shashank created CAMEL-26086:
--------------------------------
Summary: camel-stax - xtokenize mode 't' returns undecoded markup
and loses CDATA, and modes 'i' and 'u' cut the start tag at a '>' inside an
attribute value
Key: CAMEL-26086
URL: https://issues.apache.org/jira/browse/CAMEL-26086
Project: Camel
Issue Type: Bug
Components: camel-stax
Reporter: shashank
Assignee: shashank
{{XMLTokenExpressionIterator}} (the {{xtokenize}} language, main 6a2f66ddec3e)
builds the token of a mode from the raw text of the matched element, in two
places not as an XML parser reads it. Valid XML then gives wrong tokens without
an error.
* Mode {{t}} ("extracting the text content of the specified element") copies
the characters between each {{>}} and the next {{<}}: {{<order>AT&T
<5></order>}} gives {{AT&T <5>}} instead of {{AT&T <5>}}, and
{{<order><![CDATA[a<b]]></order>}} gives an empty string. With a {{group}}
above 1 the {{<group>}} element can get a stray {{]]>}} and is no longer XML.
* Modes {{i}} (default) and {{u}} take the start tag up to the first {{>}},
which can be inside a quoted attribute value. Mode {{i}} then inserts the
inherited namespace declarations inside the attribute: {{<orders
xmlns='urn:orders'><order note='qty > 5'>1</order></orders>}} with
{{xtokenize("//o:order")}} gives {{<order note='qty xmlns="urn:orders">
5'>1</order>}}: the element loses its namespace and {{note}} changes. In mode
{{u}} the content starts with the rest of the start tag.
*Fix*: mode {{t}} reads the text of the token with a StAX reader (no DTD, no
external entities, coalescing, not namespace aware as the token may use
prefixes of its ancestors): entity references decoded, CDATA included, comments
and PIs left out; in a group the texts are escaped as XML text. Modes {{i}} and
{{u}} find the end of the start tag with a quote-aware scan. Upgrade guide 4.24
entry for the text mode.
*Tests*: new {{XMLTokenizeTextAndStartTagTest}}, 6 tests, all fail on main, for
example {{Expected: <AT&T <5>> but was: <AT&T <5>>}}, {{Expected:
<a<b> but was: <>}}, {{expected: <urn:orders> but was: <null>}}. Unit tests of
camel-stax with the fix: 116 run, 0 failures, 2 skipped. A differential run
against a namespace-aware DOM parser on 20,000 generated documents (together
with the related xtokenize fix for comments before the root and the wrap mode):
modes {{i}}, {{t}} and {{u}} agree with the parser on every document.
*Related*: a document starting with a comment or doctype without an XML
declaration fails in every mode, and mode {{w}} with matches at different
depths throws {{IndexOutOfBoundsException}}: separate issue.
*How it was found*: a reference differential of {{xtokenize}} against a DOM
parser.
*Affected*: main, camel-4.23.x, camel-4.22.x, camel-4.18.x and camel-4.14.x
(same code). Read, not run. The fix uses {{EscapeHelper.xml}} (CAMEL-24802),
which camel-4.22.x and older do not have.
_Filed with Claude Code on behalf of allthingssecurity._
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
