[
https://issues.apache.org/jira/browse/CAMEL-24451?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Claus Ibsen resolved CAMEL-24451.
---------------------------------
Resolution: Fixed
Merged to main for 4.23.0 via https://github.com/apache/camel/pull/26904
(commit e65fd915f6fd0be99da1186216a79a65104149cb).
_Claude Code on behalf of davsclaus_
> camel-xslt - all headers are bound as stylesheet parameters and
> XsltUriResolver bypasses the JAXP external-access limits
> ------------------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24451
> URL: https://issues.apache.org/jira/browse/CAMEL-24451
> Project: Camel
> Issue Type: Bug
> Components: camel-xslt
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.23.0
>
>
> Two behaviours in {{XsltBuilder.configureTransformer()}} combine:
> 1. Every exchange property, message header and variable is bound as an XSLT
> parameter, with no opt-in. Message headers therefore silently shadow
> {{xsl:param}} defaults in the stylesheet.
> 2. {{XsltUriResolver}} is always installed. JAXP consults
> {{ACCESS_EXTERNAL_DTD}} / {{ACCESS_EXTERNAL_STYLESHEET}} only when no
> {{URIResolver}} returns a {{Source}}, so the resolver re-enables resolution
> of {{classpath:}}, {{file:}}, {{http:}}, {{ref:}} and {{bean:}} URIs
> regardless of those settings.
> Where a stylesheet uses a parameter inside {{document()}} - a normal pattern
> - a message header decides what the transform reads. The stylesheet author
> never asked for header binding, and the operator's external-access
> configuration does not apply.
> Proposal: gate the automatic parameter binding behind an option (an explicit
> parameter list, or an {{allowParametersFromHeaders}} flag defaulting to
> false), and make {{XsltUriResolver}} honour the configured
> {{ACCESS_EXTERNAL_*}} values rather than sitting in front of them. Both are
> behaviour changes and need upgrade-guide entries.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
