oscerd opened a new pull request, #25279: URL: https://github.com/apache/camel/pull/25279
## What `XmlStreamDetector` (camel-xml-io-util) created its StAX `XMLInputFactory` with `IS_SUPPORTING_EXTERNAL_ENTITIES=false` but left `SUPPORT_DTD` at its default. This adds `factory.setProperty(XMLInputFactory.SUPPORT_DTD, Boolean.FALSE)`, for consistency with `XmlConverter` / `StaxConverter`, which already disable DTDs. ## Why Defence-in-depth against DTD-based attacks (e.g. internal entity-expansion / "billion laughs" DoS). External entities were already blocked, and the detector only pre-scans XML to determine the root element/namespace, so DTD support is unnecessary. This aligns the detector with the rest of Camel's StAX hardening. ## Behaviour XML carrying a `<!DOCTYPE ...>` is now reported invalid by the detector (the DTD is not processed) instead of being scanned. Camel route XML does not use DTDs, and the other XML parsers already reject them, so this is a safe consistency change. ## Tests Added `documentWithDoctypeIsRejected` to `XmlStreamDetectorTest` (asserts a DOCTYPE-bearing document is reported invalid). The 6 existing detection tests are unaffected. Full-reactor `mvn clean install -DskipTests` is green. ## Backport Applicable to `camel-4.18.x` and `camel-4.14.x` (the class exists there and does not yet set `SUPPORT_DTD`). Backport PRs to follow. Closes CAMEL-24299. --- _Claude Code on behalf of Andrea Cosentino (@oscerd)_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
