[
https://issues.apache.org/jira/browse/CAMEL-24677?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Andrea Cosentino updated CAMEL-24677:
-------------------------------------
Fix Version/s: 4.22.1
> camel-smooks: align XML reader configuration with the other XML components
> --------------------------------------------------------------------------
>
> Key: CAMEL-24677
> URL: https://issues.apache.org/jira/browse/CAMEL-24677
> Project: Camel
> Issue Type: Improvement
> Components: camel-smooks
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.22.1, 4.23.0
>
>
> When the Smooks data format and the Smooks component parse XML input, the
> underlying SAX reader (Woodstox, resolved through Smooks) is used with its
> default feature configuration. The other Camel components that parse XML
> explicitly configure their parser factories/readers with secure defaults —
> disabling external general and parameter entities, restricting DTD handling,
> and enabling secure processing — but camel-smooks applies no such
> configuration.
> This issue is to bring camel-smooks in line with the XML reader configuration
> already applied across the other XML-handling components, so the behaviour is
> consistent project-wide.
> Affected classes:
> * org.apache.camel.dataformat.smooks.SmooksDataFormat (unmarshal path)
> * org.apache.camel.component.smooks.SmooksProcessor (process path)
> Reference implementations that already apply secure XML reader/factory
> configuration:
> * camel-xmlsecurity — XmlSignatureHelper
> * camel-schematron — SchematronProcessorFactory
> * camel-xslt-saxon — XsltSaxonEndpoint
> * camel-jaxb — JaxbDataFormat
> * camel-cm-sms — CMSenderOneMessageImpl
> Implementation note: the SAX reader used by Smooks is Woodstox
> (com.ctc.wstx.sax.WstxSAXParser), which does not recognise the Xerces
> "disallow-doctype-decl" feature that the other components rely on. The
> equivalent controls on Woodstox are the "external-general-entities" /
> "external-parameter-entities" SAX features and the StAX supportDTD property,
> so the configuration has to be applied in a parser-aware way (or by supplying
> a preconfigured reader). A configuration option to re-enable DTD/entity
> processing should remain available for legacy EDI configurations that depend
> on it.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
