Skip to content
XSLT Checker
XSLT Checker / XSLT polyfill

The XSLT polyfill, self-hosted

A polyfill gives a browser back what it removed. This one brings back XSLTProcessor and styled XML files with a script you serve yourself.

Last updated: ยท What changed: Added an accuracy table, coverage statement and Chrome 158 sourcing, and a new operator section on the About page.

What it is

The official deprecation page points to a polyfill that runs libxslt, the C library most browsers used, compiled to WebAssembly. Version 1.0.33 on npm is called xslt-polyfill, is by Mason Freed and is licensed BSD-3-Clause, which allows you to host a copy yourself if you keep the licence text. The file xslt-polyfill.min.js is about 1.4 MB.

Self-host it

  1. Download the package from npm (npm pack xslt-polyfill) and take xslt-polyfill.min.js and LICENSE.
  2. Upload both to your site, for example under /xslt-polyfill.min.js. Serve the script as UTF-8.
  3. For an XML file with an XSLT line, add the script element inside the root element:
<script src="/xslt-polyfill.min.js" xmlns="http://www.w3.org/1999/xhtml"></script>

For a web page that calls new XSLTProcessor(), add a normal script tag before your own code and wait for window.xsltPolyfillReady before the first transform. The polyfill replaces XSLTProcessor with its own copy.

If your site sends a Content-Security-Policy, the script needs script-src 'self' 'wasm-unsafe-eval', because WebAssembly has to be compiled.

Pros

  • Smallest change: one line in the XML file, or one script tag.
  • Your stylesheet and your output stay exactly as they are.
  • No build step and no server changes.

Cons

  • Every visit to the XML file downloads about 1.4 MB before the page can draw.
  • It is XSLT 1.0 only, like the engines it replaces.
  • It adds a script to a file that used to be data, which some sites and security reviews do not want.
  • You depend on one maintainer's package and have to update your copy yourself.
  • Search engines and feed readers do not run it, which is fine, because they never needed the stylesheet.

When to choose something else

For a sitemap or a feed that only needs to look tidy, CSS is a few hundred bytes. For a page that must keep its exact layout, render the HTML once at build time. The polyfill earns its weight when you cannot change the build, or when scripts call XSLTProcessor in many places. The converter on this site uses the same polyfill.

Questions

Is the XSLT polyfill free to use?

Yes. The package xslt-polyfill is BSD-3-Clause licensed, which permits using and redistributing it with the licence text included.

Do I need a CDN for the polyfill?

No. Copy the one file to your own site and link it from there. Self-hosting avoids a third party and keeps the file under your cache rules.

Does the polyfill work in an XML file?

Yes. Add a script element in the XHTML namespace inside the XML root, as shown above. Browsers that still run XSLT natively do the transform first.

Why does it need wasm-unsafe-eval in my CSP?

The transform engine is a WebAssembly module, and browsers treat compiling WebAssembly as an unsafe-eval-like operation under CSP. wasm-unsafe-eval allows WebAssembly without allowing eval().

Does it support XSLT 2.0?

No. It is libxslt, which implements XSLT 1.0.