XSL Error - External function calls have been disabled

[Keno]

Hi everyone,
I'm running into the next error when the flow executes an XSL policy:

05/31/2024 12:28 AM EMULATOR ERROR Code : messaging.resource.XSLCompilationFailedWithFatalErrors
05/31/2024 12:28 AM EMULATOR ERROR Message: Compilation of XSL cxsl://stylesheet_java.xsl failed with Fatal Error: Cannot find a matching 2-argument function named {java:com.example.apigee.extensions.MyJavaExtensions}setVariable(). External function calls have been disabled. null

The xsl file is : 

<xsl:stylesheet version="2.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
    xmlns:ext="java:com.example.apigee.extensions.MyJavaExtensions"
    extension-element-prefixes="ext">

    <xsl:template match="/">
        <xsl:variable name="testvar" select="ext:setVariable('key', 'value')"/>
    </xsl:template>
</xsl:stylesheet>​

As you can see, I'm trying to call a java function that was previously invoked in the flow. 

How can I enable external function calls?. I'm using apigee emulator to test in my local machine.  I wonder if I will run into the same error once I deploy in Apigee Edge. 

Thank you!

[nmarkevich]

Hi @Keno,

The error you're seeing is due to external function calls in XSLT being disabled by default in Apigee, and this is a security measure. Allowing external Java methods in XSLT introduces a significant risk, such as remote code execution (RCE), so this restriction is enforced in Apigee X and Apigee Edge.

Even though you’re testing in the emulator, I can confirm that you'll definitely encounter the same error in Apigee Edge and Apigee X. I actually reported this issue to Google about external function calls being enabled by default a year ago, and as a result, they implemented this restriction in Apigee Edge to enhance security.

Additionally, even if external function calls were enabled, your attempt to call a custom Java class like xmlns:ext="java:com.example.apigee.extensions.MyJavaExtensions" is likely to fail. Apigee’s class loader for JavaCallout policies should be isolated to that specific policy and shouldn't expose the custom classes outside of it. So, trying to reference your Java class in the XSLT policy shouldn’t work even with external functions enabled.

To safely handle variable assignments, consider using Apigee’s built-in policies like AssignMessage or JavaScript instead of relying on external Java methods within XSLT.

Hope this helps clarify things!

Best,
Nikita

[dchiesa1]

---

@Keno wrote:

I'm trying to call a java function that was previously invoked in the flow. 

---

Hi , 

what do you mean by "previously invoked in the flow" ? 

[Mohammed-Mahtab]

Apigee Private cloud 4.53.00 XSL Transform policy is falling

Hi @dchiesa1 

The XSL Transform policy was working on OPDK Version 4.50.00.00, but after migrated the same code to 4.53.00 we are getting error 

{

    "fault": {

        "faultstring": "Evaluation of XSL FindAccountReceivableRequest.xsl failed with reason: \"Cannot find a matching 1-argument function named {http://exslt.org/common}node-set(). External function calls have been disabled\"",

        "detail": {

            "errorcode": "steps.xsl.XSLEvaluationFailed"

        }

    }

}

Apigee Trace 

error.cause.cause Cannot find a matching 1-argument function named {http://exslt.org/common}node-set(). External function calls have been disabled
error Evaluation of XSL FindAccountReceivableRequest.xsl failed with reason: "Cannot find a matching 1-argument function named {http://exslt.org/common}node-set(). External function calls have been disabled"
type ErrorPoint
state PROXY_REQ_FLOW
error.class com.apigee.flow.FlowException
error.cause Cannot find a matching 1-argument function named {http://exslt.org/common}node-set(). External function calls have been disabled
Identifier fault

[dchiesa1]

Hi, 

If I am understanding correctly, your question is entirely independent of the question originally posted here in this thread, in May 2024.  Is that right? Yours is related to an OPDK upgrade. 

if so, please post a new question. And we'll have someone address it there.

[Mohammed-Mahtab]

Thanks @dchiesa1   please provide your valuable input on this https://www.googlecloudcommunity.com/gc/Apigee/XSL-Error-Cannot-find-a-matching-1-argument-function-...