[
https://issues.apache.org/jira/browse/CAMEL-25827?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18132770#comment-18132770
]
Andrea Cosentino commented on CAMEL-25827:
------------------------------------------
Fixed via merged PR https://github.com/apache/camel/pull/28160
_Claude Code on behalf of oscerd_
> camel-xslt-saxon - apply endpoint factory settings to the aggregation strategy
> ------------------------------------------------------------------------------
>
> Key: CAMEL-25827
> URL: https://issues.apache.org/jira/browse/CAMEL-25827
> Project: Camel
> Issue Type: Bug
> Components: camel-xslt
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.18.6, 4.22.3, 4.24.0
>
>
> h3. Current behaviour
> {{XsltSaxonAggregationStrategy}} creates a plain
> {{net.sf.saxon.TransformerFactoryImpl}} in its constructor and passes it to
> {{setTransformerFactory(...)}}. {{XsltAggregationStrategy.doInit()}} hands
> that factory to {{XsltBuilder.setTransformerFactory(...)}}, which stores it
> unchanged. The factory the strategy transforms with therefore keeps the Saxon
> defaults:
> * {{XMLConstants.FEATURE_SECURE_PROCESSING}} is not set;
> * {{XMLConstants.ACCESS_EXTERNAL_DTD}} and
> {{XMLConstants.ACCESS_EXTERNAL_STYLESHEET}} are not set.
> The other ways to run a stylesheet in {{camel-xslt}} and {{camel-xslt-saxon}}
> configure the factory they create:
> * {{XsltSaxonEndpoint.createXsltBuilder()}} calls
> {{XsltSaxonHelper.configureSecureProcessing(factory, secureProcessing)}} (the
> {{secureProcessing}} option defaults to {{true}}) and sets
> {{ACCESS_EXTERNAL_DTD}} and {{ACCESS_EXTERNAL_STYLESHEET}} to an empty string;
> * when no factory is configured, the {{xslt}} endpoint and the
> {{XsltAggregationStrategy}} of {{camel-xslt}} use
> {{XMLConverterHelper.createTransformerFactory()}}, which applies the same
> three settings.
> The same stylesheet therefore runs with different factory settings depending
> on whether it is used from an {{xslt-saxon}} endpoint or from
> {{XsltSaxonAggregationStrategy}}.
> h3. Proposed change
> * {{XsltSaxonHelper}}: add one method (for example
> {{configureTransformerFactory(...)}}) that applies what {{XsltSaxonEndpoint}}
> applies today: {{configureSecureProcessing(...)}} with the given flag, then
> {{ACCESS_EXTERNAL_DTD}} and {{ACCESS_EXTERNAL_STYLESHEET}} set to an empty
> string, ignoring an {{IllegalArgumentException}} from {{setAttribute}} as the
> endpoint does now.
> * {{XsltSaxonAggregationStrategy}}: pass the {{TransformerFactoryImpl}}
> created in the constructor through that method, with secure processing
> enabled, before calling {{setTransformerFactory(...)}}.
> * {{XsltSaxonEndpoint.createXsltBuilder()}}: call the same method instead of
> the inline code, so that the endpoint and the strategy share one
> implementation. The endpoint behaves as before: the {{secureProcessing}}
> option is still honoured, the {{transformerFactoryConfigurationStrategy}} and
> {{xpathTotalOpLimit}} steps stay where they are, and a factory the user
> supplies is still used as given.
> * Make sure the settings are in effect for the whole transformation,
> including the parsing of the input document, for every message body type the
> strategy accepts, and not only on the factory object. The tests below check
> this; where a step does not pick the settings up from the factory, configure
> that step the same way, in the strategy and in the endpoint.
> * A {{TransformerFactory}} set on the strategy with
> {{setTransformerFactory(...)}} is still used as given.
> * No option is added or changed, so the catalog and the DSLs do not change.
> h3. Maintenance branches
> * camel-4.22.x: same code as main, the change applies as is.
> * camel-4.18.x: the {{xslt-saxon}} endpoint does not apply these settings yet
> (it sets {{FEATURE_SECURE_PROCESSING}} only when {{saxonExtensionFunctions}}
> is configured, and it does not set {{ACCESS_EXTERNAL_DTD}} or
> {{ACCESS_EXTERNAL_STYLESHEET}}), and {{XsltSaxonHelper}} differs from main.
> The change is made directly on that branch and applies the helper to both the
> strategy and the endpoint, which {{camel-xj}} extends.
> h3. Behaviour after the change
> {{XsltSaxonAggregationStrategy}} transforms with a factory configured like
> the one an {{xslt-saxon}} endpoint creates with its default options, on every
> supported branch. A route that needs different factory settings can still set
> its own {{TransformerFactory}} on the strategy with
> {{setTransformerFactory(...)}}. The upgrade guide will describe the change.
> h3. Tests
> In {{components/camel-xslt-saxon}}, using JUnit assertions like the other
> tests of the module:
> * a new test (for example {{XsltSaxonAggregationStrategyConfigurationTest}})
> checking that the factory used by {{XsltSaxonAggregationStrategy}} has
> {{FEATURE_SECURE_PROCESSING}} enabled and {{ACCESS_EXTERNAL_DTD}} and
> {{ACCESS_EXTERNAL_STYLESHEET}} set to an empty string, the same values as the
> factory {{XsltSaxonEndpoint}} creates;
> * a route test that runs an aggregation with the strategy, with message
> bodies of the different types it accepts, and checks that the settings are in
> effect during the transformation itself, not only on the factory object; the
> same check for the {{xslt-saxon}} endpoint;
> * the existing tests of the module, including
> {{XsltAggregationStrategyTest}}, keep passing.
> ----
> _Claude Code on behalf of [~acosentino]_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
