1 files changed, 33 insertions, 1 deletions

diff --git a/WebCore/xml/XSLTProcessorQt.cpp b/WebCore/xml/XSLTProcessorQt.cpp
index 50ee427..9ac3f5d 100644
--- a/WebCore/xml/XSLTProcessorQt.cpp
+++ b/WebCore/xml/XSLTProcessorQt.cpp
@@ -36,6 +36,7 @@
 #include <wtf/Vector.h>
 
 #include <qabstractmessagehandler.h>
+#include <qabstracturiresolver.h>
 #include <qbuffer.h>
 #include <qsourcelocation.h>
 #include <qxmlquery.h>
@@ -87,6 +88,31 @@ void XSLTMessageHandler::handleMessage(QtMsgType type, const QString& descriptio
                         sourceLocation.line(), sourceLocation.uri().toString());
 }
 
+class XSLTUriResolver : public QAbstractUriResolver {
+
+public:
+    XSLTUriResolver(Document* document);
+    virtual QUrl resolve(const QUrl& relative, const QUrl& baseURI) const;
+
+private:
+    Document* m_document;
+};
+
+XSLTUriResolver::XSLTUriResolver(Document* document)
+    : QAbstractUriResolver()
+    , m_document(document)
+{
+}
+
+QUrl XSLTUriResolver::resolve(const QUrl& relative, const QUrl& baseURI) const
+{
+    QUrl url = baseURI.resolved(relative);
+
+    if (!m_document->frame() || !m_document->securityOrigin()->canRequest(url))
+        return QUrl();
+    return url;
+}
+
 bool XSLTProcessor::transformToString(Node* sourceNode, String&, String& resultString, String&)
 {
     bool success = false;
@@ -94,7 +120,9 @@ bool XSLTProcessor::transformToString(Node* sourceNode, String&, String& resultS
     RefPtr<XSLStyleSheet> stylesheet = m_stylesheet;
     if (!stylesheet && m_stylesheetRootNode) {
         Node* node = m_stylesheetRootNode.get();
-        stylesheet = XSLStyleSheet::create(node->parent() ? node->parent() : node, node->document()->url().string());
+        stylesheet = XSLStyleSheet::create(node->parent() ? node->parent() : node,
+            node->document()->url().string(),
+            node->document()->url()); // FIXME: Should we use baseURL here?
         stylesheet->parseString(createMarkup(node));
     }
 
@@ -107,6 +135,7 @@ bool XSLTProcessor::transformToString(Node* sourceNode, String&, String& resultS
     QXmlQuery query(QXmlQuery::XSLT20);
 
     XSLTMessageHandler messageHandler(ownerDocument.get());
+    XSLTUriResolver uriResolver(ownerDocument.get());
     query.setMessageHandler(&messageHandler);
 
     XSLTProcessor::ParameterMap::iterator end = m_parameters.end();
@@ -132,6 +161,9 @@ bool XSLTProcessor::transformToString(Node* sourceNode, String&, String& resultS
 
     query.setFocus(&inputBuffer);
     query.setQuery(&styleSheetBuffer, QUrl(stylesheet->href()));
+
+    query.setUriResolver(&uriResolver);
+
     success = query.evaluateTo(&outputBuffer);
     outputBuffer.reset();
     resultString = QString::fromUtf8(outputBuffer.readAll()).trimmed();