This is an automated email from the ASF dual-hosted git repository.
davsclaus pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new 9c23b6868bb9 CAMEL-24691: camel-saxon - align XQueryBuilder with
secure XML parsing defaults
9c23b6868bb9 is described below
commit 9c23b6868bb92cb19c2b5a7ee624421d760cda8f
Author: Andrea Cosentino <[email protected]>
AuthorDate: Tue Sep 22 09:09:56 2026 +0200
CAMEL-24691: camel-saxon - align XQueryBuilder with secure XML parsing
defaults
XQueryBuilder built its default Saxon Configuration with only a
space-stripping ParseOptions. A message body that already arrives as a
javax.xml.transform.Source (e.g. after convertBodyTo(Source.class)) is
handed straight to Saxon and parsed with the parser defaults, which
accept a DOCTYPE and resolve external entities and DTDs. String, byte[]
and InputStream bodies were unaffected because they already go through
Camel's hardened SAX/StAX converters.
The default Configuration now disallows DOCTYPE declarations and
disables external general/parameter entities and external DTD loading,
matching XmlConverter and camel-xslt-saxon, and mirroring CAMEL-24475
for camel-xpath. A user-supplied Configuration (the configuration
option or XQueryBuilder.setConfiguration) is used as-is.
A Source body carrying a DOCTYPE is now rejected with a parse error;
documented in the 4.23 upgrade guide.
Closes #26344
Co-authored-by: Claude Opus 4.8 <[email protected]>
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
---
.../camel/component/xquery/XQueryBuilder.java | 17 +++-
.../camel/component/xquery/XQueryXxeTest.java | 95 ++++++++++++++++++++++
.../ROOT/pages/camel-4x-upgrade-guide-4_23.adoc | 18 ++++
3 files changed, 128 insertions(+), 2 deletions(-)
diff --git
a/components/camel-saxon/src/main/java/org/apache/camel/component/xquery/XQueryBuilder.java
b/components/camel-saxon/src/main/java/org/apache/camel/component/xquery/XQueryBuilder.java
index c6e0691da4be..c2dc74ad450b 100644
---
a/components/camel-saxon/src/main/java/org/apache/camel/component/xquery/XQueryBuilder.java
+++
b/components/camel-saxon/src/main/java/org/apache/camel/component/xquery/XQueryBuilder.java
@@ -121,8 +121,21 @@ public abstract class XQueryBuilder implements Expression,
Predicate, NamespaceA
LOG.debug("Initializing XQueryBuilder {}", this);
if (configuration == null) {
configuration = new Configuration();
- configuration.setParseOptions(new
ParseOptions().withSpaceStrippingRule(isStripsAllWhiteSpace()
- ? AllElementsSpaceStrippingRule.getInstance() :
IgnorableSpaceStrippingRule.getInstance()));
+ // Harden the default Saxon Configuration against XML external
entity (XXE) processing.
+ // A message body that already arrives as a
javax.xml.transform.Source is handed straight to
+ // Saxon (see getSource and createDynamicContext) and therefore
bypasses the hardened SAX/StAX
+ // type converters that plain String, byte[] and InputStream
bodies go through. Disable DOCTYPE
+ // declarations and external entity/DTD resolution so that
untrusted XML cannot pull in local
+ // files or remote resources. This mirrors the secure defaults
already applied by Camel's
+ // XmlConverter and by camel-xslt-saxon.
+ ParseOptions parseOptions = new ParseOptions()
+ .withSpaceStrippingRule(isStripsAllWhiteSpace()
+ ? AllElementsSpaceStrippingRule.getInstance() :
IgnorableSpaceStrippingRule.getInstance())
+
.withParserFeature("http://apache.org/xml/features/disallow-doctype-decl";, true)
+
.withParserFeature("http://xml.org/sax/features/external-general-entities";,
false)
+
.withParserFeature("http://xml.org/sax/features/external-parameter-entities";,
false)
+
.withParserFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd";,
false);
+ configuration.setParseOptions(parseOptions);
LOG.debug("Created new Configuration {}", configuration);
} else {
LOG.debug("Using existing Configuration {}", configuration);
diff --git
a/components/camel-saxon/src/test/java/org/apache/camel/component/xquery/XQueryXxeTest.java
b/components/camel-saxon/src/test/java/org/apache/camel/component/xquery/XQueryXxeTest.java
new file mode 100644
index 000000000000..1115b3ed2e08
--- /dev/null
+++
b/components/camel-saxon/src/test/java/org/apache/camel/component/xquery/XQueryXxeTest.java
@@ -0,0 +1,95 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.xquery;
+
+import java.io.PrintWriter;
+import java.io.StringWriter;
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import org.apache.camel.Exchange;
+import org.apache.camel.support.DefaultExchange;
+import org.apache.camel.test.junit6.CamelTestSupport;
+import org.apache.camel.util.xml.StringSource;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+
+/**
+ * Verifies that {@link XQueryBuilder} does not resolve XML external entities
when the message body already arrives as a
+ * {@link javax.xml.transform.Source} (which bypasses Camel's hardened
SAX/StAX type converters and is handed straight
+ * to Saxon).
+ */
+public class XQueryXxeTest extends CamelTestSupport {
+
+ private static final String SECRET = "CANARY-XQUERY-XXE-do-not-disclose";
+
+ @TempDir
+ Path tempDir;
+
+ @Override
+ public boolean isUseRouteBuilder() {
+ return false;
+ }
+
+ @Test
+ public void testExternalEntityIsNotResolvedForSourceBody() throws
Exception {
+ Path secret = Files.writeString(tempDir.resolve("secret.txt"), SECRET);
+
+ String payload = "<?xml version=\"1.0\"?>\n"
+ + "<!DOCTYPE data [ <!ENTITY xxe SYSTEM \"" +
secret.toUri() + "\"> ]>\n"
+ + "<order status=\"pending\">&xxe;</order>";
+
+ Exchange exchange = new DefaultExchange(context);
+ // a Source-typed body is returned unchanged by getSource() and parsed
directly by Saxon
+ exchange.getIn().setBody(new StringSource(payload));
+
+ XQueryBuilder xquery = XQueryBuilder.xquery("//order").asString();
+ xquery.init(context);
+
+ String outcome;
+ try {
+ outcome = String.valueOf(xquery.evaluate(exchange));
+ } catch (Exception e) {
+ outcome = stackTraceOf(e);
+ }
+
+ // The hardened Configuration must fail closed on the DOCTYPE (or at
least never resolve the external
+ // entity); either way the contents of the local file must not leak
into the result or the error.
+ assertFalse(outcome.contains(SECRET), "External entity was resolved -
local file content leaked");
+ }
+
+ @Test
+ public void testBenignSourceBodyStillEvaluates() {
+ Exchange exchange = new DefaultExchange(context);
+ exchange.getIn().setBody(new StringSource("<order
status=\"pending\">hello-world</order>"));
+
+ XQueryBuilder xquery = XQueryBuilder.xquery("//order").asString();
+ xquery.init(context);
+
+ String result = xquery.evaluate(exchange, String.class);
+ assertEquals("hello-world", result);
+ }
+
+ private static String stackTraceOf(Throwable t) {
+ StringWriter sw = new StringWriter();
+ t.printStackTrace(new PrintWriter(sw));
+ return sw.toString();
+ }
+}
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc
index cd41d1f7fb46..a225847e2772 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc
@@ -2461,3 +2461,21 @@ it had no effect. The option is kept for backward
compatibility of existing endp
deprecated and will be removed in a future release. Routes that set
`maxRetryTimeout` can simply drop it;
behaviour is unchanged.
+
+=== camel-saxon - external XML entity resolution disabled by default in XQuery
+
+The XQuery language and the `xquery` component now build their default Saxon
`Configuration` with a
+hardened XML parser that does not accept a `DOCTYPE` declaration and does not
resolve external
+general or parameter entities or external DTDs. This aligns XQuery with the
parser configuration
+already applied to the `String`, `byte[]` and `InputStream` body paths through
Camel's
+`XmlConverter`, and with `camel-xslt-saxon` (which already defaults
`secureProcessing` to `true`).
+
+Previously, when a message body reached XQuery as an already-built
`javax.xml.transform.Source` (for
+example after a `convertBodyTo(Source.class)`), it was parsed with the Saxon
parser defaults, which
+resolved external entities. A body carrying a `DOCTYPE` declaration on that
path is now rejected with
+a parse error. Bodies without a `DOCTYPE` are unaffected.
+
+A deployment that genuinely needs to parse documents with a `DOCTYPE` or
external entities can supply
+its own pre-configured Saxon `Configuration` through the `configuration`
option of the `xquery`
+endpoint or language (or `XQueryBuilder.setConfiguration(...)`); a
user-supplied `Configuration` is
+used as-is and is not modified.
