This is an automated email from the ASF dual-hosted git repository.
oscerd pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new bdb8d28b9447 CAMEL-25827: camel-xslt-saxon - restrict external
resource access for a Source message body
bdb8d28b9447 is described below
commit bdb8d28b94471fda8fd348514ffa95921bbccbc0
Author: Andrea Cosentino <[email protected]>
AuthorDate: Tue Oct 27 09:47:47 2026 +0100
CAMEL-25827: camel-xslt-saxon - restrict external resource access for a
Source message body
- Configure XsltSaxonAggregationStrategy TransformerFactory with
FEATURE_SECURE_PROCESSING enabled and external access restricted, matching the
endpoint configuration
- Restrict external entity resolution on StreamSource message bodies parsed
with Saxon
- Add secureProcessing option metadata and documentation in upgrade guide
- Lazily initialize XMLReaderPool via holder to fail closed without
blocking class loading
Co-authored-by: Claude Opus 4.8 <[email protected]>
Signed-off-by: Andrea Cosentino <[email protected]>
---
.../org/apache/camel/catalog/components/xj.json | 26 +++---
.../camel/catalog/components/xslt-saxon.json | 26 +++---
.../META-INF/org/apache/camel/component/xj/xj.json | 26 +++---
.../camel/component/xslt/saxon/xslt-saxon.json | 26 +++---
.../saxon/SaxonXmlSourceHandlerFactoryImpl.java | 21 +++++
.../xslt/saxon/XsltSaxonAggregationStrategy.java | 10 ++-
.../component/xslt/saxon/XsltSaxonBuilder.java | 10 +++
.../component/xslt/saxon/XsltSaxonComponent.java | 6 +-
.../component/xslt/saxon/XsltSaxonEndpoint.java | 18 ++--
.../component/xslt/saxon/XsltSaxonHelper.java | 89 ++++++++++++++++++++
.../XsltSaxonAggregationStrategyIncludeTest.java | 65 +++++++++++++++
...XsltSaxonAggregationStrategySourceBodyTest.java | 96 ++++++++++++++++++++++
.../xslt/saxon/XsltSaxonDomSourceTest.java | 34 +++++++-
.../saxon/XsltSaxonHelperConfigurationTest.java | 75 +++++++++++++++++
.../component/xslt/saxon/aggregate-included.xsl | 28 +++++++
.../xslt/saxon/aggregate-with-include.xsl | 38 +++++++++
.../java/org/apache/camel/util/SecurityUtils.java | 4 +
.../ROOT/pages/camel-4x-upgrade-guide-4_24.adoc | 24 ++++++
.../component/dsl/XjComponentBuilderFactory.java | 44 +++++-----
.../dsl/XsltSaxonComponentBuilderFactory.java | 44 +++++-----
.../endpoint/dsl/XJEndpointBuilderFactory.java | 76 +++++++++--------
.../dsl/XsltSaxonEndpointBuilderFactory.java | 76 +++++++++--------
22 files changed, 679 insertions(+), 183 deletions(-)
diff --git
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/xj.json
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/xj.json
index 0a57d2901364..0ff9220c9932 100644
---
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/xj.json
+++
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/xj.json
@@ -31,12 +31,12 @@
"saxonConfiguration": { "index": 4, "kind": "property", "displayName":
"Saxon Configuration", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType": "net.sf.saxon.Configuration",
"deprecated": false, "autowired": false, "secret": false, "description": "To
use a custom Saxon configuration" },
"saxonConfigurationProperties": { "index": 5, "kind": "property",
"displayName": "Saxon Configuration Properties", "group": "advanced", "label":
"advanced", "required": false, "type": "object", "javaType":
"java.util.Map<java.lang.String, java.lang.Object>", "deprecated": false,
"autowired": false, "secret": false, "description": "To set custom Saxon
configuration properties" },
"saxonExtensionFunctions": { "index": 6, "kind": "property",
"displayName": "Saxon Extension Functions", "group": "advanced", "label":
"advanced", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"description": "Allows you to use a custom
net.sf.saxon.lib.ExtensionFunctionDefinition. You would need to add camel-saxon
to the classpath. The function is looked up in the registry, where you can use
commas to se [...]
- "secureProcessing": { "index": 7, "kind": "property", "displayName":
"Secure Processing", "group": "advanced", "label": "advanced", "required":
false, "type": "boolean", "javaType": "boolean", "deprecated": false,
"autowired": false, "secret": false, "defaultValue": true, "description":
"Feature for XML secure processing (see javax.xml.XMLConstants). This is
enabled by default. However, when using Saxon Professional you may need to turn
this off to allow Saxon to be able to use Java [...]
- "transformerFactoryClass": { "index": 8, "kind": "property",
"displayName": "Transformer Factory Class", "group": "advanced", "label":
"advanced", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"description": "To use a custom XSLT transformer factory, specified as a FQN
class name" },
- "transformerFactoryConfigurationStrategy": { "index": 9, "kind":
"property", "displayName": "Transformer Factory Configuration Strategy",
"group": "advanced", "label": "advanced", "required": false, "type": "object",
"javaType":
"org.apache.camel.component.xslt.TransformerFactoryConfigurationStrategy",
"deprecated": false, "autowired": false, "secret": false, "description": "A
configuration strategy to apply on freshly created instances of
TransformerFactory." },
- "uriResolver": { "index": 10, "kind": "property", "displayName": "Uri
Resolver", "group": "advanced", "label": "advanced", "required": false, "type":
"object", "javaType": "javax.xml.transform.URIResolver", "deprecated": false,
"autowired": false, "secret": false, "description": "To use a custom
UriResolver. Should not be used together with the option 'uriResolverFactory'."
},
- "uriResolverFactory": { "index": 11, "kind": "property", "displayName":
"Uri Resolver Factory", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType":
"org.apache.camel.component.xslt.XsltUriResolverFactory", "deprecated": false,
"autowired": false, "secret": false, "description": "To use a custom
UriResolver which depends on a dynamic endpoint resource URI. Should not be
used together with the option 'uriResolver'." },
- "xpathTotalOpLimit": { "index": 12, "kind": "property", "displayName":
"Xpath Total Op Limit", "group": "advanced", "label": "advanced", "required":
false, "type": "integer", "javaType": "int", "deprecated": false, "autowired":
false, "secret": false, "defaultValue": 10000, "description": "Limits the total
number of XPath operators in an XSL Stylesheet. The default (from JDK) is
10000. The limit is set per TransformerFactory instance used by each endpoint,
not as a JVM-global system [...]
+ "transformerFactoryClass": { "index": 7, "kind": "property",
"displayName": "Transformer Factory Class", "group": "advanced", "label":
"advanced", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"description": "To use a custom XSLT transformer factory, specified as a FQN
class name" },
+ "transformerFactoryConfigurationStrategy": { "index": 8, "kind":
"property", "displayName": "Transformer Factory Configuration Strategy",
"group": "advanced", "label": "advanced", "required": false, "type": "object",
"javaType":
"org.apache.camel.component.xslt.TransformerFactoryConfigurationStrategy",
"deprecated": false, "autowired": false, "secret": false, "description": "A
configuration strategy to apply on freshly created instances of
TransformerFactory." },
+ "uriResolver": { "index": 9, "kind": "property", "displayName": "Uri
Resolver", "group": "advanced", "label": "advanced", "required": false, "type":
"object", "javaType": "javax.xml.transform.URIResolver", "deprecated": false,
"autowired": false, "secret": false, "description": "To use a custom
UriResolver. Should not be used together with the option 'uriResolverFactory'."
},
+ "uriResolverFactory": { "index": 10, "kind": "property", "displayName":
"Uri Resolver Factory", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType":
"org.apache.camel.component.xslt.XsltUriResolverFactory", "deprecated": false,
"autowired": false, "secret": false, "description": "To use a custom
UriResolver which depends on a dynamic endpoint resource URI. Should not be
used together with the option 'uriResolver'." },
+ "xpathTotalOpLimit": { "index": 11, "kind": "property", "displayName":
"Xpath Total Op Limit", "group": "advanced", "label": "advanced", "required":
false, "type": "integer", "javaType": "int", "deprecated": false, "autowired":
false, "secret": false, "defaultValue": 10000, "description": "Limits the total
number of XPath operators in an XSL Stylesheet. The default (from JDK) is
10000. The limit is set per TransformerFactory instance used by each endpoint,
not as a JVM-global system [...]
+ "secureProcessing": { "index": 12, "kind": "property", "displayName":
"Secure Processing", "group": "security", "label": "advanced,security",
"required": false, "type": "boolean", "javaType": "boolean", "deprecated":
false, "autowired": false, "secret": false, "security": "insecure:dev",
"insecureValue": "false", "defaultValue": true, "description": "Feature for XML
secure processing (see javax.xml.XMLConstants). This is enabled by default.
However, when using Saxon Professional you [...]
},
"headers": {
"CamelXsltFileName": { "index": 0, "kind": "header", "displayName": "",
"group": "producer", "label": "", "required": false, "javaType": "String",
"deprecated": false, "deprecationNote": "", "autowired": false, "secret":
false, "description": "The XSLT file name", "constantName":
"org.apache.camel.component.xj.XJConstants#XSLT_FILE_NAME" },
@@ -65,12 +65,12 @@
"resultHandlerFactory": { "index": 14, "kind": "parameter", "displayName":
"Result Handler Factory", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType":
"org.apache.camel.component.xslt.ResultHandlerFactory", "deprecated": false,
"autowired": false, "secret": false, "description": "Allows you to use a custom
org.apache.camel.builder.xml.ResultHandlerFactory which is capable of using
custom org.apache.camel.builder.xml.ResultHandler types." },
"saxonConfiguration": { "index": 15, "kind": "parameter", "displayName":
"Saxon Configuration", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType": "net.sf.saxon.Configuration",
"deprecated": false, "autowired": false, "secret": false, "description": "To
use a custom Saxon configuration" },
"saxonExtensionFunctions": { "index": 16, "kind": "parameter",
"displayName": "Saxon Extension Functions", "group": "advanced", "label":
"advanced", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"description": "Allows you to use a custom
net.sf.saxon.lib.ExtensionFunctionDefinition. You would need to add camel-saxon
to the classpath. The function is looked up in the registry, where you can
comma to separ [...]
- "secureProcessing": { "index": 17, "kind": "parameter", "displayName":
"Secure Processing", "group": "advanced", "label": "advanced", "required":
false, "type": "boolean", "javaType": "boolean", "deprecated": false,
"autowired": false, "secret": false, "defaultValue": true, "description":
"Feature for XML secure processing (see javax.xml.XMLConstants). This is
enabled by default. However, when using Saxon Professional you may need to turn
this off to allow Saxon to be able to use Jav [...]
- "transformerFactory": { "index": 18, "kind": "parameter", "displayName":
"Transformer Factory", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType": "javax.xml.transform.TransformerFactory",
"deprecated": false, "autowired": false, "secret": false, "description": "To
use a custom XSLT transformer factory" },
- "transformerFactoryClass": { "index": 19, "kind": "parameter",
"displayName": "Transformer Factory Class", "group": "advanced", "label":
"advanced", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"description": "To use a custom XSLT transformer factory, specified as a FQN
class name" },
- "transformerFactoryConfigurationStrategy": { "index": 20, "kind":
"parameter", "displayName": "Transformer Factory Configuration Strategy",
"group": "advanced", "label": "advanced", "required": false, "type": "object",
"javaType":
"org.apache.camel.component.xslt.TransformerFactoryConfigurationStrategy",
"deprecated": false, "autowired": false, "secret": false, "description": "A
configuration strategy to apply on freshly created instances of
TransformerFactory." },
- "uriResolver": { "index": 21, "kind": "parameter", "displayName": "Uri
Resolver", "group": "advanced", "label": "advanced", "required": false, "type":
"object", "javaType": "javax.xml.transform.URIResolver", "deprecated": false,
"autowired": false, "secret": false, "description": "To use a custom
javax.xml.transform.URIResolver" },
- "xpathTotalOpLimit": { "index": 22, "kind": "parameter", "displayName":
"Xpath Total Op Limit", "group": "advanced", "label": "advanced", "required":
false, "type": "integer", "javaType": "int", "deprecated": false, "autowired":
false, "secret": false, "defaultValue": 10000, "description": "Limits the total
number of XPath operators in an XSL Stylesheet. The default (from JDK) is
10000. The limit is set per TransformerFactory instance used by this endpoint."
},
- "xsltMessageLogger": { "index": 23, "kind": "parameter", "displayName":
"Xslt Message Logger", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType":
"org.apache.camel.component.xslt.XsltMessageLogger", "deprecated": false,
"autowired": false, "secret": false, "description": "A consumer to messages
generated during XSLT transformations." }
+ "transformerFactory": { "index": 17, "kind": "parameter", "displayName":
"Transformer Factory", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType": "javax.xml.transform.TransformerFactory",
"deprecated": false, "autowired": false, "secret": false, "description": "To
use a custom XSLT transformer factory" },
+ "transformerFactoryClass": { "index": 18, "kind": "parameter",
"displayName": "Transformer Factory Class", "group": "advanced", "label":
"advanced", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"description": "To use a custom XSLT transformer factory, specified as a FQN
class name" },
+ "transformerFactoryConfigurationStrategy": { "index": 19, "kind":
"parameter", "displayName": "Transformer Factory Configuration Strategy",
"group": "advanced", "label": "advanced", "required": false, "type": "object",
"javaType":
"org.apache.camel.component.xslt.TransformerFactoryConfigurationStrategy",
"deprecated": false, "autowired": false, "secret": false, "description": "A
configuration strategy to apply on freshly created instances of
TransformerFactory." },
+ "uriResolver": { "index": 20, "kind": "parameter", "displayName": "Uri
Resolver", "group": "advanced", "label": "advanced", "required": false, "type":
"object", "javaType": "javax.xml.transform.URIResolver", "deprecated": false,
"autowired": false, "secret": false, "description": "To use a custom
javax.xml.transform.URIResolver" },
+ "xpathTotalOpLimit": { "index": 21, "kind": "parameter", "displayName":
"Xpath Total Op Limit", "group": "advanced", "label": "advanced", "required":
false, "type": "integer", "javaType": "int", "deprecated": false, "autowired":
false, "secret": false, "defaultValue": 10000, "description": "Limits the total
number of XPath operators in an XSL Stylesheet. The default (from JDK) is
10000. The limit is set per TransformerFactory instance used by this endpoint."
},
+ "xsltMessageLogger": { "index": 22, "kind": "parameter", "displayName":
"Xslt Message Logger", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType":
"org.apache.camel.component.xslt.XsltMessageLogger", "deprecated": false,
"autowired": false, "secret": false, "description": "A consumer to messages
generated during XSLT transformations." },
+ "secureProcessing": { "index": 23, "kind": "parameter", "displayName":
"Secure Processing", "group": "security", "label": "advanced,security",
"required": false, "type": "boolean", "javaType": "boolean", "deprecated":
false, "autowired": false, "secret": false, "security": "insecure:dev",
"insecureValue": "false", "defaultValue": true, "description": "Feature for XML
secure processing (see javax.xml.XMLConstants). This is enabled by default.
However, when using Saxon Professional you [...]
}
}
diff --git
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/xslt-saxon.json
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/xslt-saxon.json
index 28cd2c8d0599..72a4431ca839 100644
---
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/xslt-saxon.json
+++
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/xslt-saxon.json
@@ -31,12 +31,12 @@
"saxonConfiguration": { "index": 4, "kind": "property", "displayName":
"Saxon Configuration", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType": "net.sf.saxon.Configuration",
"deprecated": false, "autowired": false, "secret": false, "description": "To
use a custom Saxon configuration" },
"saxonConfigurationProperties": { "index": 5, "kind": "property",
"displayName": "Saxon Configuration Properties", "group": "advanced", "label":
"advanced", "required": false, "type": "object", "javaType":
"java.util.Map<java.lang.String, java.lang.Object>", "deprecated": false,
"autowired": false, "secret": false, "description": "To set custom Saxon
configuration properties" },
"saxonExtensionFunctions": { "index": 6, "kind": "property",
"displayName": "Saxon Extension Functions", "group": "advanced", "label":
"advanced", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"description": "Allows you to use a custom
net.sf.saxon.lib.ExtensionFunctionDefinition. You would need to add camel-saxon
to the classpath. The function is looked up in the registry, where you can use
commas to se [...]
- "secureProcessing": { "index": 7, "kind": "property", "displayName":
"Secure Processing", "group": "advanced", "label": "advanced", "required":
false, "type": "boolean", "javaType": "boolean", "deprecated": false,
"autowired": false, "secret": false, "defaultValue": true, "description":
"Feature for XML secure processing (see javax.xml.XMLConstants). This is
enabled by default. However, when using Saxon Professional you may need to turn
this off to allow Saxon to be able to use Java [...]
- "transformerFactoryClass": { "index": 8, "kind": "property",
"displayName": "Transformer Factory Class", "group": "advanced", "label":
"advanced", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"description": "To use a custom XSLT transformer factory, specified as a FQN
class name" },
- "transformerFactoryConfigurationStrategy": { "index": 9, "kind":
"property", "displayName": "Transformer Factory Configuration Strategy",
"group": "advanced", "label": "advanced", "required": false, "type": "object",
"javaType":
"org.apache.camel.component.xslt.TransformerFactoryConfigurationStrategy",
"deprecated": false, "autowired": false, "secret": false, "description": "A
configuration strategy to apply on freshly created instances of
TransformerFactory." },
- "uriResolver": { "index": 10, "kind": "property", "displayName": "Uri
Resolver", "group": "advanced", "label": "advanced", "required": false, "type":
"object", "javaType": "javax.xml.transform.URIResolver", "deprecated": false,
"autowired": false, "secret": false, "description": "To use a custom
UriResolver. Should not be used together with the option 'uriResolverFactory'."
},
- "uriResolverFactory": { "index": 11, "kind": "property", "displayName":
"Uri Resolver Factory", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType":
"org.apache.camel.component.xslt.XsltUriResolverFactory", "deprecated": false,
"autowired": false, "secret": false, "description": "To use a custom
UriResolver which depends on a dynamic endpoint resource URI. Should not be
used together with the option 'uriResolver'." },
- "xpathTotalOpLimit": { "index": 12, "kind": "property", "displayName":
"Xpath Total Op Limit", "group": "advanced", "label": "advanced", "required":
false, "type": "integer", "javaType": "int", "deprecated": false, "autowired":
false, "secret": false, "defaultValue": 10000, "description": "Limits the total
number of XPath operators in an XSL Stylesheet. The default (from JDK) is
10000. The limit is set per TransformerFactory instance used by each endpoint,
not as a JVM-global system [...]
+ "transformerFactoryClass": { "index": 7, "kind": "property",
"displayName": "Transformer Factory Class", "group": "advanced", "label":
"advanced", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"description": "To use a custom XSLT transformer factory, specified as a FQN
class name" },
+ "transformerFactoryConfigurationStrategy": { "index": 8, "kind":
"property", "displayName": "Transformer Factory Configuration Strategy",
"group": "advanced", "label": "advanced", "required": false, "type": "object",
"javaType":
"org.apache.camel.component.xslt.TransformerFactoryConfigurationStrategy",
"deprecated": false, "autowired": false, "secret": false, "description": "A
configuration strategy to apply on freshly created instances of
TransformerFactory." },
+ "uriResolver": { "index": 9, "kind": "property", "displayName": "Uri
Resolver", "group": "advanced", "label": "advanced", "required": false, "type":
"object", "javaType": "javax.xml.transform.URIResolver", "deprecated": false,
"autowired": false, "secret": false, "description": "To use a custom
UriResolver. Should not be used together with the option 'uriResolverFactory'."
},
+ "uriResolverFactory": { "index": 10, "kind": "property", "displayName":
"Uri Resolver Factory", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType":
"org.apache.camel.component.xslt.XsltUriResolverFactory", "deprecated": false,
"autowired": false, "secret": false, "description": "To use a custom
UriResolver which depends on a dynamic endpoint resource URI. Should not be
used together with the option 'uriResolver'." },
+ "xpathTotalOpLimit": { "index": 11, "kind": "property", "displayName":
"Xpath Total Op Limit", "group": "advanced", "label": "advanced", "required":
false, "type": "integer", "javaType": "int", "deprecated": false, "autowired":
false, "secret": false, "defaultValue": 10000, "description": "Limits the total
number of XPath operators in an XSL Stylesheet. The default (from JDK) is
10000. The limit is set per TransformerFactory instance used by each endpoint,
not as a JVM-global system [...]
+ "secureProcessing": { "index": 12, "kind": "property", "displayName":
"Secure Processing", "group": "security", "label": "advanced,security",
"required": false, "type": "boolean", "javaType": "boolean", "deprecated":
false, "autowired": false, "secret": false, "security": "insecure:dev",
"insecureValue": "false", "defaultValue": true, "description": "Feature for XML
secure processing (see javax.xml.XMLConstants). This is enabled by default.
However, when using Saxon Professional you [...]
},
"headers": {
"CamelXsltResourceUri": { "index": 0, "kind": "header", "displayName": "",
"group": "producer", "label": "", "required": false, "javaType": "String",
"deprecated": false, "deprecationNote": "", "autowired": false, "secret":
false, "description": "A URI for the template resource to load and use instead
of the endpoint configured.", "constantName":
"org.apache.camel.component.xslt.XsltConstants#XSLT_RESOURCE_URI" },
@@ -64,12 +64,12 @@
"resultHandlerFactory": { "index": 13, "kind": "parameter", "displayName":
"Result Handler Factory", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType":
"org.apache.camel.component.xslt.ResultHandlerFactory", "deprecated": false,
"autowired": false, "secret": false, "description": "Allows you to use a custom
org.apache.camel.builder.xml.ResultHandlerFactory which is capable of using
custom org.apache.camel.builder.xml.ResultHandler types." },
"saxonConfiguration": { "index": 14, "kind": "parameter", "displayName":
"Saxon Configuration", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType": "net.sf.saxon.Configuration",
"deprecated": false, "autowired": false, "secret": false, "description": "To
use a custom Saxon configuration" },
"saxonExtensionFunctions": { "index": 15, "kind": "parameter",
"displayName": "Saxon Extension Functions", "group": "advanced", "label":
"advanced", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"description": "Allows you to use a custom
net.sf.saxon.lib.ExtensionFunctionDefinition. You would need to add camel-saxon
to the classpath. The function is looked up in the registry, where you can
comma to separ [...]
- "secureProcessing": { "index": 16, "kind": "parameter", "displayName":
"Secure Processing", "group": "advanced", "label": "advanced", "required":
false, "type": "boolean", "javaType": "boolean", "deprecated": false,
"autowired": false, "secret": false, "defaultValue": true, "description":
"Feature for XML secure processing (see javax.xml.XMLConstants). This is
enabled by default. However, when using Saxon Professional you may need to turn
this off to allow Saxon to be able to use Jav [...]
- "transformerFactory": { "index": 17, "kind": "parameter", "displayName":
"Transformer Factory", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType": "javax.xml.transform.TransformerFactory",
"deprecated": false, "autowired": false, "secret": false, "description": "To
use a custom XSLT transformer factory" },
- "transformerFactoryClass": { "index": 18, "kind": "parameter",
"displayName": "Transformer Factory Class", "group": "advanced", "label":
"advanced", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"description": "To use a custom XSLT transformer factory, specified as a FQN
class name" },
- "transformerFactoryConfigurationStrategy": { "index": 19, "kind":
"parameter", "displayName": "Transformer Factory Configuration Strategy",
"group": "advanced", "label": "advanced", "required": false, "type": "object",
"javaType":
"org.apache.camel.component.xslt.TransformerFactoryConfigurationStrategy",
"deprecated": false, "autowired": false, "secret": false, "description": "A
configuration strategy to apply on freshly created instances of
TransformerFactory." },
- "uriResolver": { "index": 20, "kind": "parameter", "displayName": "Uri
Resolver", "group": "advanced", "label": "advanced", "required": false, "type":
"object", "javaType": "javax.xml.transform.URIResolver", "deprecated": false,
"autowired": false, "secret": false, "description": "To use a custom
javax.xml.transform.URIResolver" },
- "xpathTotalOpLimit": { "index": 21, "kind": "parameter", "displayName":
"Xpath Total Op Limit", "group": "advanced", "label": "advanced", "required":
false, "type": "integer", "javaType": "int", "deprecated": false, "autowired":
false, "secret": false, "defaultValue": 10000, "description": "Limits the total
number of XPath operators in an XSL Stylesheet. The default (from JDK) is
10000. The limit is set per TransformerFactory instance used by this endpoint."
},
- "xsltMessageLogger": { "index": 22, "kind": "parameter", "displayName":
"Xslt Message Logger", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType":
"org.apache.camel.component.xslt.XsltMessageLogger", "deprecated": false,
"autowired": false, "secret": false, "description": "A consumer to messages
generated during XSLT transformations." }
+ "transformerFactory": { "index": 16, "kind": "parameter", "displayName":
"Transformer Factory", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType": "javax.xml.transform.TransformerFactory",
"deprecated": false, "autowired": false, "secret": false, "description": "To
use a custom XSLT transformer factory" },
+ "transformerFactoryClass": { "index": 17, "kind": "parameter",
"displayName": "Transformer Factory Class", "group": "advanced", "label":
"advanced", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"description": "To use a custom XSLT transformer factory, specified as a FQN
class name" },
+ "transformerFactoryConfigurationStrategy": { "index": 18, "kind":
"parameter", "displayName": "Transformer Factory Configuration Strategy",
"group": "advanced", "label": "advanced", "required": false, "type": "object",
"javaType":
"org.apache.camel.component.xslt.TransformerFactoryConfigurationStrategy",
"deprecated": false, "autowired": false, "secret": false, "description": "A
configuration strategy to apply on freshly created instances of
TransformerFactory." },
+ "uriResolver": { "index": 19, "kind": "parameter", "displayName": "Uri
Resolver", "group": "advanced", "label": "advanced", "required": false, "type":
"object", "javaType": "javax.xml.transform.URIResolver", "deprecated": false,
"autowired": false, "secret": false, "description": "To use a custom
javax.xml.transform.URIResolver" },
+ "xpathTotalOpLimit": { "index": 20, "kind": "parameter", "displayName":
"Xpath Total Op Limit", "group": "advanced", "label": "advanced", "required":
false, "type": "integer", "javaType": "int", "deprecated": false, "autowired":
false, "secret": false, "defaultValue": 10000, "description": "Limits the total
number of XPath operators in an XSL Stylesheet. The default (from JDK) is
10000. The limit is set per TransformerFactory instance used by this endpoint."
},
+ "xsltMessageLogger": { "index": 21, "kind": "parameter", "displayName":
"Xslt Message Logger", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType":
"org.apache.camel.component.xslt.XsltMessageLogger", "deprecated": false,
"autowired": false, "secret": false, "description": "A consumer to messages
generated during XSLT transformations." },
+ "secureProcessing": { "index": 22, "kind": "parameter", "displayName":
"Secure Processing", "group": "security", "label": "advanced,security",
"required": false, "type": "boolean", "javaType": "boolean", "deprecated":
false, "autowired": false, "secret": false, "security": "insecure:dev",
"insecureValue": "false", "defaultValue": true, "description": "Feature for XML
secure processing (see javax.xml.XMLConstants). This is enabled by default.
However, when using Saxon Professional you [...]
}
}
diff --git
a/components/camel-xj/src/generated/resources/META-INF/org/apache/camel/component/xj/xj.json
b/components/camel-xj/src/generated/resources/META-INF/org/apache/camel/component/xj/xj.json
index 0a57d2901364..0ff9220c9932 100644
---
a/components/camel-xj/src/generated/resources/META-INF/org/apache/camel/component/xj/xj.json
+++
b/components/camel-xj/src/generated/resources/META-INF/org/apache/camel/component/xj/xj.json
@@ -31,12 +31,12 @@
"saxonConfiguration": { "index": 4, "kind": "property", "displayName":
"Saxon Configuration", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType": "net.sf.saxon.Configuration",
"deprecated": false, "autowired": false, "secret": false, "description": "To
use a custom Saxon configuration" },
"saxonConfigurationProperties": { "index": 5, "kind": "property",
"displayName": "Saxon Configuration Properties", "group": "advanced", "label":
"advanced", "required": false, "type": "object", "javaType":
"java.util.Map<java.lang.String, java.lang.Object>", "deprecated": false,
"autowired": false, "secret": false, "description": "To set custom Saxon
configuration properties" },
"saxonExtensionFunctions": { "index": 6, "kind": "property",
"displayName": "Saxon Extension Functions", "group": "advanced", "label":
"advanced", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"description": "Allows you to use a custom
net.sf.saxon.lib.ExtensionFunctionDefinition. You would need to add camel-saxon
to the classpath. The function is looked up in the registry, where you can use
commas to se [...]
- "secureProcessing": { "index": 7, "kind": "property", "displayName":
"Secure Processing", "group": "advanced", "label": "advanced", "required":
false, "type": "boolean", "javaType": "boolean", "deprecated": false,
"autowired": false, "secret": false, "defaultValue": true, "description":
"Feature for XML secure processing (see javax.xml.XMLConstants). This is
enabled by default. However, when using Saxon Professional you may need to turn
this off to allow Saxon to be able to use Java [...]
- "transformerFactoryClass": { "index": 8, "kind": "property",
"displayName": "Transformer Factory Class", "group": "advanced", "label":
"advanced", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"description": "To use a custom XSLT transformer factory, specified as a FQN
class name" },
- "transformerFactoryConfigurationStrategy": { "index": 9, "kind":
"property", "displayName": "Transformer Factory Configuration Strategy",
"group": "advanced", "label": "advanced", "required": false, "type": "object",
"javaType":
"org.apache.camel.component.xslt.TransformerFactoryConfigurationStrategy",
"deprecated": false, "autowired": false, "secret": false, "description": "A
configuration strategy to apply on freshly created instances of
TransformerFactory." },
- "uriResolver": { "index": 10, "kind": "property", "displayName": "Uri
Resolver", "group": "advanced", "label": "advanced", "required": false, "type":
"object", "javaType": "javax.xml.transform.URIResolver", "deprecated": false,
"autowired": false, "secret": false, "description": "To use a custom
UriResolver. Should not be used together with the option 'uriResolverFactory'."
},
- "uriResolverFactory": { "index": 11, "kind": "property", "displayName":
"Uri Resolver Factory", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType":
"org.apache.camel.component.xslt.XsltUriResolverFactory", "deprecated": false,
"autowired": false, "secret": false, "description": "To use a custom
UriResolver which depends on a dynamic endpoint resource URI. Should not be
used together with the option 'uriResolver'." },
- "xpathTotalOpLimit": { "index": 12, "kind": "property", "displayName":
"Xpath Total Op Limit", "group": "advanced", "label": "advanced", "required":
false, "type": "integer", "javaType": "int", "deprecated": false, "autowired":
false, "secret": false, "defaultValue": 10000, "description": "Limits the total
number of XPath operators in an XSL Stylesheet. The default (from JDK) is
10000. The limit is set per TransformerFactory instance used by each endpoint,
not as a JVM-global system [...]
+ "transformerFactoryClass": { "index": 7, "kind": "property",
"displayName": "Transformer Factory Class", "group": "advanced", "label":
"advanced", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"description": "To use a custom XSLT transformer factory, specified as a FQN
class name" },
+ "transformerFactoryConfigurationStrategy": { "index": 8, "kind":
"property", "displayName": "Transformer Factory Configuration Strategy",
"group": "advanced", "label": "advanced", "required": false, "type": "object",
"javaType":
"org.apache.camel.component.xslt.TransformerFactoryConfigurationStrategy",
"deprecated": false, "autowired": false, "secret": false, "description": "A
configuration strategy to apply on freshly created instances of
TransformerFactory." },
+ "uriResolver": { "index": 9, "kind": "property", "displayName": "Uri
Resolver", "group": "advanced", "label": "advanced", "required": false, "type":
"object", "javaType": "javax.xml.transform.URIResolver", "deprecated": false,
"autowired": false, "secret": false, "description": "To use a custom
UriResolver. Should not be used together with the option 'uriResolverFactory'."
},
+ "uriResolverFactory": { "index": 10, "kind": "property", "displayName":
"Uri Resolver Factory", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType":
"org.apache.camel.component.xslt.XsltUriResolverFactory", "deprecated": false,
"autowired": false, "secret": false, "description": "To use a custom
UriResolver which depends on a dynamic endpoint resource URI. Should not be
used together with the option 'uriResolver'." },
+ "xpathTotalOpLimit": { "index": 11, "kind": "property", "displayName":
"Xpath Total Op Limit", "group": "advanced", "label": "advanced", "required":
false, "type": "integer", "javaType": "int", "deprecated": false, "autowired":
false, "secret": false, "defaultValue": 10000, "description": "Limits the total
number of XPath operators in an XSL Stylesheet. The default (from JDK) is
10000. The limit is set per TransformerFactory instance used by each endpoint,
not as a JVM-global system [...]
+ "secureProcessing": { "index": 12, "kind": "property", "displayName":
"Secure Processing", "group": "security", "label": "advanced,security",
"required": false, "type": "boolean", "javaType": "boolean", "deprecated":
false, "autowired": false, "secret": false, "security": "insecure:dev",
"insecureValue": "false", "defaultValue": true, "description": "Feature for XML
secure processing (see javax.xml.XMLConstants). This is enabled by default.
However, when using Saxon Professional you [...]
},
"headers": {
"CamelXsltFileName": { "index": 0, "kind": "header", "displayName": "",
"group": "producer", "label": "", "required": false, "javaType": "String",
"deprecated": false, "deprecationNote": "", "autowired": false, "secret":
false, "description": "The XSLT file name", "constantName":
"org.apache.camel.component.xj.XJConstants#XSLT_FILE_NAME" },
@@ -65,12 +65,12 @@
"resultHandlerFactory": { "index": 14, "kind": "parameter", "displayName":
"Result Handler Factory", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType":
"org.apache.camel.component.xslt.ResultHandlerFactory", "deprecated": false,
"autowired": false, "secret": false, "description": "Allows you to use a custom
org.apache.camel.builder.xml.ResultHandlerFactory which is capable of using
custom org.apache.camel.builder.xml.ResultHandler types." },
"saxonConfiguration": { "index": 15, "kind": "parameter", "displayName":
"Saxon Configuration", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType": "net.sf.saxon.Configuration",
"deprecated": false, "autowired": false, "secret": false, "description": "To
use a custom Saxon configuration" },
"saxonExtensionFunctions": { "index": 16, "kind": "parameter",
"displayName": "Saxon Extension Functions", "group": "advanced", "label":
"advanced", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"description": "Allows you to use a custom
net.sf.saxon.lib.ExtensionFunctionDefinition. You would need to add camel-saxon
to the classpath. The function is looked up in the registry, where you can
comma to separ [...]
- "secureProcessing": { "index": 17, "kind": "parameter", "displayName":
"Secure Processing", "group": "advanced", "label": "advanced", "required":
false, "type": "boolean", "javaType": "boolean", "deprecated": false,
"autowired": false, "secret": false, "defaultValue": true, "description":
"Feature for XML secure processing (see javax.xml.XMLConstants). This is
enabled by default. However, when using Saxon Professional you may need to turn
this off to allow Saxon to be able to use Jav [...]
- "transformerFactory": { "index": 18, "kind": "parameter", "displayName":
"Transformer Factory", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType": "javax.xml.transform.TransformerFactory",
"deprecated": false, "autowired": false, "secret": false, "description": "To
use a custom XSLT transformer factory" },
- "transformerFactoryClass": { "index": 19, "kind": "parameter",
"displayName": "Transformer Factory Class", "group": "advanced", "label":
"advanced", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"description": "To use a custom XSLT transformer factory, specified as a FQN
class name" },
- "transformerFactoryConfigurationStrategy": { "index": 20, "kind":
"parameter", "displayName": "Transformer Factory Configuration Strategy",
"group": "advanced", "label": "advanced", "required": false, "type": "object",
"javaType":
"org.apache.camel.component.xslt.TransformerFactoryConfigurationStrategy",
"deprecated": false, "autowired": false, "secret": false, "description": "A
configuration strategy to apply on freshly created instances of
TransformerFactory." },
- "uriResolver": { "index": 21, "kind": "parameter", "displayName": "Uri
Resolver", "group": "advanced", "label": "advanced", "required": false, "type":
"object", "javaType": "javax.xml.transform.URIResolver", "deprecated": false,
"autowired": false, "secret": false, "description": "To use a custom
javax.xml.transform.URIResolver" },
- "xpathTotalOpLimit": { "index": 22, "kind": "parameter", "displayName":
"Xpath Total Op Limit", "group": "advanced", "label": "advanced", "required":
false, "type": "integer", "javaType": "int", "deprecated": false, "autowired":
false, "secret": false, "defaultValue": 10000, "description": "Limits the total
number of XPath operators in an XSL Stylesheet. The default (from JDK) is
10000. The limit is set per TransformerFactory instance used by this endpoint."
},
- "xsltMessageLogger": { "index": 23, "kind": "parameter", "displayName":
"Xslt Message Logger", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType":
"org.apache.camel.component.xslt.XsltMessageLogger", "deprecated": false,
"autowired": false, "secret": false, "description": "A consumer to messages
generated during XSLT transformations." }
+ "transformerFactory": { "index": 17, "kind": "parameter", "displayName":
"Transformer Factory", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType": "javax.xml.transform.TransformerFactory",
"deprecated": false, "autowired": false, "secret": false, "description": "To
use a custom XSLT transformer factory" },
+ "transformerFactoryClass": { "index": 18, "kind": "parameter",
"displayName": "Transformer Factory Class", "group": "advanced", "label":
"advanced", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"description": "To use a custom XSLT transformer factory, specified as a FQN
class name" },
+ "transformerFactoryConfigurationStrategy": { "index": 19, "kind":
"parameter", "displayName": "Transformer Factory Configuration Strategy",
"group": "advanced", "label": "advanced", "required": false, "type": "object",
"javaType":
"org.apache.camel.component.xslt.TransformerFactoryConfigurationStrategy",
"deprecated": false, "autowired": false, "secret": false, "description": "A
configuration strategy to apply on freshly created instances of
TransformerFactory." },
+ "uriResolver": { "index": 20, "kind": "parameter", "displayName": "Uri
Resolver", "group": "advanced", "label": "advanced", "required": false, "type":
"object", "javaType": "javax.xml.transform.URIResolver", "deprecated": false,
"autowired": false, "secret": false, "description": "To use a custom
javax.xml.transform.URIResolver" },
+ "xpathTotalOpLimit": { "index": 21, "kind": "parameter", "displayName":
"Xpath Total Op Limit", "group": "advanced", "label": "advanced", "required":
false, "type": "integer", "javaType": "int", "deprecated": false, "autowired":
false, "secret": false, "defaultValue": 10000, "description": "Limits the total
number of XPath operators in an XSL Stylesheet. The default (from JDK) is
10000. The limit is set per TransformerFactory instance used by this endpoint."
},
+ "xsltMessageLogger": { "index": 22, "kind": "parameter", "displayName":
"Xslt Message Logger", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType":
"org.apache.camel.component.xslt.XsltMessageLogger", "deprecated": false,
"autowired": false, "secret": false, "description": "A consumer to messages
generated during XSLT transformations." },
+ "secureProcessing": { "index": 23, "kind": "parameter", "displayName":
"Secure Processing", "group": "security", "label": "advanced,security",
"required": false, "type": "boolean", "javaType": "boolean", "deprecated":
false, "autowired": false, "secret": false, "security": "insecure:dev",
"insecureValue": "false", "defaultValue": true, "description": "Feature for XML
secure processing (see javax.xml.XMLConstants). This is enabled by default.
However, when using Saxon Professional you [...]
}
}
diff --git
a/components/camel-xslt-saxon/src/generated/resources/META-INF/org/apache/camel/component/xslt/saxon/xslt-saxon.json
b/components/camel-xslt-saxon/src/generated/resources/META-INF/org/apache/camel/component/xslt/saxon/xslt-saxon.json
index 28cd2c8d0599..72a4431ca839 100644
---
a/components/camel-xslt-saxon/src/generated/resources/META-INF/org/apache/camel/component/xslt/saxon/xslt-saxon.json
+++
b/components/camel-xslt-saxon/src/generated/resources/META-INF/org/apache/camel/component/xslt/saxon/xslt-saxon.json
@@ -31,12 +31,12 @@
"saxonConfiguration": { "index": 4, "kind": "property", "displayName":
"Saxon Configuration", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType": "net.sf.saxon.Configuration",
"deprecated": false, "autowired": false, "secret": false, "description": "To
use a custom Saxon configuration" },
"saxonConfigurationProperties": { "index": 5, "kind": "property",
"displayName": "Saxon Configuration Properties", "group": "advanced", "label":
"advanced", "required": false, "type": "object", "javaType":
"java.util.Map<java.lang.String, java.lang.Object>", "deprecated": false,
"autowired": false, "secret": false, "description": "To set custom Saxon
configuration properties" },
"saxonExtensionFunctions": { "index": 6, "kind": "property",
"displayName": "Saxon Extension Functions", "group": "advanced", "label":
"advanced", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"description": "Allows you to use a custom
net.sf.saxon.lib.ExtensionFunctionDefinition. You would need to add camel-saxon
to the classpath. The function is looked up in the registry, where you can use
commas to se [...]
- "secureProcessing": { "index": 7, "kind": "property", "displayName":
"Secure Processing", "group": "advanced", "label": "advanced", "required":
false, "type": "boolean", "javaType": "boolean", "deprecated": false,
"autowired": false, "secret": false, "defaultValue": true, "description":
"Feature for XML secure processing (see javax.xml.XMLConstants). This is
enabled by default. However, when using Saxon Professional you may need to turn
this off to allow Saxon to be able to use Java [...]
- "transformerFactoryClass": { "index": 8, "kind": "property",
"displayName": "Transformer Factory Class", "group": "advanced", "label":
"advanced", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"description": "To use a custom XSLT transformer factory, specified as a FQN
class name" },
- "transformerFactoryConfigurationStrategy": { "index": 9, "kind":
"property", "displayName": "Transformer Factory Configuration Strategy",
"group": "advanced", "label": "advanced", "required": false, "type": "object",
"javaType":
"org.apache.camel.component.xslt.TransformerFactoryConfigurationStrategy",
"deprecated": false, "autowired": false, "secret": false, "description": "A
configuration strategy to apply on freshly created instances of
TransformerFactory." },
- "uriResolver": { "index": 10, "kind": "property", "displayName": "Uri
Resolver", "group": "advanced", "label": "advanced", "required": false, "type":
"object", "javaType": "javax.xml.transform.URIResolver", "deprecated": false,
"autowired": false, "secret": false, "description": "To use a custom
UriResolver. Should not be used together with the option 'uriResolverFactory'."
},
- "uriResolverFactory": { "index": 11, "kind": "property", "displayName":
"Uri Resolver Factory", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType":
"org.apache.camel.component.xslt.XsltUriResolverFactory", "deprecated": false,
"autowired": false, "secret": false, "description": "To use a custom
UriResolver which depends on a dynamic endpoint resource URI. Should not be
used together with the option 'uriResolver'." },
- "xpathTotalOpLimit": { "index": 12, "kind": "property", "displayName":
"Xpath Total Op Limit", "group": "advanced", "label": "advanced", "required":
false, "type": "integer", "javaType": "int", "deprecated": false, "autowired":
false, "secret": false, "defaultValue": 10000, "description": "Limits the total
number of XPath operators in an XSL Stylesheet. The default (from JDK) is
10000. The limit is set per TransformerFactory instance used by each endpoint,
not as a JVM-global system [...]
+ "transformerFactoryClass": { "index": 7, "kind": "property",
"displayName": "Transformer Factory Class", "group": "advanced", "label":
"advanced", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"description": "To use a custom XSLT transformer factory, specified as a FQN
class name" },
+ "transformerFactoryConfigurationStrategy": { "index": 8, "kind":
"property", "displayName": "Transformer Factory Configuration Strategy",
"group": "advanced", "label": "advanced", "required": false, "type": "object",
"javaType":
"org.apache.camel.component.xslt.TransformerFactoryConfigurationStrategy",
"deprecated": false, "autowired": false, "secret": false, "description": "A
configuration strategy to apply on freshly created instances of
TransformerFactory." },
+ "uriResolver": { "index": 9, "kind": "property", "displayName": "Uri
Resolver", "group": "advanced", "label": "advanced", "required": false, "type":
"object", "javaType": "javax.xml.transform.URIResolver", "deprecated": false,
"autowired": false, "secret": false, "description": "To use a custom
UriResolver. Should not be used together with the option 'uriResolverFactory'."
},
+ "uriResolverFactory": { "index": 10, "kind": "property", "displayName":
"Uri Resolver Factory", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType":
"org.apache.camel.component.xslt.XsltUriResolverFactory", "deprecated": false,
"autowired": false, "secret": false, "description": "To use a custom
UriResolver which depends on a dynamic endpoint resource URI. Should not be
used together with the option 'uriResolver'." },
+ "xpathTotalOpLimit": { "index": 11, "kind": "property", "displayName":
"Xpath Total Op Limit", "group": "advanced", "label": "advanced", "required":
false, "type": "integer", "javaType": "int", "deprecated": false, "autowired":
false, "secret": false, "defaultValue": 10000, "description": "Limits the total
number of XPath operators in an XSL Stylesheet. The default (from JDK) is
10000. The limit is set per TransformerFactory instance used by each endpoint,
not as a JVM-global system [...]
+ "secureProcessing": { "index": 12, "kind": "property", "displayName":
"Secure Processing", "group": "security", "label": "advanced,security",
"required": false, "type": "boolean", "javaType": "boolean", "deprecated":
false, "autowired": false, "secret": false, "security": "insecure:dev",
"insecureValue": "false", "defaultValue": true, "description": "Feature for XML
secure processing (see javax.xml.XMLConstants). This is enabled by default.
However, when using Saxon Professional you [...]
},
"headers": {
"CamelXsltResourceUri": { "index": 0, "kind": "header", "displayName": "",
"group": "producer", "label": "", "required": false, "javaType": "String",
"deprecated": false, "deprecationNote": "", "autowired": false, "secret":
false, "description": "A URI for the template resource to load and use instead
of the endpoint configured.", "constantName":
"org.apache.camel.component.xslt.XsltConstants#XSLT_RESOURCE_URI" },
@@ -64,12 +64,12 @@
"resultHandlerFactory": { "index": 13, "kind": "parameter", "displayName":
"Result Handler Factory", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType":
"org.apache.camel.component.xslt.ResultHandlerFactory", "deprecated": false,
"autowired": false, "secret": false, "description": "Allows you to use a custom
org.apache.camel.builder.xml.ResultHandlerFactory which is capable of using
custom org.apache.camel.builder.xml.ResultHandler types." },
"saxonConfiguration": { "index": 14, "kind": "parameter", "displayName":
"Saxon Configuration", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType": "net.sf.saxon.Configuration",
"deprecated": false, "autowired": false, "secret": false, "description": "To
use a custom Saxon configuration" },
"saxonExtensionFunctions": { "index": 15, "kind": "parameter",
"displayName": "Saxon Extension Functions", "group": "advanced", "label":
"advanced", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"description": "Allows you to use a custom
net.sf.saxon.lib.ExtensionFunctionDefinition. You would need to add camel-saxon
to the classpath. The function is looked up in the registry, where you can
comma to separ [...]
- "secureProcessing": { "index": 16, "kind": "parameter", "displayName":
"Secure Processing", "group": "advanced", "label": "advanced", "required":
false, "type": "boolean", "javaType": "boolean", "deprecated": false,
"autowired": false, "secret": false, "defaultValue": true, "description":
"Feature for XML secure processing (see javax.xml.XMLConstants). This is
enabled by default. However, when using Saxon Professional you may need to turn
this off to allow Saxon to be able to use Jav [...]
- "transformerFactory": { "index": 17, "kind": "parameter", "displayName":
"Transformer Factory", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType": "javax.xml.transform.TransformerFactory",
"deprecated": false, "autowired": false, "secret": false, "description": "To
use a custom XSLT transformer factory" },
- "transformerFactoryClass": { "index": 18, "kind": "parameter",
"displayName": "Transformer Factory Class", "group": "advanced", "label":
"advanced", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"description": "To use a custom XSLT transformer factory, specified as a FQN
class name" },
- "transformerFactoryConfigurationStrategy": { "index": 19, "kind":
"parameter", "displayName": "Transformer Factory Configuration Strategy",
"group": "advanced", "label": "advanced", "required": false, "type": "object",
"javaType":
"org.apache.camel.component.xslt.TransformerFactoryConfigurationStrategy",
"deprecated": false, "autowired": false, "secret": false, "description": "A
configuration strategy to apply on freshly created instances of
TransformerFactory." },
- "uriResolver": { "index": 20, "kind": "parameter", "displayName": "Uri
Resolver", "group": "advanced", "label": "advanced", "required": false, "type":
"object", "javaType": "javax.xml.transform.URIResolver", "deprecated": false,
"autowired": false, "secret": false, "description": "To use a custom
javax.xml.transform.URIResolver" },
- "xpathTotalOpLimit": { "index": 21, "kind": "parameter", "displayName":
"Xpath Total Op Limit", "group": "advanced", "label": "advanced", "required":
false, "type": "integer", "javaType": "int", "deprecated": false, "autowired":
false, "secret": false, "defaultValue": 10000, "description": "Limits the total
number of XPath operators in an XSL Stylesheet. The default (from JDK) is
10000. The limit is set per TransformerFactory instance used by this endpoint."
},
- "xsltMessageLogger": { "index": 22, "kind": "parameter", "displayName":
"Xslt Message Logger", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType":
"org.apache.camel.component.xslt.XsltMessageLogger", "deprecated": false,
"autowired": false, "secret": false, "description": "A consumer to messages
generated during XSLT transformations." }
+ "transformerFactory": { "index": 16, "kind": "parameter", "displayName":
"Transformer Factory", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType": "javax.xml.transform.TransformerFactory",
"deprecated": false, "autowired": false, "secret": false, "description": "To
use a custom XSLT transformer factory" },
+ "transformerFactoryClass": { "index": 17, "kind": "parameter",
"displayName": "Transformer Factory Class", "group": "advanced", "label":
"advanced", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"description": "To use a custom XSLT transformer factory, specified as a FQN
class name" },
+ "transformerFactoryConfigurationStrategy": { "index": 18, "kind":
"parameter", "displayName": "Transformer Factory Configuration Strategy",
"group": "advanced", "label": "advanced", "required": false, "type": "object",
"javaType":
"org.apache.camel.component.xslt.TransformerFactoryConfigurationStrategy",
"deprecated": false, "autowired": false, "secret": false, "description": "A
configuration strategy to apply on freshly created instances of
TransformerFactory." },
+ "uriResolver": { "index": 19, "kind": "parameter", "displayName": "Uri
Resolver", "group": "advanced", "label": "advanced", "required": false, "type":
"object", "javaType": "javax.xml.transform.URIResolver", "deprecated": false,
"autowired": false, "secret": false, "description": "To use a custom
javax.xml.transform.URIResolver" },
+ "xpathTotalOpLimit": { "index": 20, "kind": "parameter", "displayName":
"Xpath Total Op Limit", "group": "advanced", "label": "advanced", "required":
false, "type": "integer", "javaType": "int", "deprecated": false, "autowired":
false, "secret": false, "defaultValue": 10000, "description": "Limits the total
number of XPath operators in an XSL Stylesheet. The default (from JDK) is
10000. The limit is set per TransformerFactory instance used by this endpoint."
},
+ "xsltMessageLogger": { "index": 21, "kind": "parameter", "displayName":
"Xslt Message Logger", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType":
"org.apache.camel.component.xslt.XsltMessageLogger", "deprecated": false,
"autowired": false, "secret": false, "description": "A consumer to messages
generated during XSLT transformations." },
+ "secureProcessing": { "index": 22, "kind": "parameter", "displayName":
"Secure Processing", "group": "security", "label": "advanced,security",
"required": false, "type": "boolean", "javaType": "boolean", "deprecated":
false, "autowired": false, "secret": false, "security": "insecure:dev",
"insecureValue": "false", "defaultValue": true, "description": "Feature for XML
secure processing (see javax.xml.XMLConstants). This is enabled by default.
However, when using Saxon Professional you [...]
}
}
diff --git
a/components/camel-xslt-saxon/src/main/java/org/apache/camel/component/xslt/saxon/SaxonXmlSourceHandlerFactoryImpl.java
b/components/camel-xslt-saxon/src/main/java/org/apache/camel/component/xslt/saxon/SaxonXmlSourceHandlerFactoryImpl.java
index 138cf53aa915..7cbc184aa34e 100644
---
a/components/camel-xslt-saxon/src/main/java/org/apache/camel/component/xslt/saxon/SaxonXmlSourceHandlerFactoryImpl.java
+++
b/components/camel-xslt-saxon/src/main/java/org/apache/camel/component/xslt/saxon/SaxonXmlSourceHandlerFactoryImpl.java
@@ -43,6 +43,7 @@ public class SaxonXmlSourceHandlerFactoryImpl extends
XmlSourceHandlerFactoryImp
private static final Logger LOG =
LoggerFactory.getLogger(SaxonXmlSourceHandlerFactoryImpl.class);
private boolean useJsonBody = false;
+ private boolean secureProcessing = true;
public boolean isUseJsonBody() {
return useJsonBody;
@@ -52,12 +53,32 @@ public class SaxonXmlSourceHandlerFactoryImpl extends
XmlSourceHandlerFactoryImp
this.useJsonBody = useJsonBody;
}
+ public boolean isSecureProcessing() {
+ return secureProcessing;
+ }
+
+ public void setSecureProcessing(boolean secureProcessing) {
+ this.secureProcessing = secureProcessing;
+ }
+
private Processor saxonProcessor;
private XPathExecutable saxonJsonToXmlExecutable;
private DocumentBuilder documentBuilder;
@Override
protected Source getSource(Exchange exchange, Object body) {
+ Source source = doGetSource(exchange, body);
+ if (secureProcessing) {
+ // A stream-based source still has to be parsed. Parse it with a
reader that does not resolve references
+ // to external resources declared in the document, like the other
body types which reach Saxon through
+ // Camel's StAX/SAX converters. A source that is already parsed
(for example a DOMSource or a StAXSource)
+ // or that carries a reader the caller configured is returned as
is.
+ source = XsltSaxonHelper.secureSource(source);
+ }
+ return source;
+ }
+
+ private Source doGetSource(Exchange exchange, Object body) {
// body may already be a source
if (body instanceof Source) {
return (Source) body;
diff --git
a/components/camel-xslt-saxon/src/main/java/org/apache/camel/component/xslt/saxon/XsltSaxonAggregationStrategy.java
b/components/camel-xslt-saxon/src/main/java/org/apache/camel/component/xslt/saxon/XsltSaxonAggregationStrategy.java
index cf86c3d4b010..d531828fb59d 100644
---
a/components/camel-xslt-saxon/src/main/java/org/apache/camel/component/xslt/saxon/XsltSaxonAggregationStrategy.java
+++
b/components/camel-xslt-saxon/src/main/java/org/apache/camel/component/xslt/saxon/XsltSaxonAggregationStrategy.java
@@ -19,6 +19,7 @@ package org.apache.camel.component.xslt.saxon;
import javax.xml.transform.TransformerFactory;
import net.sf.saxon.TransformerFactoryImpl;
+import org.apache.camel.RuntimeCamelException;
import org.apache.camel.component.xslt.XsltAggregationStrategy;
import org.apache.camel.component.xslt.XsltBuilder;
import org.apache.camel.component.xslt.XsltOutput;
@@ -50,7 +51,14 @@ public class XsltSaxonAggregationStrategy extends
XsltAggregationStrategy {
public XsltSaxonAggregationStrategy(String xslFileLocation) {
super(xslFileLocation);
- setTransformerFactory(new TransformerFactoryImpl());
+ TransformerFactoryImpl factory = new TransformerFactoryImpl();
+ try {
+ XsltSaxonHelper.configureSecureProcessing(factory, true);
+ } catch (Exception e) {
+ throw new RuntimeCamelException("Cannot configure secure
processing on the Saxon TransformerFactory", e);
+ }
+ XsltSaxonHelper.configureExternalAccess(factory);
+ setTransformerFactory(factory);
}
@Override
diff --git
a/components/camel-xslt-saxon/src/main/java/org/apache/camel/component/xslt/saxon/XsltSaxonBuilder.java
b/components/camel-xslt-saxon/src/main/java/org/apache/camel/component/xslt/saxon/XsltSaxonBuilder.java
index bd3c58e04028..e5b2fd193d0f 100644
---
a/components/camel-xslt-saxon/src/main/java/org/apache/camel/component/xslt/saxon/XsltSaxonBuilder.java
+++
b/components/camel-xslt-saxon/src/main/java/org/apache/camel/component/xslt/saxon/XsltSaxonBuilder.java
@@ -40,6 +40,7 @@ public class XsltSaxonBuilder extends XsltBuilder {
private boolean allowStAX = true;
private boolean useJsonBody = false;
+ private boolean secureProcessing = true;
@Override
protected Source prepareSource(Source source) {
@@ -74,10 +75,19 @@ public class XsltSaxonBuilder extends XsltBuilder {
this.useJsonBody = useJsonBody;
}
+ public boolean isSecureProcessing() {
+ return secureProcessing;
+ }
+
+ public void setSecureProcessing(boolean secureProcessing) {
+ this.secureProcessing = secureProcessing;
+ }
+
@Override
protected XmlSourceHandlerFactoryImpl createXmlSourceHandlerFactoryImpl() {
SaxonXmlSourceHandlerFactoryImpl factory = new
SaxonXmlSourceHandlerFactoryImpl();
factory.setUseJsonBody(useJsonBody);
+ factory.setSecureProcessing(secureProcessing);
return factory;
}
diff --git
a/components/camel-xslt-saxon/src/main/java/org/apache/camel/component/xslt/saxon/XsltSaxonComponent.java
b/components/camel-xslt-saxon/src/main/java/org/apache/camel/component/xslt/saxon/XsltSaxonComponent.java
index e21898cc5ed7..7de498921d6e 100644
---
a/components/camel-xslt-saxon/src/main/java/org/apache/camel/component/xslt/saxon/XsltSaxonComponent.java
+++
b/components/camel-xslt-saxon/src/main/java/org/apache/camel/component/xslt/saxon/XsltSaxonComponent.java
@@ -39,7 +39,7 @@ public class XsltSaxonComponent extends XsltComponent {
private Map<String, Object> saxonConfigurationProperties = new HashMap<>();
@Metadata(label = "advanced", javaType = "java.lang.String")
private List<Object> saxonExtensionFunctions;
- @Metadata(label = "advanced", defaultValue = "true")
+ @Metadata(label = "advanced,security", defaultValue = "true", security =
"insecure:dev", insecureValue = "false")
private boolean secureProcessing = true;
public List<Object> getSaxonExtensionFunctions() {
@@ -73,7 +73,9 @@ public class XsltSaxonComponent extends XsltComponent {
/**
* Feature for XML secure processing (see javax.xml.XMLConstants). This is
enabled by default. However, when using
- * Saxon Professional you may need to turn this off to allow Saxon to be
able to use Java extension functions.
+ * Saxon Professional you may need to turn this off to allow Saxon to be
able to use Java extension functions. Note
+ * that turning it off also restores the previous, unrestricted parsing of
a {@code Source} message body that is
+ * still to be parsed, so only do so for trusted input.
*/
public void setSecureProcessing(boolean secureProcessing) {
this.secureProcessing = secureProcessing;
diff --git
a/components/camel-xslt-saxon/src/main/java/org/apache/camel/component/xslt/saxon/XsltSaxonEndpoint.java
b/components/camel-xslt-saxon/src/main/java/org/apache/camel/component/xslt/saxon/XsltSaxonEndpoint.java
index 3c5f8ce5e4f1..f0579c004446 100644
---
a/components/camel-xslt-saxon/src/main/java/org/apache/camel/component/xslt/saxon/XsltSaxonEndpoint.java
+++
b/components/camel-xslt-saxon/src/main/java/org/apache/camel/component/xslt/saxon/XsltSaxonEndpoint.java
@@ -100,7 +100,7 @@ public class XsltSaxonEndpoint extends XsltEndpoint {
private List<Object> saxonExtensionFunctions;
@UriParam(displayName = "Allow StAX", defaultValue = "true")
private boolean allowStAX = true;
- @UriParam(label = "advanced", defaultValue = "true")
+ @UriParam(label = "advanced,security", defaultValue = "true", security =
"insecure:dev", insecureValue = "false")
private boolean secureProcessing = true;
@UriParam
@Metadata(firstVersion = "4.15.0", displayName = "Use JSON Body",
defaultValue = "false", required = false)
@@ -190,7 +190,9 @@ public class XsltSaxonEndpoint extends XsltEndpoint {
/**
* Feature for XML secure processing (see javax.xml.XMLConstants). This is
enabled by default. However, when using
- * Saxon Professional you may need to turn this off to allow Saxon to be
able to use Java extension functions.
+ * Saxon Professional you may need to turn this off to allow Saxon to be
able to use Java extension functions. Note
+ * that turning it off also restores the previous, unrestricted parsing of
a {@code Source} message body that is
+ * still to be parsed, so only do so for trusted input.
*/
public void setSecureProcessing(boolean secureProcessing) {
this.secureProcessing = secureProcessing;
@@ -237,16 +239,7 @@ public class XsltSaxonEndpoint extends XsltEndpoint {
XsltSaxonHelper.registerSaxonExtensionFunctions(tf,
saxonExtensionFunctions);
}
- try {
- factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
- } catch (IllegalArgumentException e) {
- LOG.debug("TransformerFactory does not support {}",
XMLConstants.ACCESS_EXTERNAL_DTD);
- }
- try {
- factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET,
"");
- } catch (IllegalArgumentException e) {
- LOG.debug("TransformerFactory does not support {}",
XMLConstants.ACCESS_EXTERNAL_STYLESHEET);
- }
+ XsltSaxonHelper.configureExternalAccess(factory);
final TransformerFactoryConfigurationStrategy strategy =
getTransformerFactoryConfigurationStrategy();
if (strategy != null) {
@@ -279,6 +272,7 @@ public class XsltSaxonEndpoint extends XsltEndpoint {
xslt.setEntityResolver(getEntityResolver());
xslt.setAllowStAX(allowStAX);
xslt.setUseJsonBody(useJsonBody);
+ xslt.setSecureProcessing(secureProcessing);
xslt.setDeleteOutputFile(isDeleteOutputFile());
xslt.setSource(ExpressionBuilder.singleInputExpression(getSource()));
diff --git
a/components/camel-xslt-saxon/src/main/java/org/apache/camel/component/xslt/saxon/XsltSaxonHelper.java
b/components/camel-xslt-saxon/src/main/java/org/apache/camel/component/xslt/saxon/XsltSaxonHelper.java
index 40e9ca881bba..022f6903b93e 100644
---
a/components/camel-xslt-saxon/src/main/java/org/apache/camel/component/xslt/saxon/XsltSaxonHelper.java
+++
b/components/camel-xslt-saxon/src/main/java/org/apache/camel/component/xslt/saxon/XsltSaxonHelper.java
@@ -20,10 +20,21 @@ import java.util.List;
import java.util.Map;
import javax.xml.XMLConstants;
+import javax.xml.parsers.ParserConfigurationException;
+import javax.xml.parsers.SAXParserFactory;
+import javax.xml.transform.Source;
+import javax.xml.transform.TransformerFactory;
+import javax.xml.transform.sax.SAXSource;
+
+import org.xml.sax.InputSource;
+import org.xml.sax.SAXException;
+import org.xml.sax.XMLReader;
import net.sf.saxon.Configuration;
import net.sf.saxon.TransformerFactoryImpl;
import net.sf.saxon.lib.ExtensionFunctionDefinition;
+import org.apache.camel.RuntimeCamelException;
+import org.apache.camel.converter.jaxp.XMLReaderPool;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -31,9 +42,35 @@ final class XsltSaxonHelper {
private static final Logger LOG =
LoggerFactory.getLogger(XsltSaxonHelper.class);
+ private static final String EXTERNAL_GENERAL_ENTITIES =
"http://xml.org/sax/features/external-general-entities";;
+ private static final String EXTERNAL_PARAMETER_ENTITIES =
"http://xml.org/sax/features/external-parameter-entities";;
+ private static final String LOAD_EXTERNAL_DTD =
"http://apache.org/xml/features/nonvalidating/load-external-dtd";;
+
+ private static final class SecureReaderPoolHolder {
+ // Configured once: a SAXParserFactory on the classpath that does not
recognise one of the required features fails
+ // on first use of the holder rather than silently degrading on every
exchange. The pool hands out a
+ // reader for a single parse and is safe to share between threads.
+ static final XMLReaderPool POOL = new
XMLReaderPool(createSecureSaxParserFactory());
+ }
+
private XsltSaxonHelper() {
}
+ private static SAXParserFactory createSecureSaxParserFactory() {
+ try {
+ SAXParserFactory factory = SAXParserFactory.newInstance();
+ factory.setNamespaceAware(true);
+ factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+ factory.setFeature(EXTERNAL_GENERAL_ENTITIES, false);
+ factory.setFeature(EXTERNAL_PARAMETER_ENTITIES, false);
+ factory.setFeature(LOAD_EXTERNAL_DTD, false);
+ return factory;
+ } catch (ParserConfigurationException | SAXException e) {
+ throw new IllegalStateException(
+ "Cannot configure a restricted SAXParserFactory for
xslt-saxon input parsing", e);
+ }
+ }
+
public static void registerSaxonConfiguration(TransformerFactoryImpl
factory, Configuration saxonConfiguration) {
if (saxonConfiguration != null) {
factory.setConfiguration(saxonConfiguration);
@@ -55,6 +92,58 @@ final class XsltSaxonHelper {
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING,
secureProcessing);
}
+ /**
+ * Restricts the external resource access of the given factory to the
empty set, so that stylesheet compilation and
+ * the {@code document()} function do not reach external resources. This
is the same configuration the
+ * {@code xslt-saxon} endpoint applies to the factory it creates; it is
shared so the endpoint and
+ * {@link XsltSaxonAggregationStrategy} cannot drift apart.
+ */
+ public static void configureExternalAccess(TransformerFactory factory) {
+ try {
+ factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+ } catch (IllegalArgumentException e) {
+ LOG.debug("TransformerFactory does not support {}",
XMLConstants.ACCESS_EXTERNAL_DTD);
+ }
+ try {
+ factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
+ } catch (IllegalArgumentException e) {
+ LOG.debug("TransformerFactory does not support {}",
XMLConstants.ACCESS_EXTERNAL_STYLESHEET);
+ }
+ }
+
+ /**
+ * Returns a source whose parsing does not resolve references to external
resources, for an input that is still to
+ * be parsed. The factory's {@code ACCESS_EXTERNAL_*} attributes do not
cover this parse, because the transformer
+ * factory has a {@link javax.xml.transform.URIResolver} installed that
resolves the reference itself, so the input
+ * is parsed with a dedicated reader instead.
+ * <p>
+ * A {@link SAXSource} that already carries its own {@link XMLReader}, and
any source that is not stream-based (for
+ * example a {@code DOMSource} or a {@code StAXSource}), is returned
unchanged; its content has already been parsed
+ * or is read through a reader the caller controls. Only a stream-based
source still to be parsed
+ * ({@code StreamSource}, including Camel's {@code StringSource}/{@code
BytesSource}, or a reader-less
+ * {@code SAXSource}) is wrapped with the restricted reader.
+ */
+ public static Source secureSource(Source source) {
+ if (source == null) {
+ return null;
+ }
+ if (source instanceof SAXSource saxSource && saxSource.getXMLReader()
!= null) {
+ return source;
+ }
+ InputSource inputSource = SAXSource.sourceToInputSource(source);
+ if (inputSource == null) {
+ return source;
+ }
+ try {
+ XMLReader xmlReader =
SecureReaderPoolHolder.POOL.createXMLReader();
+ return new SAXSource(xmlReader, inputSource);
+ } catch (ParserConfigurationException | SAXException e) {
+ // Fail closed: this is the security control, so do not fall back
to an unrestricted parse.
+ throw new RuntimeCamelException(
+ "Cannot create a restricted XMLReader for the xslt-saxon
input source", e);
+ }
+ }
+
public static void registerSaxonExtensionFunctions(
TransformerFactoryImpl factory,
List<Object> saxonExtensionFunctions)
diff --git
a/components/camel-xslt-saxon/src/test/java/org/apache/camel/component/xslt/saxon/XsltSaxonAggregationStrategyIncludeTest.java
b/components/camel-xslt-saxon/src/test/java/org/apache/camel/component/xslt/saxon/XsltSaxonAggregationStrategyIncludeTest.java
new file mode 100644
index 000000000000..4d9ce3e05b67
--- /dev/null
+++
b/components/camel-xslt-saxon/src/test/java/org/apache/camel/component/xslt/saxon/XsltSaxonAggregationStrategyIncludeTest.java
@@ -0,0 +1,65 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.xslt.saxon;
+
+import org.apache.camel.builder.RouteBuilder;
+import org.apache.camel.component.mock.MockEndpoint;
+import org.apache.camel.test.junit6.CamelTestSupport;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * Checks that an aggregation stylesheet used by {@link
XsltSaxonAggregationStrategy} can still resolve an
+ * {@code xsl:include} from the classpath, even though the strategy now
restricts external resource access
+ * ({@code ACCESS_EXTERNAL_STYLESHEET=""}) the same way the {@code xslt-saxon}
endpoint does. The restriction targets
+ * resources named by the message body, not the stylesheet's own includes,
which Camel resolves from the classpath.
+ */
+class XsltSaxonAggregationStrategyIncludeTest extends CamelTestSupport {
+
+ @Test
+ void shouldResolveClasspathIncludeInAggregationStylesheet() throws
Exception {
+ MockEndpoint mock = getMockEndpoint("mock:result");
+ mock.expectedMessageCount(1);
+
+ template.sendBody("direct:aggregate", "<item>A</item>");
+ template.sendBody("direct:aggregate", "<item>B</item>");
+
+ MockEndpoint.assertIsSatisfied(context);
+
+ String body =
mock.getReceivedExchanges().get(0).getIn().getBody(String.class);
+ assertTrue(body.contains("INCLUDED-"),
+ "The xsl:include from the classpath should be resolved (named
template from the included stylesheet). Got: "
+ + body);
+ assertTrue(body.contains("AB"), "The aggregation should combine both
bodies. Got: " + body);
+ }
+
+ @Override
+ protected RouteBuilder createRouteBuilder() {
+ return new RouteBuilder() {
+ @Override
+ public void configure() {
+ from("direct:aggregate")
+ .aggregate(constant(true),
+ new XsltSaxonAggregationStrategy(
+
"org/apache/camel/component/xslt/saxon/aggregate-with-include.xsl"))
+ .completionSize(2)
+ .to("mock:result");
+ }
+ };
+ }
+}
diff --git
a/components/camel-xslt-saxon/src/test/java/org/apache/camel/component/xslt/saxon/XsltSaxonAggregationStrategySourceBodyTest.java
b/components/camel-xslt-saxon/src/test/java/org/apache/camel/component/xslt/saxon/XsltSaxonAggregationStrategySourceBodyTest.java
new file mode 100644
index 000000000000..7fe5501b5876
--- /dev/null
+++
b/components/camel-xslt-saxon/src/test/java/org/apache/camel/component/xslt/saxon/XsltSaxonAggregationStrategySourceBodyTest.java
@@ -0,0 +1,96 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.xslt.saxon;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import org.apache.camel.builder.RouteBuilder;
+import org.apache.camel.component.mock.MockEndpoint;
+import org.apache.camel.test.junit6.CamelTestSupport;
+import org.apache.camel.util.xml.StringSource;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * Checks how {@link XsltSaxonAggregationStrategy} parses a message body that
is already a
+ * {@link javax.xml.transform.Source} when it aggregates it. Such a body
reaches Saxon still to be parsed, unlike the
+ * other body types which Camel converts first, so the strategy must parse it
with the same restrictions the
+ * {@code xslt-saxon} endpoint applies to its own factory: a reference to a
resource named by the body is not resolved
+ * from it, while a declaration internal to the document is still applied.
+ */
+class XsltSaxonAggregationStrategySourceBodyTest extends CamelTestSupport {
+
+ @TempDir
+ static Path tmp;
+
+ private static final String SENTINEL = "SENTINELFILECONTENT";
+
+ @Test
+ void shouldNotResolveSystemReferenceInAggregatedSourceBody() throws
Exception {
+ Path file = tmp.resolve("neighbour.txt");
+ Files.writeString(file, SENTINEL);
+
+ String firstBody = "<!DOCTYPE item [<!ENTITY ref SYSTEM \"" +
file.toUri() + "\">]><item>&ref;</item>";
+
+ MockEndpoint mock = getMockEndpoint("mock:result");
+ mock.expectedMessageCount(1);
+
+ template.sendBody("direct:aggregate", new StringSource(firstBody));
+ template.sendBody("direct:aggregate", "<item>B</item>");
+
+ MockEndpoint.assertIsSatisfied(context);
+
+ String body =
mock.getReceivedExchanges().get(0).getIn().getBody(String.class);
+ assertFalse(body.contains(SENTINEL),
+ "The resource named by the aggregated body must not be
resolved into the result. Got: " + body);
+ }
+
+ @Test
+ void shouldStillApplyInternalDeclarationInAggregatedSourceBody() throws
Exception {
+ String firstBody = "<!DOCTYPE item [<!ENTITY ok
\"OKVALUE\">]><item>&ok;</item>";
+
+ MockEndpoint mock = getMockEndpoint("mock:result");
+ mock.expectedMessageCount(1);
+
+ template.sendBody("direct:aggregate", new StringSource(firstBody));
+ template.sendBody("direct:aggregate", "<item>B</item>");
+
+ MockEndpoint.assertIsSatisfied(context);
+
+ String body =
mock.getReceivedExchanges().get(0).getIn().getBody(String.class);
+ assertTrue(body.contains("OKVALUE"),
+ "A declaration internal to the document should still be
applied. Got: " + body);
+ }
+
+ @Override
+ protected RouteBuilder createRouteBuilder() {
+ return new RouteBuilder() {
+ @Override
+ public void configure() {
+ from("direct:aggregate")
+ .aggregate(constant(true),
+ new
XsltSaxonAggregationStrategy("org/apache/camel/util/toolbox/aggregate.xsl"))
+ .completionSize(2)
+ .to("mock:result");
+ }
+ };
+ }
+}
diff --git
a/components/camel-xslt-saxon/src/test/java/org/apache/camel/component/xslt/saxon/XsltSaxonDomSourceTest.java
b/components/camel-xslt-saxon/src/test/java/org/apache/camel/component/xslt/saxon/XsltSaxonDomSourceTest.java
index 082e47fb66b9..11380cc47d6d 100644
---
a/components/camel-xslt-saxon/src/test/java/org/apache/camel/component/xslt/saxon/XsltSaxonDomSourceTest.java
+++
b/components/camel-xslt-saxon/src/test/java/org/apache/camel/component/xslt/saxon/XsltSaxonDomSourceTest.java
@@ -46,6 +46,8 @@ import org.junit.jupiter.params.provider.ValueSource;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertInstanceOf;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
import static org.junit.jupiter.api.Assertions.assertNotSame;
import static org.junit.jupiter.api.Assertions.assertSame;
import static org.junit.jupiter.api.Assertions.assertTrue;
@@ -211,7 +213,7 @@ class XsltSaxonDomSourceTest {
@ValueSource(strings = { "document", "sax", "stream", "stax" })
void testExplicitDocumentAndStreamingSources(String kind) throws Exception
{
Source source = documentOrStreamingSource(kind);
- assertSame(source, getSource(source));
+ assertPreparedSource(kind, getSource(source));
String result = template.requestBody(ENDPOINT, source, String.class);
assertTrue(result.contains("<root"), result);
assertEquals("root", parse(result).getDocumentElement().getNodeName());
@@ -222,12 +224,40 @@ class XsltSaxonDomSourceTest {
void testImplicitDocumentAndStreamingSources(String kind) throws Exception
{
Source source = documentOrStreamingSource(kind);
Payload payload = new Payload(source, false);
- assertSame(source, getSource(payload));
+ assertPreparedSource(kind, getSource(payload));
String result = template.requestBody(ENDPOINT, payload, String.class);
assertEquals("root", parse(result).getDocumentElement().getNodeName());
assertTrue(payload.conversions >= 2);
}
+ @Test
+ void testStreamSourceUnwrappedWhenSecureProcessingDisabled() throws
Exception {
+ XsltSaxonEndpoint endpoint = context.getEndpoint(ENDPOINT +
"?secureProcessing=false", XsltSaxonEndpoint.class);
+ endpoint.start();
+ XsltSaxonBuilder builder = (XsltSaxonBuilder) endpoint.getXslt();
+ Exchange exchange = new DefaultExchange(context);
+ StreamSource source = new StreamSource(new StringReader(INPUT));
+ exchange.getMessage().setBody(source);
+ assertSame(source,
builder.getSourceHandlerFactory().getSource(exchange, (Expression) null));
+ }
+
+ /**
+ * A source that is already parsed ({@code DOMSource}) or read through a
reader the caller controls
+ * ({@code StAXSource}) is passed through unchanged; a stream-based source
still to be parsed is wrapped with a
+ * reader that does not resolve references to external resources.
+ */
+ private static void assertPreparedSource(String kind, Source prepared)
throws Exception {
+ if (kind.equals("document")) {
+ assertInstanceOf(DOMSource.class, prepared);
+ } else if (kind.equals("stax")) {
+ assertInstanceOf(StAXSource.class, prepared);
+ } else {
+ SAXSource saxSource = assertInstanceOf(SAXSource.class, prepared);
+ assertNotNull(saxSource.getXMLReader(), "A restricted reader
should be installed on the source");
+
assertFalse(saxSource.getXMLReader().getFeature("http://xml.org/sax/features/external-general-entities";));
+ }
+ }
+
private static Source documentOrStreamingSource(String kind) throws
Exception {
return switch (kind) {
case "document" -> new DOMSource(parse(INPUT));
diff --git
a/components/camel-xslt-saxon/src/test/java/org/apache/camel/component/xslt/saxon/XsltSaxonHelperConfigurationTest.java
b/components/camel-xslt-saxon/src/test/java/org/apache/camel/component/xslt/saxon/XsltSaxonHelperConfigurationTest.java
new file mode 100644
index 000000000000..2639189bdae6
--- /dev/null
+++
b/components/camel-xslt-saxon/src/test/java/org/apache/camel/component/xslt/saxon/XsltSaxonHelperConfigurationTest.java
@@ -0,0 +1,75 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.xslt.saxon;
+
+import java.io.ByteArrayInputStream;
+
+import javax.xml.XMLConstants;
+import javax.xml.parsers.DocumentBuilderFactory;
+import javax.xml.transform.Source;
+import javax.xml.transform.dom.DOMSource;
+import javax.xml.transform.sax.SAXSource;
+
+import net.sf.saxon.TransformerFactoryImpl;
+import org.apache.camel.util.xml.StringSource;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertInstanceOf;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertSame;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * Unit tests for the configuration helpers shared by {@link
XsltSaxonEndpoint} and
+ * {@link XsltSaxonAggregationStrategy}.
+ */
+class XsltSaxonHelperConfigurationTest {
+
+ @Test
+ void shouldRestrictExternalResourceAccessOnFactory() {
+ TransformerFactoryImpl factory = new TransformerFactoryImpl();
+ XsltSaxonHelper.configureExternalAccess(factory);
+
+ assertEquals("",
factory.getAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET));
+ }
+
+ @Test
+ void shouldWrapStreamBasedSourceWithRestrictedReader() throws Exception {
+ Source secured = XsltSaxonHelper.secureSource(new
StringSource("<item>A</item>"));
+
+ SAXSource saxSource = assertInstanceOf(SAXSource.class, secured);
+ assertNotNull(saxSource.getXMLReader(), "A restricted reader should be
installed on the source");
+
assertTrue(saxSource.getXMLReader().getFeature(XMLConstants.FEATURE_SECURE_PROCESSING));
+
assertFalse(saxSource.getXMLReader().getFeature("http://xml.org/sax/features/external-general-entities";));
+
assertFalse(saxSource.getXMLReader().getFeature("http://xml.org/sax/features/external-parameter-entities";));
+
assertFalse(saxSource.getXMLReader().getFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd";));
+ }
+
+ @Test
+ void shouldLeaveAlreadyParsedSourceUnchanged() throws Exception {
+ DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
+ dbf.setNamespaceAware(true);
+ DOMSource domSource = new DOMSource(
+ dbf.newDocumentBuilder().parse(new
ByteArrayInputStream("<item>A</item>".getBytes())));
+
+ Source secured = XsltSaxonHelper.secureSource(domSource);
+
+ assertSame(domSource, secured, "A source that is already parsed should
be returned unchanged");
+ }
+}
diff --git
a/components/camel-xslt-saxon/src/test/resources/org/apache/camel/component/xslt/saxon/aggregate-included.xsl
b/components/camel-xslt-saxon/src/test/resources/org/apache/camel/component/xslt/saxon/aggregate-included.xsl
new file mode 100644
index 000000000000..32e6c4dc1916
--- /dev/null
+++
b/components/camel-xslt-saxon/src/test/resources/org/apache/camel/component/xslt/saxon/aggregate-included.xsl
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+-->
+<xsl:stylesheet version="2.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform";>
+
+ <!-- Included from the classpath by aggregate-with-include.xsl, to check
that an xsl:include is still resolved
+ when the aggregation strategy restricts external stylesheet access
(ACCESS_EXTERNAL_STYLESHEET=""). -->
+ <xsl:template name="prefix">
+ <xsl:text>INCLUDED-</xsl:text>
+ </xsl:template>
+
+</xsl:stylesheet>
diff --git
a/components/camel-xslt-saxon/src/test/resources/org/apache/camel/component/xslt/saxon/aggregate-with-include.xsl
b/components/camel-xslt-saxon/src/test/resources/org/apache/camel/component/xslt/saxon/aggregate-with-include.xsl
new file mode 100644
index 000000000000..32a5cd045e09
--- /dev/null
+++
b/components/camel-xslt-saxon/src/test/resources/org/apache/camel/component/xslt/saxon/aggregate-with-include.xsl
@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+-->
+<xsl:stylesheet version="2.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform";>
+
+ <xsl:output method="xml" indent="no"/>
+ <xsl:strip-space elements="*"/>
+
+ <xsl:param name="new-exchange"/>
+
+ <!-- A classpath include, resolved relative to this stylesheet by Camel's
URI resolver. -->
+ <xsl:include href="aggregate-included.xsl"/>
+
+ <xsl:template match="/">
+ <item>
+ <xsl:call-template name="prefix"/>
+ <xsl:value-of select="."/>
+ <xsl:value-of select="$new-exchange/item"/>
+ </item>
+ </xsl:template>
+
+</xsl:stylesheet>
diff --git
a/core/camel-util/src/main/java/org/apache/camel/util/SecurityUtils.java
b/core/camel-util/src/main/java/org/apache/camel/util/SecurityUtils.java
index 67140037ee0b..20402847e7e1 100644
--- a/core/camel-util/src/main/java/org/apache/camel/util/SecurityUtils.java
+++ b/core/camel-util/src/main/java/org/apache/camel/util/SecurityUtils.java
@@ -85,6 +85,7 @@ public final class SecurityUtils {
map.put("objectcodecpattern", new
SecurityOption(INSECURE_SERIALIZATION, ""));
map.put("objectmessageenabled", new
SecurityOption(INSECURE_SERIALIZATION, "true"));
map.put("requireclassregistration", new
SecurityOption(INSECURE_SERIALIZATION, VALUE_FALSE));
+ map.put("secureprocessing", new SecurityOption(INSECURE_DEV,
VALUE_FALSE));
map.put("sendenabled", new SecurityOption(INSECURE_DEV, "true"));
map.put("serializablepackages", new
SecurityOption(INSECURE_SERIALIZATION, ""));
map.put("skiptlsverify", new SecurityOption(INSECURE_SSL, "true"));
@@ -197,6 +198,9 @@ public final class SecurityUtils {
"component:sjms2"));
owners.put("requireclassregistration", Set.of(
"dataformat:fory"));
+ owners.put("secureprocessing", Set.of(
+ "component:xj",
+ "component:xsltsaxon"));
owners.put("serializablepackages", Set.of(
"component:avro",
"dataformat:avro"));
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
index b5233ff44e10..28b8203e1e06 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
@@ -1354,6 +1354,30 @@ and uses the bucket of the endpoint, or the bucket named
in the new `CamelIBMCOS
that sets `CamelIBMCOSBucketName` to choose the bucket of a producer operation
(for example `createBucket` or
`deleteBucket`) must set `CamelIBMCOSOverrideBucketName` instead.
+=== camel-xslt-saxon - external resource access is restricted for a Source
message body
+
+`XsltSaxonAggregationStrategy` now configures its Saxon `TransformerFactory`
the same way the `xslt-saxon`
+endpoint configures the factory it creates: `FEATURE_SECURE_PROCESSING` is
enabled and `ACCESS_EXTERNAL_DTD`
+and `ACCESS_EXTERNAL_STYLESHEET` are set to an empty string. Previously the
strategy used the Saxon defaults,
+so the same stylesheet ran with different settings depending on whether it was
used from the endpoint or from
+the strategy. On Saxon PE/EE, `FEATURE_SECURE_PROCESSING` also disables
reflexive Java extension functions in the
+stylesheet.
+
+In addition, both the strategy and the `xslt-saxon` endpoint now parse a
message body that is already a
+`javax.xml.transform.Source` still to be parsed, for example a `StreamSource`
or the body after a
+`convertBodyTo(Source.class)`, with a reader that does not resolve references
to external resources declared
+in the document. A `DOMSource`, a `StAXSource`, or a `Source` that already
carries its own reader is left
+unchanged, and a declaration internal to the document is still applied. The
other body types (`String`,
+`byte[]`, `InputStream`) are unaffected, as they already reach the transformer
through Camel's StAX/SAX
+conversion.
+
+On the `xslt-saxon` endpoint, `secureProcessing` now controls both: setting
`secureProcessing=false` (for example so
+a Saxon PE/EE stylesheet can call Java extension functions) also restores the
previous, unrestricted parsing of a
+`Source` body. The option is marked as a security knob
(`security=insecure:dev`, `insecureValue=false`), so
+`camel.main.profile=prod` reports it when it is turned off.
`XsltSaxonAggregationStrategy` has no switch for the
+`Source` parsing: `setTransformerFactory(...)` replaces the factory, but the
strategy's `XsltSaxonBuilder` keeps
+`secureProcessing=true`, so the body is still parsed with the restricted
reader.
+
=== camel-ical - each unmarshal parses with its own calendar builder
The `ical` data format used one ical4j `CalendarBuilder` for all exchanges.
Two exchanges that were unmarshalled at
diff --git
a/dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/XjComponentBuilderFactory.java
b/dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/XjComponentBuilderFactory.java
index ae52c2fa98d1..ea4a532a2e35 100644
---
a/dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/XjComponentBuilderFactory.java
+++
b/dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/XjComponentBuilderFactory.java
@@ -190,26 +190,6 @@ public interface XjComponentBuilderFactory {
return this;
}
-
- /**
- * Feature for XML secure processing (see javax.xml.XMLConstants). This
- * is enabled by default. However, when using Saxon Professional you
may
- * need to turn this off to allow Saxon to be able to use Java
extension
- * functions.
- *
- * The option is a: <code>boolean</code> type.
- *
- * Default: true
- * Group: advanced
- *
- * @param secureProcessing the value to set
- * @return the dsl builder
- */
- default XjComponentBuilder secureProcessing(boolean secureProcessing) {
- doSetProperty("secureProcessing", secureProcessing);
- return this;
- }
-
/**
* To use a custom XSLT transformer factory, specified as a FQN class
* name.
@@ -296,6 +276,28 @@ public interface XjComponentBuilderFactory {
doSetProperty("xpathTotalOpLimit", xpathTotalOpLimit);
return this;
}
+
+
+ /**
+ * Feature for XML secure processing (see javax.xml.XMLConstants). This
+ * is enabled by default. However, when using Saxon Professional you
may
+ * need to turn this off to allow Saxon to be able to use Java
extension
+ * functions. Note that turning it off also restores the previous,
+ * unrestricted parsing of a Source message body that is still to be
+ * parsed, so only do so for trusted input.
+ *
+ * The option is a: <code>boolean</code> type.
+ *
+ * Default: true
+ * Group: security
+ *
+ * @param secureProcessing the value to set
+ * @return the dsl builder
+ */
+ default XjComponentBuilder secureProcessing(boolean secureProcessing) {
+ doSetProperty("secureProcessing", secureProcessing);
+ return this;
+ }
}
class XjComponentBuilderImpl
@@ -318,12 +320,12 @@ public interface XjComponentBuilderFactory {
case "saxonConfiguration": ((XJComponent)
component).setSaxonConfiguration((net.sf.saxon.Configuration) value); return
true;
case "saxonConfigurationProperties": ((XJComponent)
component).setSaxonConfigurationProperties((java.util.Map) value); return true;
case "saxonExtensionFunctions": ((XJComponent)
component).setSaxonExtensionFunctions((java.lang.String) value); return true;
- case "secureProcessing": ((XJComponent)
component).setSecureProcessing((boolean) value); return true;
case "transformerFactoryClass": ((XJComponent)
component).setTransformerFactoryClass((java.lang.String) value); return true;
case "transformerFactoryConfigurationStrategy": ((XJComponent)
component).setTransformerFactoryConfigurationStrategy((org.apache.camel.component.xslt.TransformerFactoryConfigurationStrategy)
value); return true;
case "uriResolver": ((XJComponent)
component).setUriResolver((javax.xml.transform.URIResolver) value); return true;
case "uriResolverFactory": ((XJComponent)
component).setUriResolverFactory((org.apache.camel.component.xslt.XsltUriResolverFactory)
value); return true;
case "xpathTotalOpLimit": ((XJComponent)
component).setXpathTotalOpLimit((int) value); return true;
+ case "secureProcessing": ((XJComponent)
component).setSecureProcessing((boolean) value); return true;
default: return false;
}
}
diff --git
a/dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/XsltSaxonComponentBuilderFactory.java
b/dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/XsltSaxonComponentBuilderFactory.java
index ec7c13e405c5..233a4924a638 100644
---
a/dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/XsltSaxonComponentBuilderFactory.java
+++
b/dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/XsltSaxonComponentBuilderFactory.java
@@ -190,26 +190,6 @@ public interface XsltSaxonComponentBuilderFactory {
return this;
}
-
- /**
- * Feature for XML secure processing (see javax.xml.XMLConstants). This
- * is enabled by default. However, when using Saxon Professional you
may
- * need to turn this off to allow Saxon to be able to use Java
extension
- * functions.
- *
- * The option is a: <code>boolean</code> type.
- *
- * Default: true
- * Group: advanced
- *
- * @param secureProcessing the value to set
- * @return the dsl builder
- */
- default XsltSaxonComponentBuilder secureProcessing(boolean
secureProcessing) {
- doSetProperty("secureProcessing", secureProcessing);
- return this;
- }
-
/**
* To use a custom XSLT transformer factory, specified as a FQN class
* name.
@@ -296,6 +276,28 @@ public interface XsltSaxonComponentBuilderFactory {
doSetProperty("xpathTotalOpLimit", xpathTotalOpLimit);
return this;
}
+
+
+ /**
+ * Feature for XML secure processing (see javax.xml.XMLConstants). This
+ * is enabled by default. However, when using Saxon Professional you
may
+ * need to turn this off to allow Saxon to be able to use Java
extension
+ * functions. Note that turning it off also restores the previous,
+ * unrestricted parsing of a Source message body that is still to be
+ * parsed, so only do so for trusted input.
+ *
+ * The option is a: <code>boolean</code> type.
+ *
+ * Default: true
+ * Group: security
+ *
+ * @param secureProcessing the value to set
+ * @return the dsl builder
+ */
+ default XsltSaxonComponentBuilder secureProcessing(boolean
secureProcessing) {
+ doSetProperty("secureProcessing", secureProcessing);
+ return this;
+ }
}
class XsltSaxonComponentBuilderImpl
@@ -318,12 +320,12 @@ public interface XsltSaxonComponentBuilderFactory {
case "saxonConfiguration": ((XsltSaxonComponent)
component).setSaxonConfiguration((net.sf.saxon.Configuration) value); return
true;
case "saxonConfigurationProperties": ((XsltSaxonComponent)
component).setSaxonConfigurationProperties((java.util.Map) value); return true;
case "saxonExtensionFunctions": ((XsltSaxonComponent)
component).setSaxonExtensionFunctions((java.lang.String) value); return true;
- case "secureProcessing": ((XsltSaxonComponent)
component).setSecureProcessing((boolean) value); return true;
case "transformerFactoryClass": ((XsltSaxonComponent)
component).setTransformerFactoryClass((java.lang.String) value); return true;
case "transformerFactoryConfigurationStrategy":
((XsltSaxonComponent)
component).setTransformerFactoryConfigurationStrategy((org.apache.camel.component.xslt.TransformerFactoryConfigurationStrategy)
value); return true;
case "uriResolver": ((XsltSaxonComponent)
component).setUriResolver((javax.xml.transform.URIResolver) value); return true;
case "uriResolverFactory": ((XsltSaxonComponent)
component).setUriResolverFactory((org.apache.camel.component.xslt.XsltUriResolverFactory)
value); return true;
case "xpathTotalOpLimit": ((XsltSaxonComponent)
component).setXpathTotalOpLimit((int) value); return true;
+ case "secureProcessing": ((XsltSaxonComponent)
component).setSecureProcessing((boolean) value); return true;
default: return false;
}
}
diff --git
a/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/XJEndpointBuilderFactory.java
b/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/XJEndpointBuilderFactory.java
index fcbbd82a6ace..5e17fda3afdf 100644
---
a/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/XJEndpointBuilderFactory.java
+++
b/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/XJEndpointBuilderFactory.java
@@ -593,42 +593,6 @@ public interface XJEndpointBuilderFactory {
doSetProperty("saxonExtensionFunctions", saxonExtensionFunctions);
return this;
}
- /**
- * Feature for XML secure processing (see javax.xml.XMLConstants). This
- * is enabled by default. However, when using Saxon Professional you
may
- * need to turn this off to allow Saxon to be able to use Java
extension
- * functions.
- *
- * The option is a: <code>boolean</code> type.
- *
- * Default: true
- * Group: advanced
- *
- * @param secureProcessing the value to set
- * @return the dsl builder
- */
- default AdvancedXJEndpointBuilder secureProcessing(boolean
secureProcessing) {
- doSetProperty("secureProcessing", secureProcessing);
- return this;
- }
- /**
- * Feature for XML secure processing (see javax.xml.XMLConstants). This
- * is enabled by default. However, when using Saxon Professional you
may
- * need to turn this off to allow Saxon to be able to use Java
extension
- * functions.
- *
- * The option will be converted to a <code>boolean</code> type.
- *
- * Default: true
- * Group: advanced
- *
- * @param secureProcessing the value to set
- * @return the dsl builder
- */
- default AdvancedXJEndpointBuilder secureProcessing(String
secureProcessing) {
- doSetProperty("secureProcessing", secureProcessing);
- return this;
- }
/**
* To use a custom XSLT transformer factory.
*
@@ -799,6 +763,46 @@ public interface XJEndpointBuilderFactory {
doSetProperty("xsltMessageLogger", xsltMessageLogger);
return this;
}
+ /**
+ * Feature for XML secure processing (see javax.xml.XMLConstants). This
+ * is enabled by default. However, when using Saxon Professional you
may
+ * need to turn this off to allow Saxon to be able to use Java
extension
+ * functions. Note that turning it off also restores the previous,
+ * unrestricted parsing of a Source message body that is still to be
+ * parsed, so only do so for trusted input.
+ *
+ * The option is a: <code>boolean</code> type.
+ *
+ * Default: true
+ * Group: security
+ *
+ * @param secureProcessing the value to set
+ * @return the dsl builder
+ */
+ default AdvancedXJEndpointBuilder secureProcessing(boolean
secureProcessing) {
+ doSetProperty("secureProcessing", secureProcessing);
+ return this;
+ }
+ /**
+ * Feature for XML secure processing (see javax.xml.XMLConstants). This
+ * is enabled by default. However, when using Saxon Professional you
may
+ * need to turn this off to allow Saxon to be able to use Java
extension
+ * functions. Note that turning it off also restores the previous,
+ * unrestricted parsing of a Source message body that is still to be
+ * parsed, so only do so for trusted input.
+ *
+ * The option will be converted to a <code>boolean</code> type.
+ *
+ * Default: true
+ * Group: security
+ *
+ * @param secureProcessing the value to set
+ * @return the dsl builder
+ */
+ default AdvancedXJEndpointBuilder secureProcessing(String
secureProcessing) {
+ doSetProperty("secureProcessing", secureProcessing);
+ return this;
+ }
}
public interface XJBuilders {
diff --git
a/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/XsltSaxonEndpointBuilderFactory.java
b/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/XsltSaxonEndpointBuilderFactory.java
index 08d781ccb3ab..ceeb7a033971 100644
---
a/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/XsltSaxonEndpointBuilderFactory.java
+++
b/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/XsltSaxonEndpointBuilderFactory.java
@@ -561,42 +561,6 @@ public interface XsltSaxonEndpointBuilderFactory {
doSetProperty("saxonExtensionFunctions", saxonExtensionFunctions);
return this;
}
- /**
- * Feature for XML secure processing (see javax.xml.XMLConstants). This
- * is enabled by default. However, when using Saxon Professional you
may
- * need to turn this off to allow Saxon to be able to use Java
extension
- * functions.
- *
- * The option is a: <code>boolean</code> type.
- *
- * Default: true
- * Group: advanced
- *
- * @param secureProcessing the value to set
- * @return the dsl builder
- */
- default AdvancedXsltSaxonEndpointBuilder secureProcessing(boolean
secureProcessing) {
- doSetProperty("secureProcessing", secureProcessing);
- return this;
- }
- /**
- * Feature for XML secure processing (see javax.xml.XMLConstants). This
- * is enabled by default. However, when using Saxon Professional you
may
- * need to turn this off to allow Saxon to be able to use Java
extension
- * functions.
- *
- * The option will be converted to a <code>boolean</code> type.
- *
- * Default: true
- * Group: advanced
- *
- * @param secureProcessing the value to set
- * @return the dsl builder
- */
- default AdvancedXsltSaxonEndpointBuilder secureProcessing(String
secureProcessing) {
- doSetProperty("secureProcessing", secureProcessing);
- return this;
- }
/**
* To use a custom XSLT transformer factory.
*
@@ -767,6 +731,46 @@ public interface XsltSaxonEndpointBuilderFactory {
doSetProperty("xsltMessageLogger", xsltMessageLogger);
return this;
}
+ /**
+ * Feature for XML secure processing (see javax.xml.XMLConstants). This
+ * is enabled by default. However, when using Saxon Professional you
may
+ * need to turn this off to allow Saxon to be able to use Java
extension
+ * functions. Note that turning it off also restores the previous,
+ * unrestricted parsing of a Source message body that is still to be
+ * parsed, so only do so for trusted input.
+ *
+ * The option is a: <code>boolean</code> type.
+ *
+ * Default: true
+ * Group: security
+ *
+ * @param secureProcessing the value to set
+ * @return the dsl builder
+ */
+ default AdvancedXsltSaxonEndpointBuilder secureProcessing(boolean
secureProcessing) {
+ doSetProperty("secureProcessing", secureProcessing);
+ return this;
+ }
+ /**
+ * Feature for XML secure processing (see javax.xml.XMLConstants). This
+ * is enabled by default. However, when using Saxon Professional you
may
+ * need to turn this off to allow Saxon to be able to use Java
extension
+ * functions. Note that turning it off also restores the previous,
+ * unrestricted parsing of a Source message body that is still to be
+ * parsed, so only do so for trusted input.
+ *
+ * The option will be converted to a <code>boolean</code> type.
+ *
+ * Default: true
+ * Group: security
+ *
+ * @param secureProcessing the value to set
+ * @return the dsl builder
+ */
+ default AdvancedXsltSaxonEndpointBuilder secureProcessing(String
secureProcessing) {
+ doSetProperty("secureProcessing", secureProcessing);
+ return this;
+ }
}
public interface XsltSaxonBuilders {
