Claus Ibsen created CAMEL-26282:
-----------------------------------
Summary: camel-flowable - xml inbound channels parse events with
the Camel XML settings
Key: CAMEL-26282
URL: https://issues.apache.org/jira/browse/CAMEL-26282
Project: Camel
Issue Type: Improvement
Reporter: Claus Ibsen
Assignee: Claus Ibsen
Fix For: 4.24.0, 4.22.3, 4.18.6
When a Flowable event registry inbound channel of type {{camel}} uses
{{deserializerType: xml}}, the {{flowable:}} producer hands the message body to
Flowable's {{StringToXmlDocumentDeserializer}}. In Flowable 7.x that class
builds a {{DocumentBuilderFactory}} with the JDK default settings, unlike the
XML parsing elsewhere in Camel (for example {{XmlConverter}}) and unlike
Flowable 8, which configures the factory explicitly. Camel stays on Flowable
7.2.0 for now (Flowable 8 needs Jackson 3, see CAMEL-23143).
h3. Today
{{FlowableProducer}} passes the body unchanged to
{{InboundChannelModel.getInboundEventProcessingPipeline()}}, and the xml
pipeline parses it with the Flowable 7.x deserializer. DOCTYPE declarations,
external DTDs and XInclude are processed with the JDK defaults.
h3. After the change
Inbound camel channels with the xml deserializer parse the event with the same
settings Camel uses for its own XML parsing (and that Flowable 8 uses): secure
processing on, external general and parameter entities off, external DTD
loading off, entity reference expansion off, XInclude off, and
{{ACCESS_EXTERNAL_DTD}} / {{ACCESS_EXTERNAL_SCHEMA}} set to empty. A channel
that sets its own {{deserializerDelegateExpression}} keeps its own deserializer.
h3. Code change
* New
{{org.apache.camel.component.flowable.CamelStringToXmlDocumentDeserializer}},
extending Flowable's {{StringToXmlDocumentDeserializer}} and overriding
{{deserialize}} with a configured {{DocumentBuilderFactory}} (each feature or
attribute set in a try/catch for parser implementations that do not support
it). Inline, no new dependency.
* {{FlowableProducer}}: before {{eventReceived}}, when the channel's pipeline
is a {{DefaultInboundEventProcessingPipeline}} whose deserializer is exactly
{{StringToXmlDocumentDeserializer}} (class equality), replace it with the Camel
deserializer via {{setInboundEventDeserializer}}. Doing it in the producer
keeps it independent of the order of Flowable's channel model processors and
also covers redeployed channels.
* {{flowable-component.adoc}}: a note on how xml inbound channels are parsed
and that {{deserializerDelegateExpression}} selects a different parser;
regenerate the catalog doc copy.
* Upgrade guide notes for 4.24.0, 4.22.3 and 4.18.6: xml events that rely on a
DOCTYPE with external entities or an external DTD no longer have them loaded.
h3. Tests
* {{FlowableInboundXmlChannelTest#xmlEventStartsProcessWithMappedVariables}}: a
new xml channel and event definition; an XML body starts the process with the
mapped variables (there is no xml channel test today).
* {{FlowableInboundXmlChannelTest#xmlChannelUsesCamelXmlDeserializer}}: after a
send, the channel pipeline uses the Camel deserializer.
* {{FlowableInboundXmlChannelTest#customXmlDeserializerIsKept}}: a channel with
{{deserializerDelegateExpression}} keeps its own deserializer.
*
{{CamelStringToXmlDocumentDeserializerTest#entityDeclaredInDoctypeIsNotExpandedFromFile}}:
a body whose DOCTYPE declares an entity pointing at a file under {{target/}}
does not get the file content in the parsed document.
Related: CAMEL-26118 changes the same producer.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
