(camel) branch main updated: CAMEL-24299: disable DTD support in XmlStreamDetector for consistency with other XML parsers (#25279)

[acosentino]

This is an automated email from the ASF dual-hosted git repository.

oscerd pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git


The following commit(s) were added to refs/heads/main by this push:
     new a746e8ea958e CAMEL-24299: disable DTD support in XmlStreamDetector for 
consistency with other XML parsers (#25279)
a746e8ea958e is described below

commit a746e8ea958ef2451a2b3505cddaba676e512fbe
Author: Andrea Cosentino <anco...@gmail.com>
AuthorDate: Mon Aug 3 09:44:47 2026 +0200

    CAMEL-24299: disable DTD support in XmlStreamDetector for consistency with 
other XML parsers (#25279)
    
    XmlStreamDetector created its StAX XMLInputFactory with 
IS_SUPPORTING_EXTERNAL_ENTITIES=false
    but left SUPPORT_DTD at its default. For consistency with XmlConverter / 
StaxConverter (which
    disable DTDs) and as defence-in-depth against DTD-based attacks (e.g. 
entity-expansion DoS), set
    XMLInputFactory.SUPPORT_DTD=false. External entities were already blocked; 
the detector only
    pre-scans XML to determine the root element, so rejecting DTD-bearing input 
is safe.
    
    Co-authored-by: Claude Opus 4.8 <nore...@anthropic.com>
---
 .../java/org/apache/camel/xml/io/util/XmlStreamDetector.java |  2 ++
 .../org/apache/camel/xml/io/util/XmlStreamDetectorTest.java  | 12 ++++++++++++
 2 files changed, 14 insertions(+)

diff --git 
a/core/camel-xml-io-util/src/main/java/org/apache/camel/xml/io/util/XmlStreamDetector.java
 
b/core/camel-xml-io-util/src/main/java/org/apache/camel/xml/io/util/XmlStreamDetector.java
index 379802a6703d..ce20246c707d 100644
--- 
a/core/camel-xml-io-util/src/main/java/org/apache/camel/xml/io/util/XmlStreamDetector.java
+++ 
b/core/camel-xml-io-util/src/main/java/org/apache/camel/xml/io/util/XmlStreamDetector.java
@@ -67,6 +67,8 @@ public class XmlStreamDetector {
             XMLInputFactory factory = XMLInputFactory.newInstance();
             factory.setProperty(XMLInputFactory.IS_COALESCING, Boolean.TRUE);
             
factory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, 
Boolean.FALSE);
+            // disable DTD support for consistency with XmlConverter / 
StaxConverter (defends against DTD-based attacks)
+            factory.setProperty(XMLInputFactory.SUPPORT_DTD, Boolean.FALSE);
             reader = factory.createXMLStreamReader(xmlStream);
         } catch (XMLStreamException e) {
             information.problem = e;
diff --git 
a/core/camel-xml-io-util/src/test/java/org/apache/camel/xml/io/util/XmlStreamDetectorTest.java
 
b/core/camel-xml-io-util/src/test/java/org/apache/camel/xml/io/util/XmlStreamDetectorTest.java
index adaa245a1652..3188ea07d83d 100644
--- 
a/core/camel-xml-io-util/src/test/java/org/apache/camel/xml/io/util/XmlStreamDetectorTest.java
+++ 
b/core/camel-xml-io-util/src/test/java/org/apache/camel/xml/io/util/XmlStreamDetectorTest.java
@@ -133,4 +133,16 @@ public class XmlStreamDetectorTest {
         assertEquals("http://www.w3.org/2001/XMLSchema-instance";, 
info.getNamespaces().get("xsi"));
     }
 
+    @Test
+    void documentWithDoctypeIsRejected() throws IOException {
+        // SUPPORT_DTD=false: a DOCTYPE declaration is not processed, so the 
stream is reported invalid rather than
+        // expanding any DTD-defined entities (CAMEL-24299)
+        String xml = "<?xml version=\"1.0\"?>\n"
+                     + "<!DOCTYPE root [ <!ENTITY x \"expanded\"> ]>\n"
+                     + "<root>&x;</root>";
+        XmlStreamDetector detector
+                = new XmlStreamDetector(new 
ByteArrayInputStream(xml.getBytes(StandardCharsets.UTF_8)));
+        assertFalse(detector.information().isValid());
+    }
+
 }