Andrea Cosentino created CAMEL-24416:
----------------------------------------
Summary: camel-core - XmlConverter SAX parser factory is
configured more permissively than the DOM factory in the same class
Key: CAMEL-24416
URL: https://issues.apache.org/jira/browse/CAMEL-24416
Project: Camel
Issue Type: Improvement
Components: camel-core
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
Fix For: 4.23.0
XmlConverter contains two factory builders whose hardening has drifted apart.
createDocumentBuilderFactory() (line 1020) sets:
* FEATURE_SECURE_PROCESSING = true
* http://apache.org/xml/features/disallow-doctype-decl = true
* http://xml.org/sax/features/external-general-entities = false
* the Xerces security manager when that class is present
* and then applies setupFeatures() so system properties can tune it further
createSAXParserFactory() (line 1193) sets only:
* FEATURE_SECURE_PROCESSING = true
* http://xml.org/sax/features/external-general-entities = false
It does not set load-external-dtd or external-parameter-entities, does not
install the Xerces security manager, and does not call setupFeatures().
toSAXSource() is a registered converter, and camel-xslt reaches for the
SAXSource route first, so the looser factory is on a commonly used path.
Proposal: bring createSAXParserFactory() in line with the DOM factory. The
conservative form - adding
http://xml.org/sax/features/external-parameter-entities = false
http://apache.org/xml/features/nonvalidating/load-external-dtd = false
plus the setupFeatures() call - closes the external-resource resolution
difference without rejecting documents that carry an internal DTD subset, so it
should be backport-safe. Adding disallow-doctype-decl on top would match the
DOM factory exactly but would reject documents that parse today, so if it is
wanted it belongs on main with an upgrade-guide entry.
Continues the parser-consistency work in CAMEL-24299.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
