Claus Ibsen created CAMEL-26498:
-----------------------------------
Summary: camel-xml-jaxp - stream caching a SAXSource that has no
XMLReader should parse with the secure XMLReader
Key: CAMEL-26498
URL: https://issues.apache.org/jira/browse/CAMEL-26498
Project: Camel
Issue Type: Improvement
Components: camel-core
Reporter: Claus Ibsen
Assignee: Claus Ibsen
Fix For: 4.24.0
With stream caching on, StreamSourceConverter.convertToStreamCache(SAXSource)
turns the SAXSource into a String with XmlConverter and a Transformer. When the
SAXSource carries an XMLReader, that reader is used. The SAXSource instances
that Camel creates (XmlConverter.toSAXSource from String, bytes, InputStream,
File, Path) carry the secure XMLReader from XMLReaderPool, so they are fine.
A SAXSource that has no XMLReader (for example new SAXSource(new
InputSource(...)) created in a route, or XmlConverter.toSAXSourceFromStream
when the SAX parser could not be created) is parsed by the default parser of
the TransformerFactory, which may not have the same secure settings (depending
on the JAXP implementation on the classpath).
Hardening: when the SAXSource has no XMLReader, set the secure XMLReader of
XmlConverter (createSAXParserFactory / XMLReaderPool) before the transform, so
stream caching parses every SAXSource with the same secure settings. This is
defence in depth for route-provided sources; it is not reachable from message
data sent by external clients.
_Claude Code on behalf of Claus Ibsen (davsclaus)_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
