[
https://issues.apache.org/jira/browse/CAMEL-24691?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18114316#comment-18114316
]
Andrea Cosentino commented on CAMEL-24691:
------------------------------------------
PR (draft): https://github.com/apache/camel/pull/26344
_Claude Code on behalf of oscerd_
> camel-saxon - align XQueryBuilder with secure XML parsing defaults
> ------------------------------------------------------------------
>
> Key: CAMEL-24691
> URL: https://issues.apache.org/jira/browse/CAMEL-24691
> Project: Camel
> Issue Type: Bug
> Components: camel-saxon
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.23.0
>
>
> XQueryBuilder builds its default Saxon Configuration in XQueryBuilder.init()
> with only a space-stripping ParseOptions. Unlike camel-xslt-saxon (which
> defaults secureProcessing=true) and Camel's own XmlConverter, it does not
> configure the underlying XML parser features. As a result, when a message
> body reaches Saxon as an already-built javax.xml.transform.Source, it is
> parsed using the parser defaults rather than Camel's hardened ones. This is
> inconsistent with the String/byte[]/InputStream body paths (which are already
> hardened via XmlConverter) and with the recent camel-xpath change in
> CAMEL-24475.
> Configure the standard secure parser features on the default Configuration's
> ParseOptions:
> * http://apache.org/xml/features/disallow-doctype-decl = true
> * http://xml.org/sax/features/external-general-entities = false
> * http://xml.org/sax/features/external-parameter-entities = false
> * http://apache.org/xml/features/nonvalidating/load-external-dtd = false
> This aligns the Source body path with the already-hardened converter paths
> and with camel-xslt-saxon. A unit test is added, and an upgrade-guide note is
> included since Source-typed input that contains a DOCTYPE will now be
> rejected.
> Affected: components/camel-saxon (XQueryBuilder). To be backported to
> camel-4.22.x and camel-4.18.x.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
