oscerd opened a new pull request, #25594: URL: https://github.com/apache/camel/pull/25594
Fixes [CAMEL-24416](https://issues.apache.org/jira/browse/CAMEL-24416). ## Problem `XmlConverter` holds two factory builders whose hardening has drifted apart. | | `createDocumentBuilderFactory()` | `createSAXParserFactory()` | |---|---|---| | `FEATURE_SECURE_PROCESSING` | ✅ | ✅ | | `external-general-entities=false` | ✅ | ✅ | | `disallow-doctype-decl=true` | ✅ | ✖ | | `external-parameter-entities=false` | — | ✖ | | `load-external-dtd=false` | — | ✖ | | Xerces security manager | ✅ | ✖ | | `setupFeatures()` (system-property tuning) | ✅ | ✖ | Both are reachable from a converted message body — `toSAXSource` is a registered converter and the SAXSource route is tried first for bodies reaching camel-xslt — so the two should not disagree about external resource resolution. ## Change Adds the two features that close the difference: ``` http://xml.org/sax/features/external-parameter-entities = false http://apache.org/xml/features/nonvalidating/load-external-dtd = false ``` ## What I deliberately did *not* do, and why - **`disallow-doctype-decl` is not set here.** The DOM factory sets it, and adding it would make the two identical — but it would reject documents carrying an internal DTD subset that parse today. That is a separate, breaking decision and belongs in its own change with an upgrade-guide entry. - **`setupFeatures()` is not reused.** It looks like the obvious route to parity, but it is `DocumentBuilderFactory`-typed and driven by the `DOCUMENT_BUILDER_FACTORY_FEATURE` system-property namespace. Applying it to a SAX factory would be wrong, not merely inconvenient. - **The Xerces security-manager attribute is DOM-only** for the same reason — `SAXParserFactory` has no `setAttribute` equivalent. Worth a follow-up if wanted. ## Tests `SaxParserFactoryHardeningTest` asserts the **factory configuration** rather than parse behaviour, on purpose: whether a given JDK would have resolved the external resource anyway varies by version, so configuration is what Camel can state and keep. Verified it catches the regression — with the change reverted, `saxFactoryBlocksExternalResourceResolution` fails with *"Expecting value to be false but was true"*. ``` mvn test -Dtest=SaxParserFactoryHardeningTest # 2 passed mvn clean install -DskipTests # full reactor, BUILD SUCCESS ``` ## Backport The two added features do not reject anything that parses today, so this is **backport-safe to camel-4.22.x / 4.18.x / 4.14.x**. Continues the parser-consistency work in CAMEL-24299. --- _Claude Code on behalf of -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
