Andrea Cosentino created CAMEL-24677:
----------------------------------------
Summary: camel-smooks: align XML reader configuration with the
other XML components
Key: CAMEL-24677
URL: https://issues.apache.org/jira/browse/CAMEL-24677
Project: Camel
Issue Type: Improvement
Components: camel-smooks
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
When the Smooks data format and the Smooks component parse XML input, the
underlying SAX reader (Woodstox, resolved through Smooks) is used with its
default feature configuration. The other Camel components that parse XML
explicitly configure their parser factories/readers with secure defaults —
disabling external general and parameter entities, restricting DTD handling,
and enabling secure processing — but camel-smooks applies no such configuration.
This issue is to bring camel-smooks in line with the XML reader configuration
already applied across the other XML-handling components, so the behaviour is
consistent project-wide.
Affected classes:
* org.apache.camel.dataformat.smooks.SmooksDataFormat (unmarshal path)
* org.apache.camel.component.smooks.SmooksProcessor (process path)
Reference implementations that already apply secure XML reader/factory
configuration:
* camel-xmlsecurity — XmlSignatureHelper
* camel-schematron — SchematronProcessorFactory
* camel-xslt-saxon — XsltSaxonEndpoint
* camel-jaxb — JaxbDataFormat
* camel-cm-sms — CMSenderOneMessageImpl
Implementation note: the SAX reader used by Smooks is Woodstox
(com.ctc.wstx.sax.WstxSAXParser), which does not recognise the Xerces
"disallow-doctype-decl" feature that the other components rely on. The
equivalent controls on Woodstox are the "external-general-entities" /
"external-parameter-entities" SAX features and the StAX supportDTD property, so
the configuration has to be applied in a parser-aware way (or by supplying a
preconfigured reader). A configuration option to re-enable DTD/entity
processing should remain available for legacy EDI configurations that depend on
it.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
