Andrea Cosentino created CAMEL-25827:
----------------------------------------
Summary: camel-xslt-saxon - apply endpoint factory settings to the
aggregation strategy
Key: CAMEL-25827
URL: https://issues.apache.org/jira/browse/CAMEL-25827
Project: Camel
Issue Type: Bug
Components: camel-xslt
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
Fix For: 4.24.0, 4.22.3, 4.18.6
h3. Current behaviour
{{XsltSaxonAggregationStrategy}} creates a plain
{{net.sf.saxon.TransformerFactoryImpl}} in its constructor and passes it to
{{setTransformerFactory(...)}}. {{XsltAggregationStrategy.doInit()}} hands that
factory to {{XsltBuilder.setTransformerFactory(...)}}, which stores it
unchanged. The factory the strategy transforms with therefore keeps the Saxon
defaults:
* {{XMLConstants.FEATURE_SECURE_PROCESSING}} is not set;
* {{XMLConstants.ACCESS_EXTERNAL_DTD}} and
{{XMLConstants.ACCESS_EXTERNAL_STYLESHEET}} are not set.
The other ways to run a stylesheet in {{camel-xslt}} and {{camel-xslt-saxon}}
configure the factory they create:
* {{XsltSaxonEndpoint.createXsltBuilder()}} calls
{{XsltSaxonHelper.configureSecureProcessing(factory, secureProcessing)}} (the
{{secureProcessing}} option defaults to {{true}}) and sets
{{ACCESS_EXTERNAL_DTD}} and {{ACCESS_EXTERNAL_STYLESHEET}} to an empty string;
* when no factory is configured, the {{xslt}} endpoint and the
{{XsltAggregationStrategy}} of {{camel-xslt}} use
{{XMLConverterHelper.createTransformerFactory()}}, which applies the same three
settings.
The same stylesheet therefore runs with different factory settings depending on
whether it is used from an {{xslt-saxon}} endpoint or from
{{XsltSaxonAggregationStrategy}}.
h3. Proposed change
* {{XsltSaxonHelper}}: add one method (for example
{{configureTransformerFactory(...)}}) that applies what {{XsltSaxonEndpoint}}
applies today: {{configureSecureProcessing(...)}} with the given flag, then
{{ACCESS_EXTERNAL_DTD}} and {{ACCESS_EXTERNAL_STYLESHEET}} set to an empty
string, ignoring an {{IllegalArgumentException}} from {{setAttribute}} as the
endpoint does now.
* {{XsltSaxonAggregationStrategy}}: pass the {{TransformerFactoryImpl}} created
in the constructor through that method, with secure processing enabled, before
calling {{setTransformerFactory(...)}}.
* {{XsltSaxonEndpoint.createXsltBuilder()}}: call the same method instead of
the inline code, so that the endpoint and the strategy share one
implementation. The endpoint behaves as before: the {{secureProcessing}} option
is still honoured, the {{transformerFactoryConfigurationStrategy}} and
{{xpathTotalOpLimit}} steps stay where they are, and a factory the user
supplies is still used as given.
* Make sure the settings are in effect for the whole transformation, including
the parsing of the input document, for every message body type the strategy
accepts, and not only on the factory object. The tests below check this; where
a step does not pick the settings up from the factory, configure that step the
same way, in the strategy and in the endpoint.
* A {{TransformerFactory}} set on the strategy with
{{setTransformerFactory(...)}} is still used as given.
* No option is added or changed, so the catalog and the DSLs do not change.
h3. Maintenance branches
* camel-4.22.x: same code as main, the change applies as is.
* camel-4.18.x: the {{xslt-saxon}} endpoint does not apply these settings yet
(it sets {{FEATURE_SECURE_PROCESSING}} only when {{saxonExtensionFunctions}} is
configured, and it does not set {{ACCESS_EXTERNAL_DTD}} or
{{ACCESS_EXTERNAL_STYLESHEET}}), and {{XsltSaxonHelper}} differs from main. The
change is made directly on that branch and applies the helper to both the
strategy and the endpoint, which {{camel-xj}} extends.
h3. Behaviour after the change
{{XsltSaxonAggregationStrategy}} transforms with a factory configured like the
one an {{xslt-saxon}} endpoint creates with its default options, on every
supported branch. A route that needs different factory settings can still set
its own {{TransformerFactory}} on the strategy with
{{setTransformerFactory(...)}}. The upgrade guide will describe the change.
h3. Tests
In {{components/camel-xslt-saxon}}, using JUnit assertions like the other tests
of the module:
* a new test (for example {{XsltSaxonAggregationStrategyConfigurationTest}})
checking that the factory used by {{XsltSaxonAggregationStrategy}} has
{{FEATURE_SECURE_PROCESSING}} enabled and {{ACCESS_EXTERNAL_DTD}} and
{{ACCESS_EXTERNAL_STYLESHEET}} set to an empty string, the same values as the
factory {{XsltSaxonEndpoint}} creates;
* a route test that runs an aggregation with the strategy, with message bodies
of the different types it accepts, and checks that the settings are in effect
during the transformation itself, not only on the factory object; the same
check for the {{xslt-saxon}} endpoint;
* the existing tests of the module, including {{XsltAggregationStrategyTest}},
keep passing.
----
_Claude Code on behalf of [~acosentino]_
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
