oscerd opened a new pull request, #26270: URL: https://github.com/apache/camel/pull/26270
This aligns `camel-smooks` with the XML reader configuration already applied by the other Camel XML components. ## Background When the Smooks data format (`.unmarshal().smooks(...)`) and the Smooks component (`smooks:...`) parse XML input, the underlying SAX reader (Woodstox, resolved through Smooks) is used with its default feature configuration, which resolves external XML entities. Other Camel XML components (`camel-xmlsecurity`, `camel-schematron`, `camel-xslt-saxon`, `camel-jaxb`, `camel-cm-sms`) already disable external entity resolution; `camel-smooks` did not. ## Change The XML body is now parsed with a `DocumentBuilder` that disables external general and parameter entities (and external DTD loading) before the parsed document is handed to Smooks. The Smooks reader is shared across every source type, and reconfiguring it through the Smooks reader API also affects the non-XML readers used for marshalling and for EDI/CSV/JSON (it makes them reject the XML feature and fail). So rather than reconfiguring the Smooks reader, the XML input is parsed into a DOM with a hardened parser and passed to Smooks as a DOM source. As a result: - Only configurations that parse XML with the **default** reader are affected. Configurations that declare their own reader (EDI, CSV, JSON, DFDL, or a custom reader) are unchanged. - The **marshalling** direction (Java object to XML) is unchanged. - Documents carrying an internal DTD subset still parse. A new `allowExternalEntities` option (default `false`) on the data format and the endpoint restores the previous behaviour for trusted legacy configurations that rely on external entity resolution. ## Tests - `SmooksDataFormatXmlSecurityTest` and `SmooksComponentXmlSecurityTest` verify that an external entity referenced from the body is not resolved by default, and is resolved when `allowExternalEntities=true`. - The existing EDI, CSV and marshalling tests continue to pass, confirming those paths are untouched. ## Docs Upgrade-guide entry added for 4.23. Jira: https://issues.apache.org/jira/browse/CAMEL-24677 --- _Claude Code on behalf of @oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
