oscerd opened a new pull request, #26344: URL: https://github.com/apache/camel/pull/26344
This aligns the XQuery language and the `xquery` component with the secure XML parser defaults already used by Camel's `XmlConverter` and by `camel-xslt-saxon`, mirroring the recent camel-xpath change in CAMEL-24475. ### Background `XQueryBuilder` built its default Saxon `Configuration` (`XQueryBuilder.init()`) with only a space-stripping `ParseOptions`. A message body that already arrives as a `javax.xml.transform.Source` (for example after a `convertBodyTo(Source.class)`) is handed straight to Saxon and parsed with the parser defaults, which accept a `DOCTYPE` and resolve external general/parameter entities and external DTDs. The `String`, `byte[]` and `InputStream` body paths are unaffected because they already go through Camel's hardened SAX/StAX converters. ### Change - Configure the default `Configuration`'s `ParseOptions` with `disallow-doctype-decl=true`, `external-general-entities=false`, `external-parameter-entities=false` and `load-external-dtd=false`. - Only the framework-created default `Configuration` is hardened; a user-supplied `Configuration` (via the `configuration` option or `XQueryBuilder.setConfiguration(...)`) is used as-is. - Adds `XQueryXxeTest` and an upgrade-guide note. ### Behaviour change A `Source`-typed body carrying a `DOCTYPE` declaration is now rejected with a parse error instead of resolving the entity, matching the behaviour the other body paths already had. Bodies without a `DOCTYPE` are unaffected. Documented in the 4.23 upgrade guide. ### Testing - New `XQueryXxeTest`: a `Source`-typed body with an external-entity `DOCTYPE` is no longer resolved; a benign `Source` body still evaluates. - Full `camel-saxon` module suite green (89 tests). To be backported to `camel-4.22.x` and `camel-4.18.x`. _Claude Code on behalf of oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
