[
https://issues.apache.org/jira/browse/CAMEL-24416?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18108195#comment-18108195
]
Andrea Cosentino commented on CAMEL-24416:
------------------------------------------
Merged to main: https://github.com/apache/camel/pull/25594
_Claude Code on behalf of oscerd_
> camel-core - XmlConverter SAX parser factory is configured more permissively
> than the DOM factory in the same class
> -------------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24416
> URL: https://issues.apache.org/jira/browse/CAMEL-24416
> Project: Camel
> Issue Type: Improvement
> Components: camel-core
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.23.0
>
>
> XmlConverter contains two factory builders whose hardening has drifted apart.
> createDocumentBuilderFactory() (line 1020) sets:
> * FEATURE_SECURE_PROCESSING = true
> * http://apache.org/xml/features/disallow-doctype-decl = true
> * http://xml.org/sax/features/external-general-entities = false
> * the Xerces security manager when that class is present
> * and then applies setupFeatures() so system properties can tune it further
> createSAXParserFactory() (line 1193) sets only:
> * FEATURE_SECURE_PROCESSING = true
> * http://xml.org/sax/features/external-general-entities = false
> It does not set load-external-dtd or external-parameter-entities, does not
> install the Xerces security manager, and does not call setupFeatures().
> toSAXSource() is a registered converter, and camel-xslt reaches for the
> SAXSource route first, so the looser factory is on a commonly used path.
> Proposal: bring createSAXParserFactory() in line with the DOM factory. The
> conservative form - adding
> http://xml.org/sax/features/external-parameter-entities = false
> http://apache.org/xml/features/nonvalidating/load-external-dtd = false
> plus the setupFeatures() call - closes the external-resource resolution
> difference without rejecting documents that carry an internal DTD subset, so
> it should be backport-safe. Adding disallow-doctype-decl on top would match
> the DOM factory exactly but would reject documents that parse today, so if it
> is wanted it belongs on main with an upgrade-guide entry.
> Continues the parser-consistency work in CAMEL-24299.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
