davsclaus commented on code in PR #28160:
URL: https://github.com/apache/camel/pull/28160#discussion_r4376485061
##########
components/camel-xslt-saxon/src/main/java/org/apache/camel/component/xslt/saxon/XsltSaxonHelper.java:
##########
@@ -20,20 +20,55 @@
import java.util.Map;
import javax.xml.XMLConstants;
+import javax.xml.parsers.ParserConfigurationException;
+import javax.xml.parsers.SAXParserFactory;
+import javax.xml.transform.Source;
+import javax.xml.transform.TransformerFactory;
+import javax.xml.transform.sax.SAXSource;
+
+import org.xml.sax.InputSource;
+import org.xml.sax.SAXException;
+import org.xml.sax.XMLReader;
import net.sf.saxon.Configuration;
import net.sf.saxon.TransformerFactoryImpl;
import net.sf.saxon.lib.ExtensionFunctionDefinition;
+import org.apache.camel.RuntimeCamelException;
+import org.apache.camel.converter.jaxp.XMLReaderPool;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
final class XsltSaxonHelper {
private static final Logger LOG =
LoggerFactory.getLogger(XsltSaxonHelper.class);
+ private static final String EXTERNAL_GENERAL_ENTITIES =
"http://xml.org/sax/features/external-general-entities";;
+ private static final String EXTERNAL_PARAMETER_ENTITIES =
"http://xml.org/sax/features/external-parameter-entities";;
+ private static final String LOAD_EXTERNAL_DTD =
"http://apache.org/xml/features/nonvalidating/load-external-dtd";;
+
+ // Configured once: a SAXParserFactory on the classpath that does not
recognise one of the required features fails
+ // here, on the first use of this class, rather than silently degrading on
every exchange. The pool hands out a
+ // reader for a single parse and is safe to share between threads.
+ private static final XMLReaderPool SECURE_XML_READER_POOL = new
XMLReaderPool(createSecureSaxParserFactory());
Review Comment:
Suggestion (non-blocking): if `createSecureSaxParserFactory()` throws here,
the error happens when the whole `XsltSaxonHelper` class is initialised. Every
later use of the class then fails with `NoClassDefFoundError: Could not
initialize class XsltSaxonHelper`. That includes `configureSecureProcessing`
and `configureExternalAccess`, which the endpoint and the strategy call while
they build the factory, so the component fails even for a route that sets
`secureProcessing=false` on purpose to get the old behaviour.
Moving the pool into a lazy holder keeps it fail-closed, but only on the
path that needs it:
```java
private static final class SecureReaderPoolHolder {
static final XMLReaderPool POOL = new
XMLReaderPool(createSecureSaxParserFactory());
}
```
Then use `SecureReaderPoolHolder.POOL.createXMLReader()` in
`secureSource(...)`. With the JDK or Xerces parser this never happens, so this
is defence in depth only.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
