Andrea Cosentino created CAMEL-24605:
----------------------------------------
Summary: camel-fop: align FopProducer XML transformation with
Camel's standard secure XML processing configuration
Key: CAMEL-24605
URL: https://issues.apache.org/jira/browse/CAMEL-24605
Project: Camel
Issue Type: Improvement
Components: camel-fop
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
FopProducer builds a javax.xml.transform.TransformerFactory that only enables
FEATURE_SECURE_PROCESSING before transforming the incoming message body.
Camel's standard XML processing utilities (for example
org.apache.camel.converter.jaxp.XmlConverter) configure the factory more
completely by also restricting external resource access via
XMLConstants.ACCESS_EXTERNAL_DTD and XMLConstants.ACCESS_EXTERNAL_STYLESHEET
(set to an empty string).
For consistency and robustness across the codebase, FopProducer should apply
the same standard configuration when creating its TransformerFactory.
Affected code:
components/camel-fop/src/main/java/org/apache/camel/component/fop/FopProducer.java
(transform method).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
