(camel) branch camel-4.18.x updated: CAMEL-24299: camel-core - disable DTD support in XmlStreamDetector (#25320)

[acosentino]

This is an automated email from the ASF dual-hosted git repository.

oscerd pushed a commit to branch camel-4.18.x
in repository https://gitbox.apache.org/repos/asf/camel.git


The following commit(s) were added to refs/heads/camel-4.18.x by this push:
     new f4dce1f396ee CAMEL-24299: camel-core - disable DTD support in 
XmlStreamDetector (#25320)
f4dce1f396ee is described below

commit f4dce1f396eede57b693967c9df6a41280c22f8d
Author: Andrea Cosentino <anco...@gmail.com>
AuthorDate: Tue Aug 4 12:24:46 2026 +0200

    CAMEL-24299: camel-core - disable DTD support in XmlStreamDetector (#25320)
    
    Backport to camel-4.18.x. Sets SUPPORT_DTD=false on the StAX input factory 
used by XmlStreamDetector so DTD processing is disabled when detecting the 
encoding/root of an XML stream, hardening the detector against XXE and 
DTD-based denial-of-service on untrusted input.
    
    Co-authored-by: Claude Opus 4.8 <nore...@anthropic.com>
    Signed-off-by: Andrea Cosentino <anco...@gmail.com>
---
 .../java/org/apache/camel/xml/io/util/XmlStreamDetector.java |  2 ++
 .../org/apache/camel/xml/io/util/XmlStreamDetectorTest.java  | 12 ++++++++++++
 2 files changed, 14 insertions(+)

diff --git 
a/core/camel-xml-io-util/src/main/java/org/apache/camel/xml/io/util/XmlStreamDetector.java
 
b/core/camel-xml-io-util/src/main/java/org/apache/camel/xml/io/util/XmlStreamDetector.java
index 379802a6703d..ce20246c707d 100644
--- 
a/core/camel-xml-io-util/src/main/java/org/apache/camel/xml/io/util/XmlStreamDetector.java
+++ 
b/core/camel-xml-io-util/src/main/java/org/apache/camel/xml/io/util/XmlStreamDetector.java
@@ -67,6 +67,8 @@ public class XmlStreamDetector {
             XMLInputFactory factory = XMLInputFactory.newInstance();
             factory.setProperty(XMLInputFactory.IS_COALESCING, Boolean.TRUE);
             
factory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, 
Boolean.FALSE);
+            // disable DTD support for consistency with XmlConverter / 
StaxConverter (defends against DTD-based attacks)
+            factory.setProperty(XMLInputFactory.SUPPORT_DTD, Boolean.FALSE);
             reader = factory.createXMLStreamReader(xmlStream);
         } catch (XMLStreamException e) {
             information.problem = e;
diff --git 
a/core/camel-xml-io-util/src/test/java/org/apache/camel/xml/io/util/XmlStreamDetectorTest.java
 
b/core/camel-xml-io-util/src/test/java/org/apache/camel/xml/io/util/XmlStreamDetectorTest.java
index adaa245a1652..3188ea07d83d 100644
--- 
a/core/camel-xml-io-util/src/test/java/org/apache/camel/xml/io/util/XmlStreamDetectorTest.java
+++ 
b/core/camel-xml-io-util/src/test/java/org/apache/camel/xml/io/util/XmlStreamDetectorTest.java
@@ -133,4 +133,16 @@ public class XmlStreamDetectorTest {
         assertEquals("http://www.w3.org/2001/XMLSchema-instance";, 
info.getNamespaces().get("xsi"));
     }
 
+    @Test
+    void documentWithDoctypeIsRejected() throws IOException {
+        // SUPPORT_DTD=false: a DOCTYPE declaration is not processed, so the 
stream is reported invalid rather than
+        // expanding any DTD-defined entities (CAMEL-24299)
+        String xml = "<?xml version=\"1.0\"?>\n"
+                     + "<!DOCTYPE root [ <!ENTITY x \"expanded\"> ]>\n"
+                     + "<root>&x;</root>";
+        XmlStreamDetector detector
+                = new XmlStreamDetector(new 
ByteArrayInputStream(xml.getBytes(StandardCharsets.UTF_8)));
+        assertFalse(detector.information().isValid());
+    }
+
 }