[
https://issues.apache.org/jira/browse/CAMEL-26086?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on CAMEL-26086 started by shashank.
----------------------------------------
> camel-stax - xtokenize mode 't' returns undecoded markup and loses CDATA, and
> modes 'i' and 'u' cut the start tag at a '>' inside an attribute value
> ----------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-26086
> URL: https://issues.apache.org/jira/browse/CAMEL-26086
> Project: Camel
> Issue Type: Bug
> Components: camel-stax
> Reporter: shashank
> Assignee: shashank
> Priority: Major
>
> {{XMLTokenExpressionIterator}} (the {{xtokenize}} language, main
> 6a2f66ddec3e) builds the token of a mode from the raw text of the matched
> element, in two places not as an XML parser reads it. Valid XML then gives
> wrong tokens without an error.
> * Mode {{t}} ("extracting the text content of the specified element") copies
> the characters between each {{>}} and the next {{<}}: {{<order>AT&T
> <5></order>}} gives {{AT&T <5>}} instead of {{AT&T <5>}}, and
> {{<order><![CDATA[a<b]]></order>}} gives an empty string. With a {{group}}
> above 1 the {{<group>}} element can get a stray {{]]>}} and is no longer XML.
> * Modes {{i}} (default) and {{u}} take the start tag up to the first {{>}},
> which can be inside a quoted attribute value. Mode {{i}} then inserts the
> inherited namespace declarations inside the attribute: {{<orders
> xmlns='urn:orders'><order note='qty > 5'>1</order></orders>}} with
> {{xtokenize("//o:order")}} gives {{<order note='qty xmlns="urn:orders">
> 5'>1</order>}}: the element loses its namespace and {{note}} changes. In mode
> {{u}} the content starts with the rest of the start tag.
> *Fix*: mode {{t}} reads the text of the token with a StAX reader (no DTD, no
> external entities, coalescing, not namespace aware as the token may use
> prefixes of its ancestors): entity references decoded, CDATA included,
> comments and PIs left out; in a group the texts are escaped as XML text.
> Modes {{i}} and {{u}} find the end of the start tag with a quote-aware scan.
> Upgrade guide 4.24 entry for the text mode.
> *Tests*: new {{XMLTokenizeTextAndStartTagTest}}, 6 tests, all fail on main,
> for example {{Expected: <AT&T <5>> but was: <AT&T <5>>}},
> {{Expected: <a<b> but was: <>}}, {{expected: <urn:orders> but was: <null>}}.
> Unit tests of camel-stax with the fix: 116 run, 0 failures, 2 skipped. A
> differential run against a namespace-aware DOM parser on 20,000 generated
> documents (together with the related xtokenize fix for comments before the
> root and the wrap mode): modes {{i}}, {{t}} and {{u}} agree with the parser
> on every document.
> *Related*: a document starting with a comment or doctype without an XML
> declaration fails in every mode, and mode {{w}} with matches at different
> depths throws {{IndexOutOfBoundsException}}: separate issue.
> *How it was found*: a reference differential of {{xtokenize}} against a DOM
> parser.
> *Affected*: main, camel-4.23.x, camel-4.22.x, camel-4.18.x and camel-4.14.x
> (same code). Read, not run. The fix uses {{EscapeHelper.xml}} (CAMEL-24802),
> which camel-4.22.x and older do not have.
> _Filed with Claude Code on behalf of allthingssecurity._
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
