[
https://issues.apache.org/jira/browse/CAMEL-24691?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18117962#comment-18117962
]
Andrea Cosentino commented on CAMEL-24691:
------------------------------------------
Backports are merged:
* camel-4.22.x -> https://github.com/apache/camel/pull/26728 (fix version
4.22.2 - note 4.22.1 is already released)
* camel-4.18.x -> https://github.com/apache/camel/pull/26730
Note: these did not come from the port/* labels. Those labels are not consumed
by any automation - PRs carrying them (e.g. #26450, #26456, #26476) sat for
days with no backport - so both were cherry-picked by hand. Each drops the
camel-4x-upgrade-guide-4_23.adoc hunk (upgrade guides for all lines live on
main) and the camel-4.18.x one uses test.junit5.CamelTestSupport to match that
branch. No production-code differences from main.
_Claude Code on behalf of oscerd_
> camel-saxon - align XQueryBuilder with secure XML parsing defaults
> ------------------------------------------------------------------
>
> Key: CAMEL-24691
> URL: https://issues.apache.org/jira/browse/CAMEL-24691
> Project: Camel
> Issue Type: Bug
> Components: camel-saxon
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.18.5, 4.22.2, 4.23.0
>
>
> XQueryBuilder builds its default Saxon Configuration in XQueryBuilder.init()
> with only a space-stripping ParseOptions. Unlike camel-xslt-saxon (which
> defaults secureProcessing=true) and Camel's own XmlConverter, it does not
> configure the underlying XML parser features. As a result, when a message
> body reaches Saxon as an already-built javax.xml.transform.Source, it is
> parsed using the parser defaults rather than Camel's hardened ones. This is
> inconsistent with the String/byte[]/InputStream body paths (which are already
> hardened via XmlConverter) and with the recent camel-xpath change in
> CAMEL-24475.
> Configure the standard secure parser features on the default Configuration's
> ParseOptions:
> * http://apache.org/xml/features/disallow-doctype-decl = true
> * http://xml.org/sax/features/external-general-entities = false
> * http://xml.org/sax/features/external-parameter-entities = false
> * http://apache.org/xml/features/nonvalidating/load-external-dtd = false
> This aligns the Source body path with the already-hardened converter paths
> and with camel-xslt-saxon. A unit test is added, and an upgrade-guide note is
> included since Source-typed input that contains a DOCTYPE will now be
> rejected.
> Affected: components/camel-saxon (XQueryBuilder). To be backported to
> camel-4.22.x and camel-4.18.x.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
