[
https://issues.apache.org/jira/browse/CAMEL-24605?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on CAMEL-24605 started by Andrea Cosentino.
------------------------------------------------
> camel-fop: align FopProducer XML transformation with Camel's standard secure
> XML processing configuration
> ---------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24605
> URL: https://issues.apache.org/jira/browse/CAMEL-24605
> Project: Camel
> Issue Type: Improvement
> Components: camel-fop
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
>
> FopProducer builds a javax.xml.transform.TransformerFactory that only enables
> FEATURE_SECURE_PROCESSING before transforming the incoming message body.
> Camel's standard XML processing utilities (for example
> org.apache.camel.converter.jaxp.XmlConverter) configure the factory more
> completely by also restricting external resource access via
> XMLConstants.ACCESS_EXTERNAL_DTD and XMLConstants.ACCESS_EXTERNAL_STYLESHEET
> (set to an empty string).
> For consistency and robustness across the codebase, FopProducer should apply
> the same standard configuration when creating its TransformerFactory.
> Affected code:
> components/camel-fop/src/main/java/org/apache/camel/component/fop/FopProducer.java
> (transform method).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
