davsclaus opened a new pull request, #26168: URL: https://github.com/apache/camel/pull/26168
## Backport of #26108 Cherry-pick of #26108 onto `camel-4.22.x`. **Original PR:** #26108 - CAMEL-24605: align FopProducer XML transformation with Camel's standard secure XML processing configuration **Original author:** @oscerd **Target branch:** `camel-4.22.x` ### Original description `FopProducer` builds a `javax.xml.transform.TransformerFactory` that only enables `FEATURE_SECURE_PROCESSING` before transforming the incoming message body. This change also sets `ACCESS_EXTERNAL_DTD` and `ACCESS_EXTERNAL_STYLESHEET` to empty strings, matching the secure XML processing pattern used in `XmlConverter` and elsewhere in Camel. A new `FopExternalEntityTest` verifies the restriction is enforced using a real, readable DTD in a `@TempDir` — failure proves the access was blocked rather than relying on JDK error message text. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
