oscerd opened a new pull request, #26108: URL: https://github.com/apache/camel/pull/26108
# Description `FopProducer` builds a `javax.xml.transform.TransformerFactory` that only enables `FEATURE_SECURE_PROCESSING` before transforming the incoming message body. Camel's standard XML processing utilities (for example `org.apache.camel.converter.jaxp.XmlConverter`) configure the factory more completely by also restricting access to external resources via `XMLConstants.ACCESS_EXTERNAL_DTD` and `XMLConstants.ACCESS_EXTERNAL_STYLESHEET` (set to an empty string). For consistency and robustness across the codebase, this change applies the same standard configuration when `FopProducer` creates its `TransformerFactory`. ## Changes - `FopProducer` now sets `ACCESS_EXTERNAL_DTD` and `ACCESS_EXTERNAL_STYLESHEET` to an empty string on the `TransformerFactory` (defensively guarded, matching the pattern in `XmlConverter`). - Added `FopExternalEntityTest` verifying that external DTD/stylesheet access is not resolved during transformation. ## Testing - `mvn test -Dtest=FopExternalEntityTest,FopComponentTest` in `components/camel-fop` — all green. _Claude Code on behalf of oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
