[
https://issues.apache.org/jira/browse/CAMEL-26498?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Claus Ibsen resolved CAMEL-26498.
---------------------------------
Resolution: Fixed
Fixed by https://github.com/apache/camel/pull/28979 (merged to main as
20a3c9d83f8ee467bb500e9472ce78eef422737e).
_Claude Code on behalf of Claus Ibsen (davsclaus)_
> camel-xml-jaxp - stream caching a SAXSource that has no XMLReader should
> parse with the secure XMLReader
> --------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-26498
> URL: https://issues.apache.org/jira/browse/CAMEL-26498
> Project: Camel
> Issue Type: Improvement
> Components: camel-core
> Reporter: Claus Ibsen
> Assignee: Claus Ibsen
> Priority: Minor
> Fix For: 4.24.0
>
>
> With stream caching on, StreamSourceConverter.convertToStreamCache(SAXSource)
> turns the SAXSource into a String with XmlConverter and a Transformer. When
> the SAXSource carries an XMLReader, that reader is used. The SAXSource
> instances that Camel creates (XmlConverter.toSAXSource from String, bytes,
> InputStream, File, Path) carry the secure XMLReader from XMLReaderPool, so
> they are fine.
> A SAXSource that has no XMLReader (for example new SAXSource(new
> InputSource(...)) created in a route, or XmlConverter.toSAXSourceFromStream
> when the SAX parser could not be created) is parsed by the default parser of
> the TransformerFactory, which may not have the same secure settings
> (depending on the JAXP implementation on the classpath).
> Hardening: when the SAXSource has no XMLReader, set the secure XMLReader of
> XmlConverter (createSAXParserFactory / XMLReaderPool) before the transform,
> so stream caching parses every SAXSource with the same secure settings. This
> is defence in depth for route-provided sources; it is not reachable from
> message data sent by external clients.
> _Claude Code on behalf of Claus Ibsen (davsclaus)_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
