oscerd opened a new pull request, #25320: URL: https://github.com/apache/camel/pull/25320
## Backport of #25279 Cherry-pick of #25279 onto `camel-4.18.x` (clean, no conflicts). **Original PR:** #25279 — CAMEL-24299: disable DTD support in XmlStreamDetector for consistency with other XML parsers **Original author:** @oscerd **Target branch:** `camel-4.18.x` ### What `XmlStreamDetector` created its StAX `XMLInputFactory` with `IS_SUPPORTING_EXTERNAL_ENTITIES=false` but left `SUPPORT_DTD` at its default. This adds `factory.setProperty(XMLInputFactory.SUPPORT_DTD, Boolean.FALSE)`, for consistency with `XmlConverter` / `StaxConverter`, as defence-in-depth against DTD-based attacks (e.g. entity-expansion DoS). Non-breaking: Camel route XML does not use DTDs. Sanity build: full-reactor `mvn clean install -DskipTests` green on `camel-4.18.x`; `XmlStreamDetectorTest` (7 tests incl. the DTD-rejection case) passes. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
