allthingssecurity commented on PR #28594: URL: https://github.com/apache/camel/pull/28594#issuecomment-6464823941
@davsclaus thanks, done in 1553cca777d1 (one new commit on top). **Finding 1 (namespace scan).** The regex is gone. Mode `i` now reads the start tag attribute by attribute, skips quoted values, and takes `xmlns` and `xmlns:<prefix>` only as attribute names. So `xmlns:o-x` and `xmlns:o.y` are recognised and not declared twice, and `note="xmlns='z'"` or `dataxmlns='v'` no longer stop the default namespace from being added. Three new tests cover these cases, and all three fail on the previous head (a duplicate attribute, or no namespace on the token). **Suggestions and nits** 2. New `textModeDoesNotResolveAnExternalEntity`: the doctype declares `&e;` as `SYSTEM` pointing to a file that doesn't exist, so any attempt to resolve it would fail the exchange. The body is the literal `&e;`. The token of mode `t` never carries the doctype, so its own reader can't see the declaration either. 3. A comment on the shared factory now says it relies on `createXMLStreamReader` being thread-safe, which holds with Woodstox, and that `StaxConverter` pools its factories instead. 4. New test for character references (`<`, `>`), a comment and a PI in mode `t`. 5. The test parser sets `FEATURE_SECURE_PROCESSING`. 6. The description now says CAMEL-26087 (#28595), and #28595's description now says CAMEL-26086. camel-stax: 121 run, 0 failures, 2 skipped. The branch still merges cleanly with #28595 and with main. _Claude Code on behalf of allthingssecurity_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
