gnodet-bot commented on code in PR #28840:
URL: https://github.com/apache/camel/pull/28840#discussion_r4459035296
##########
docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc:
##########
@@ -435,6 +435,31 @@ When `downloadFileName` is fully dynamic and has no static
directory prefix (for
`downloadFileName=${file:name}`), a relative destination must stay within the
working directory. An absolute
destination that comes from the route's own expression is not confined.
+=== camel-xslt-saxon - external resource access is restricted for a Source
message body
+
+`XsltSaxonAggregationStrategy` now configures its Saxon `TransformerFactory`
the same way the `xslt-saxon`
+endpoint configures the factory it creates: `FEATURE_SECURE_PROCESSING` is
enabled and `ACCESS_EXTERNAL_DTD`
+and `ACCESS_EXTERNAL_STYLESHEET` are set to an empty string. Previously the
strategy used the Saxon defaults,
+so the same stylesheet ran with different settings depending on whether it was
used from the endpoint or from
+the strategy. On Saxon PE/EE, `FEATURE_SECURE_PROCESSING` also disables
reflexive Java extension functions in the
+stylesheet.
+
+In addition, both the strategy and the `xslt-saxon` endpoint now parse a
message body that is already a
+`javax.xml.transform.Source` still to be parsed, for example a `StreamSource`
or the body after a
+`convertBodyTo(Source.class)`, with a reader that does not resolve references
to external resources declared
+in the document. A `DOMSource`, a `StAXSource`, or a `Source` that already
carries its own reader is left
+unchanged, and a declaration internal to the document is still applied. The
other body types (`String`,
+`byte[]`, `InputStream`) are unaffected, as they already reach the transformer
through Camel's StAX/SAX
+conversion.
+
+On the `xslt-saxon` endpoint, `secureProcessing` now controls both: setting
`secureProcessing=false` (for example so
+a Saxon PE/EE stylesheet can call Java extension functions) also restores the
previous, unrestricted parsing of a
+`Source` body. The option is marked as a security knob
(`security=insecure:dev`, `insecureValue=false`), so
+`camel.main.profile=prod` reports it when it is turned off.
`XsltSaxonAggregationStrategy` has no switch for the
+`Source` parsing: `setTransformerFactory(...)` replaces the factory, but the
strategy's `XsltSaxonBuilder` keeps
Review Comment:
🔧 **Nit:** Double blank line — one blank line is enough between AsciiDoc
sections.
```suggestion
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
