davsclaus opened a new pull request, #24777: URL: https://github.com/apache/camel/pull/24777
## Summary _Claude Code on behalf of davsclaus_ - **Fix `secureProcessing` no-op:** `FEATURE_SECURE_PROCESSING` is now applied to the Saxon `TransformerFactory` unconditionally, independent of whether `saxonExtensionFunctions` is configured. Previously the documented default (`true`) was silently ignored unless extension functions were present. - **Restrict external access:** The Saxon factory now attempts to set `ACCESS_EXTERNAL_DTD` and `ACCESS_EXTERNAL_STYLESHEET` to empty strings (matching the plain `xslt` component behavior). Saxon HE does not support these JAXP attributes, so the attempt is caught gracefully. - **Honor `transformerFactoryConfigurationStrategy`:** The strategy is now invoked on all factory creation paths for both `xslt-saxon` (previously never invoked) and plain `xslt` (previously only invoked when `transformerFactoryClass` was explicitly set). ## Test plan - [x] New `XsltSaxonSecureProcessingTest` — verifies secure processing is on by default, can be disabled, and transformations work correctly - [x] New `XsltSaxonConfigurationStrategyTest` — verifies the configuration strategy is actually invoked on the default factory path - [x] All 41 existing `camel-xslt-saxon` tests pass (including `SaxonXsltDTDTest`) - [x] Upgrade guide entry added for 4.22 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.6 <[email protected]> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
