oscerd opened a new pull request, #28095: URL: https://github.com/apache/camel/pull/28095
## Description [CAMEL-25787](https://issues.apache.org/jira/browse/CAMEL-25787) `SmooksProcessor.getSource(Exchange)` handed a message body that is already a Smooks `Source` (`org.smooks.api.io.Source`) to Smooks as it was. Other XML bodies (`String`, `byte[]`, `InputStream`, files) are first parsed by `SmooksSecuritySupport` according to `allowExternalEntities` when the configuration uses the default XML reader, so the option did not apply in the same way to every body type. A configuration with a `<reader>` that declares no `class` behaved the same way. Such a reader only sets handlers, features or parameters of the default XML reader, but `SmooksSecuritySupport.usesDefaultXmlReader(Smooks)` counted any `<reader>` as a reader of its own, so `allowExternalEntities` was not applied to that configuration, in the component or in the data format. On that parsing path, a document with a document type declaration (`<!DOCTYPE ...>`) failed with `Invalid node in DOM content` for every body type, because the DOM reader of Smooks does not accept a document type node. ## Changes - `SmooksProcessor` and `SmooksSecuritySupport`: when the configuration uses the default XML reader and `allowExternalEntities` is `false`: - `StreamSource`/`ByteSource`, `ReaderSource`/`StringSource` and `URLSource` bodies are parsed into a `DOMSource`, like the other bodies. Stream and URL bodies are decoded with the content encoding of the Smooks execution context (the exchange charset, or UTF-8), as Smooks decodes them. A leading byte order mark is skipped, as the Smooks reader does, and a `URLSource` keeps its URL as the system id. - `DOMSource` and `JavaSource` bodies are passed on unchanged. - A body of any other `Source` type is rejected with a `SmooksException` before Smooks is called; the SAX NG filter of Smooks accepts no other type either. With `allowExternalEntities=true` it is passed on as before. - `SmooksSecuritySupport.usesDefaultXmlReader(Smooks)`: a configuration uses the default XML reader unless it declares a reader class. A `<reader>` without a `class` therefore no longer turns the parsing above off. EDI, CSV, JSON, DFDL and custom readers declare a class and are unchanged. - `SmooksSecuritySupport`: the document type node is removed from the parsed document, so a document with a `<!DOCTYPE ...>` is processed instead of failing. The parser has already expanded the entities of its internal subset. This applies to `String`, `byte[]` and `InputStream` bodies as well. - Upgrade guide 4.24: a note for these changes. ## Tests - `SmooksSourceBodyTest`: `StringSource`, `ReaderSource`, `StreamSource`, `ByteSource` and `URLSource` bodies, each with `allowExternalEntities` at its default and set to `true`; an internal entity in a `String` and in a `StringSource` body; a `StreamSource` body with a byte order mark; `DOMSource` and `JavaSource` bodies; a `Source` type that is not supported. - `SmooksReaderConfigTest`: a `<reader>` without a `class`, for the component and for the data format, with the option at its default and set to `true`. - The existing tests keep passing, among them `SmooksProcessorTest#testProcessGivenCamelCharsetNameProperty` (an EBCDIC `StreamSource` with `CamelCharsetName=Cp1047`) and the EDI tests, whose configuration declares its own reader. - With the code under `src/main` as it is on `main`, the `...FollowsAllowExternalEntities` tests, the internal entity test and the rejection test fail. Each part of the change (Source bodies, `<reader>` without a class, document type node, byte order mark) was also reverted on its own, and each time the tests that cover it fail. The backports to `camel-4.22.x` (4.22.3) and `camel-4.18.x` (4.18.6) will follow once this is merged. _Claude Code on behalf of oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
