[camel] branch main updated: CAMEL-18825: Make XmlHelper more secure

[davsclaus]

This is an automated email from the ASF dual-hosted git repository.

davsclaus pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git


The following commit(s) were added to refs/heads/main by this push:
     new a32f094fbde CAMEL-18825: Make XmlHelper more secure
a32f094fbde is described below

commit a32f094fbdeb2cfafe705c9fe0ac7a299832aca4
Author: Claus Ibsen <claus.ib...@gmail.com>
AuthorDate: Tue Dec 20 08:41:09 2022 +0100

    CAMEL-18825: Make XmlHelper more secure
---
 .../src/main/java/org/apache/camel/maven/XmlHelper.java                 | 2 ++
 1 file changed, 2 insertions(+)

diff --git 
a/tooling/maven/camel-eip-documentation-enricher-maven-plugin/src/main/java/org/apache/camel/maven/XmlHelper.java
 
b/tooling/maven/camel-eip-documentation-enricher-maven-plugin/src/main/java/org/apache/camel/maven/XmlHelper.java
index f3bba7438e2..d189a603c07 100644
--- 
a/tooling/maven/camel-eip-documentation-enricher-maven-plugin/src/main/java/org/apache/camel/maven/XmlHelper.java
+++ 
b/tooling/maven/camel-eip-documentation-enricher-maven-plugin/src/main/java/org/apache/camel/maven/XmlHelper.java
@@ -72,6 +72,8 @@ public final class XmlHelper {
     public static Transformer buildTransformer() throws 
TransformerConfigurationException {
         TransformerFactory transformerFactory = 
TransformerFactory.newInstance();
         transformerFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, 
Boolean.TRUE);
+        transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+        
transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
         Transformer transformer = transformerFactory.newTransformer();
         transformer.setOutputProperty(OutputKeys.INDENT, "yes");
         
transformer.setOutputProperty("{http://xml.apache.org/xslt}indent-amount";, "2");