oscerd commented on PR #28160: URL: https://github.com/apache/camel/pull/28160#issuecomment-6413345907
Thanks David. Rebased onto main (the upgrade-guide conflict is resolved) and pushed `0b732ee`, addressing all four points from your 2026-10-25 review: 1. **(security annotation)** `secureProcessing` is now `security = "insecure:dev", insecureValue = "false"`, `label = "advanced,security"` on the endpoint and component; catalog, DSL and `SecurityUtils` regenerated (xslt-saxon + xj). Kept to the one option; its javadoc and the guide note it now does both. Inline. 2. **(fail closed / configure once)** `XsltSaxonHelper.secureSource` throws instead of degrading, and the `SAXParserFactory` is configured once behind `XMLReaderPool` (the `XmlConverter` pattern) — a rejected feature fails on first use, not every exchange. Inline. 3. **(strategy guide)** Reworded: the strategy has no switch for the parsing (`setTransformerFactory` does not restore it), plus the Saxon PE/EE Java-extension note. Inline. 4. **(test)** Added `XsltSaxonAggregationStrategyIncludeTest` — a classpath `xsl:include` in an aggregation stylesheet still resolves under `ACCESS_EXTERNAL_STYLESHEET=""`. All 25 xslt-saxon unit tests pass locally. _Claude Code on behalf of oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
