpler to use procedural code to do the same thing. Not always, of course, but most of the time. As Fowler points out, this does beg the question: what good is XSLT?
I think this may raise some real questions about XSLT. There’s still much I like about the power of XSLT, but I hate the syntax and the walls you keep running into. I’m not going to convert my whole site over to Ruby tomorrow – most of the XSLT works fine - but I can certainly see my way to doing that at some point in the future. But the bigger question is whether you’re better off with scripting language for this kind of task than XSLT.
Maybe the idea of XSLT transforming XML into “anything” is fundamentally unrealistic – just more Write Once, Run Anywhere snake oil.
Literally from my link:
--- start quote ---
Add a feature flag to disable XSLT
This adds a feature flag that disables:
- XSLTProcessor
- XSLT Processing Instructions
--- end quote ---
In theory. In practice not a single browser had an actual SGML parser and that was never supported.
Anyone who has read the response to the reporter knows that this is a cherry-picked alternative format. The normal format is an HTML5 page. Search engines just return that instead, so the only way to have found this page is by clicking through that.
I haven’t yet cracked open a screen reader to see how it fares, though.
“Deprecate” has a specific meaning, largely unrelated to actual removal (though depending on the convention it may be expected to lead to it after some time).
<?xml version="1.0"?>
<?xml-stylesheet type="text/xsl" href="/invoice.xsl"?>
<invoice>
<date>2025-08-23</date>
<customer>
<name>John Doe</name>
<address>
<line>123 Sunny Boulevard</line>
<city>Miami</city>
<state>FL</state>
<zip>33133</zip>
</address>
</customer>
<items>
<item>
<code>123456</code>
<description>Some Apple gadget</description>
<quantity>1</quantity>
<price>1234.56</price>
<total>1234.56</total>
</item>
<item>more items...</item>
</items>
</invoice>
Then it came SOAP and all the corporate suits and messed it all up into an extra complicated bloatness of anguish and suffering, but XML/XSLT were beautiful on their own (for data transformation, not web pages)
I don't think it's been updated since 2019. XSL was really powerful, but it had a steep learning curve, and I think server-side PHP and client-side JS were just more intuitive.
In the browser context though, i don't see why they couldn't just follow same origin rules.
{
"JSLT": "1.0",
"style": "/invoice.jsl",
"data": {
"invoice":{
"date": "2025-08-23",
"customer": {
"name": "John Doe",
"address": {
"line": "123 Sunny Boulevard",
"city": "Miami",
"state": "FL",
"zip": "33133",
},
},
"items": [
{
"code": "123456",
"description": "Some Apple gadget",
"quantity": "1",
"price": "1234.56",
"total": "1234.56",
},
{
"code": "123457",
"description": "Another Apple gadget",
"quantity": "1",
"price": "1234.57",
"total": "1234.57",
}
]
}
}
}
<html>
<body>
<h2>Invoice</h2>
<p><label>Date</label> <span><%=data.invoice.date%></span></p>
<div>
<h3>Customer</h3>
<p><%=data.invoice.customer.name%></p>
<p>
<%=data.invoice.customer.address.line%>
<%=data.invoice.customer.address.city%>
<%=data.invoice.customer.address.state%>
<%=data.invoice.customer.address.zip%>
</p>
</div>
<table>
<tr>
<th>Code</th>
<th>Description</th>
<th>Quantity</th>
<th>Price</th>
<th>Total</th>
</tr>
<% for(item of invoice.items) { %>
<tr>
<td><%=item.code%></td>
<td><%=item.description%></td>
<td><%=item.quantity%></td>
<td><%=item.price%></td>
<td><%=item.total%></td>
</tr>
<% } %>
</table>
</body>
</html>
TBH, a browser has one million other potential leaks and exploits and denials to care about. Unlike a markup language with carefully crafted rules about what to expand in which context, a browser providing a Turing-complete language trivially runs into infinite loops or recursion and could at best heuristically terminate JS code, after using laborious best-efforts methods such as execution traces and watchdog timers. Moreover, JS syntax itself and how it's represented in markup unneccessarily gives rise to obfuscation and escaping attacks. And the browser in addition also plays fast and loose with an ever-expanding, potentially Turing-complete styling language with super complicated styling syntax and constraint-based layout models with a complete lack of formal semantics or any other formal reasoning. CSS itself can contain HTML literals at several places such as data URIs and the content property with questionable escaping, but I guess this is par for the course when CSS is basically just tunneling yet another syntax through HTML attributes and elements. Context Security Policy is just bolted on to limit this pointless and careless gratuitious syntax proliferation, and of course must invent its own little item-value microsyntax to be tunneled through HTTP headers and HTML header tags.
Considering these glaring and obvious deficits weren't discussed at the same time I assume those who brought up XXE and suggested SGML/XML could leak documents or smuggle executable instructions did so in bad faith or were repeating hearsay to sound clever or something.
What it did do is create a perception that XML is insecure. This hastened its demise.
> It's trivial to mitigate security risk arising out the use of entities.
Obviously. However in practise, historically most implementations did not. At least not by default.
XML spec bears some responsibility for this for not being explicit about suggesting secure defaults.
Regardless, JSON won partially because it didnt have the attack surface, so people didn't have to worry. XML being theoretically easy to secure means nothing when practically implementations made it difficult.
The reason XSLT is this way may be similar to why SQL is this way. SQL is declarative primarily because it isolates the user from concurrency. It would be much easier to write a procedure to fetch the data the way you want, but to write a concurrent procedure that does this safely and nicely among other such procedures would be much harder. XSLT was meant to be used with XML documents of unknown quality, so the logic of what is going on should be traceable. And XSLT did this rather well, given the constraints.
Upd: The constraints, as I see them, were that: the code will be written mostly by non-professionals (there were no professionals yet) so it should not be easy for them to get into an endless loop or otherwise shoot themselves in the foot. CSS faced similar constraints and was always rather awkward; nowadays it is also too complex and is only a formatting engine, not a transformation engine.
E.g. if XSLT was the main engine of the web CSS stylesheets would be unnecessary. The attributes could be placed on the elements themselves as this happens in XSL-FO. This would remove a major source of complexity; look at Tailwind, how popular it is, and why? Exactly because it removes an indirection step and instead of providing an external formatting rule merely formats an element directly.
More or less. I wasn't really about that argument, it was about the intellectual dishonesty of ignoring that it exists.
The original GitHub issue contained that link and was almost immediately answered. Everyone reading the issue report could have, should have and probably did read the answer.
The blog post doesn't mention the argument exists. To be fair to that author, it sounds like it was mostly "oh cool, this exists post", which doesn't need to go into pros and cons.
We can't extend that goodwill to sunaookami. They used it as an example that it's "widely used". Willfully ignoring that this example is pretty minor. (If this is the best example, it's not a good sign, BTW...)
I don't really care about XSLT support in browsers, but I do care about intellectual honesty in these debates. Nobody needs to agree with the argument. AFAIC, it's perfectly okay to believe that this page is of vital importance to the world. But that argument should then be made. That's how we go forward. How we get better decisions. That's how everybody learns.
If on the other hand people only repeat each other's most impressive sounding examples, then everybody gets dumber. We're no longer working to take a good decision through good arguments, but we'd be working to justify a made decision through bad arguments.
I used LLM (gpt o4-mini) for developing a blog template. Overall it did a good job especially with logic loops
Otherwise xml messes up its outputs sometimes
I had to reset my context window frequently
It would do a bad job troubleshooting large sections of code