davsclaus opened a new pull request, #29150: URL: https://github.com/apache/camel/pull/29150
_Claude Code on behalf of davsclaus_ JIRA: https://issues.apache.org/jira/browse/CAMEL-26282 ## Problem When a Flowable event registry inbound channel of type `camel` uses `deserializerType: xml`, the `flowable:` producer hands the message body to Flowable's `StringToXmlDocumentDeserializer`. In Flowable 7.x (Camel ships 7.2.0) that class builds a `DocumentBuilderFactory` with the JDK default settings, unlike the XML parsing elsewhere in Camel and unlike Flowable 8, which configures the factory explicitly. Camel stays on Flowable 7.2.0 for now (Flowable 8 needs Jackson 3, see CAMEL-23143). ## Change - New `CamelStringToXmlDocumentDeserializer`, extending Flowable's `StringToXmlDocumentDeserializer`. It parses with: secure processing on, external general and parameter entities off, external DTD loading and DTD grammar loading off, entity references kept as nodes, XInclude off, and `ACCESS_EXTERNAL_DTD` / `ACCESS_EXTERNAL_SCHEMA` empty. Each feature or attribute is set in a try/catch for parser implementations that do not support it. No new dependency. - `FlowableProducer`: before `eventReceived`, when the channel's pipeline is a `DefaultInboundEventProcessingPipeline` whose deserializer is exactly `StringToXmlDocumentDeserializer` (class equality), it is replaced with the Camel deserializer. A channel with its own `deserializerDelegateExpression` keeps its deserializer. Doing it in the producer keeps it independent of the order of Flowable's channel model processors and also covers redeployed channels. - `flowable-component.adoc`: a short "XML events" section (and the catalog doc copy). - Upgrade guide notes on main for 4.24, 4.22.3 and 4.18.6: an xml event that relies on an external DTD or an external entity no longer gets their content. ## Tests - `FlowableInboundXmlChannelTest` (new xml channel, event and process definitions; there was no xml channel test before): - `xmlEventStartsProcessWithMappedVariables`: an XML body starts the process with the mapped variables. - `xmlChannelUsesCamelXmlDeserializer`: after a send, the channel pipeline uses the Camel deserializer. - `customXmlDeserializerIsKept`: a deserializer the channel already has (not the Flowable default) is kept and used. - `entityDeclaredInDoctypeIsNotExpandedFromFile`: an entity declared in the document type declaration and pointing at a file under `target/` does not put the file content into the mapped variable. - `CamelStringToXmlDocumentDeserializerTest`: plain XML is deserialized, an entity pointing at a file is not expanded, and a missing external DTD is not loaded. `xmlChannelUsesCamelXmlDeserializer` and `entityDeclaredInDoctypeIsNotExpandedFromFile` fail without the `FlowableProducer` change. All 14 tests of camel-flowable pass; `-Psourcecheck` is clean. Backports to camel-4.22.x and camel-4.18.x will follow (the 4.18.x doc hunk needs a manual port). 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
