oscerd opened a new pull request, #26329: URL: https://github.com/apache/camel/pull/26329
Backport of #26270 to `camel-4.18.x`. **Draft** — see "Generated files pending" below. **Original PR:** apache/camel#26270 — CAMEL-24677 **Original author:** @oscerd ## Not a straight cherry-pick — adapted for camel-4.18.x - **Security marker dropped:** `camel-4.18.x`'s `@UriParam` does not have the `security` / `insecureValue` attributes (that infrastructure is newer), so the `allowExternalEntities` endpoint option is declared without them. `SecurityUtils` does not exist on this branch and is not part of the backport. - **JUnit 5:** the new component test uses `camel-test-junit5` (this branch uses JUnit 5; `main` uses JUnit 6). - The `main`-only 4.23 upgrade-guide entry and the generated files that do not exist on this branch (`camel-java-io`/`camel-yaml-io` newer writers, the canonical/model YAML schema variants) are not included. The runtime fix (hardened DOM pre-parse via `SmooksSecuritySupport`, applied only when the config uses the default XML reader) and the `allowExternalEntities` option are otherwise identical to the merged PR. ## Verified on camel-4.18.x `camel-smooks` and its upstream compile, and the module tests pass — including the two new XML-security tests (`SmooksDataFormatXmlSecurityTest`, `SmooksComponentXmlSecurityTest`), confirming external entities are not resolved by default and are resolved with `allowExternalEntities=true`. ## Generated files pending (why this is a draft) The following generated files still need regeneration by a full `mvn clean install`; the environment used to prepare this backport could not run the full reactor build (unrelated OOM and a corrupt local dependency jar), so they were left at the branch baseline: - `dsl/camel-endpointdsl/.../dsl/SmooksEndpointBuilderFactory.java` (and `StaticEndpointBuilders.java`) - `dsl/camel-yaml-dsl/camel-yaml-dsl-deserializers/.../ModelDeserializers.java` - `dsl/camel-yaml-dsl/camel-yaml-dsl/src/generated/resources/schema/camelYamlDsl.json` - `catalog/.../schemas/camel-spring.xsd` A committer should run `mvn clean install` (or let CI regenerate), commit the result, and mark this PR ready. As a non-mechanical backport it needs a normal review. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
