Saxon » SaxonC

I am used to set the processor to only allow http and https as the allowed protocols if I tend to deploy Saxon with Java or .NET or Python to a server, the intent (which worked fine for me so far) is to disallow user code in XSLT/XPath/XQuery to access the file system with e.g. the doc, collection, unparsed-text, json-doc functions.

However, with SaxonC HE 12.1, that approach now gives me a NullPointerException when simply trying to compile some XSLT (from file):

from saxonche import *

with PySaxonProcessor(license=False) as proc:
    print(proc.version)

    proc.set_configuration_property('http://saxon.sf.net/feature/allowedProtocols', 'http,https')

    xslt30_processor = proc.new_xslt30_processor()

    xslt30_executable = xslt30_processor.compile_stylesheet(stylesheet_file='pipeline-for-svrl.xsl.SaxonEE12CompiledForHE.sef')

Output:

SaxonC-HE 12.1 from Saxonica
Traceback (most recent call last):
  File "C:\Users\marti\PycharmProjects\SaxonHEC12ProtocolRestrictionTest1\XSLTCompilationTest1.py", line 10, in <module>
    xslt30_executable = xslt30_processor.compile_stylesheet(stylesheet_file='pipeline-for-svrl.xsl.SaxonEE12CompiledForHE.sef')
  File "python_saxon\saxonc.pyx", line 1150, in saxonche.PyXslt30Processor.compile_stylesheet
RuntimeError: NullPointer exception found: java.lang.NullPointerException
	at net.sf.saxon.lib.ProtocolRestrictor.lambda$new$2(ProtocolRestrictor.java:55)
	at net.sf.saxon.lib.ProtocolRestrictor.lambda$new$3(ProtocolRestrictor.java:60)
	at net.sf.saxon.lib.ProtocolRestrictor.test(ProtocolRestrictor.java:70)
	at net.sf.saxon.lib.DirectResourceResolver.resolve(DirectResourceResolver.java:58)
	at net.sf.saxon.lib.ResourceRequest.resolve(ResourceRequest.java:130)
	at net.sf.saxon.option.cpp.SaxonCAPI.resolveFileToSource(SaxonCAPI.java:1186)
	at net.sf.saxon.option.cpp.Xslt30Processor.compileFromFile(Xslt30Processor.java:318)
. Line number: -1

I guess the NullPointerException is a bug in any case, I don't know whether subjecting the XSLT compilation to protocol restrictions is intended, I don't think this happened in 12.0.

For it's worth, I tried some similar Java code with Saxon HE 12.1

        Processor processor = new Processor(false);

        processor.setConfigurationProperty(Feature.ALLOWED_PROTOCOLS, "http,https");

        XsltCompiler xsltCompiler = processor.newXsltCompiler();

        XsltExecutable xsltExecutable = xsltCompiler.compile(new File("pipeline-for-svrl.xsl.SaxonEE12CompiledForHE.sef"));

and there I don't get any error or protocol exceptions.