[
https://issues.apache.org/jira/browse/CAMEL-26498?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18136743#comment-18136743
]
Claus Ibsen commented on CAMEL-26498:
-------------------------------------
PR: https://github.com/apache/camel/pull/28979
Stream caching now wraps a SAXSource without an XMLReader with the secure
XMLReader of XmlConverter (new XmlConverter.createXMLReader(), shared with
toSAXSourceFromStream). Test: a reader-less SAXSource with an external entity
in its DOCTYPE now caches as <test/> (entity skipped); before, with the JDK
TransformerFactory, stream caching failed on it. toSAXSourceFromStream still
returns a reader-less SAXSource with a WARN when the SAX parser cannot be
created (left as is, see the PR).
_Claude Code on behalf of Claus Ibsen (davsclaus)_
> camel-xml-jaxp - stream caching a SAXSource that has no XMLReader should
> parse with the secure XMLReader
> --------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-26498
> URL: https://issues.apache.org/jira/browse/CAMEL-26498
> Project: Camel
> Issue Type: Improvement
> Components: camel-core
> Reporter: Claus Ibsen
> Assignee: Claus Ibsen
> Priority: Minor
> Fix For: 4.24.0
>
>
> With stream caching on, StreamSourceConverter.convertToStreamCache(SAXSource)
> turns the SAXSource into a String with XmlConverter and a Transformer. When
> the SAXSource carries an XMLReader, that reader is used. The SAXSource
> instances that Camel creates (XmlConverter.toSAXSource from String, bytes,
> InputStream, File, Path) carry the secure XMLReader from XMLReaderPool, so
> they are fine.
> A SAXSource that has no XMLReader (for example new SAXSource(new
> InputSource(...)) created in a route, or XmlConverter.toSAXSourceFromStream
> when the SAX parser could not be created) is parsed by the default parser of
> the TransformerFactory, which may not have the same secure settings
> (depending on the JAXP implementation on the classpath).
> Hardening: when the SAXSource has no XMLReader, set the secure XMLReader of
> XmlConverter (createSAXParserFactory / XMLReaderPool) before the transform,
> so stream caching parses every SAXSource with the same secure settings. This
> is defence in depth for route-provided sources; it is not reachable from
> message data sent by external clients.
> _Claude Code on behalf of Claus Ibsen (davsclaus)_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
