This is an automated email from the ASF dual-hosted git repository.
oscerd pushed a commit to branch camel-4.18.x
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/camel-4.18.x by this push:
new ed513f3a7117 [backport camel-4.18.x] CAMEL-24691: camel-saxon - align
XQueryBuilder with secure XML parsing defaults (#26730)
ed513f3a7117 is described below
commit ed513f3a7117c3343a9e31e22e5627498f2fcdb6
Author: Andrea Cosentino <[email protected]>
AuthorDate: Tue Sep 22 11:17:39 2026 +0200
[backport camel-4.18.x] CAMEL-24691: camel-saxon - align XQueryBuilder with
secure XML parsing defaults (#26730)
CAMEL-24691: camel-saxon - align XQueryBuilder with secure XML parsing
defaults
XQueryBuilder built its default Saxon Configuration with only a
space-stripping ParseOptions. A message body that already arrives as a
javax.xml.transform.Source (e.g. after convertBodyTo(Source.class)) is
handed straight to Saxon and parsed with the parser defaults, which
accept a DOCTYPE and resolve external entities and DTDs. String, byte[]
and InputStream bodies were unaffected because they already go through
Camel's hardened SAX/StAX converters.
The default Configuration now disallows DOCTYPE declarations and
disables external general/parameter entities and external DTD loading,
matching XmlConverter and camel-xslt-saxon, and mirroring CAMEL-24475
for camel-xpath. A user-supplied Configuration (the configuration
option or XQueryBuilder.setConfiguration) is used as-is.
A Source body carrying a DOCTYPE is now rejected with a parse error.
The upgrade-guide note lives on main (guides for all lines are kept there).
Backport of #26344. The test imports test.junit5.CamelTestSupport on
this branch, matching the other camel-saxon tests.
Signed-off-by: Andrea Cosentino <[email protected]>
Co-authored-by: Claude Opus 4.8 <[email protected]>
---
.../camel/component/xquery/XQueryBuilder.java | 17 +++-
.../camel/component/xquery/XQueryXxeTest.java | 95 ++++++++++++++++++++++
2 files changed, 110 insertions(+), 2 deletions(-)
diff --git
a/components/camel-saxon/src/main/java/org/apache/camel/component/xquery/XQueryBuilder.java
b/components/camel-saxon/src/main/java/org/apache/camel/component/xquery/XQueryBuilder.java
index c6e0691da4be..c2dc74ad450b 100644
---
a/components/camel-saxon/src/main/java/org/apache/camel/component/xquery/XQueryBuilder.java
+++
b/components/camel-saxon/src/main/java/org/apache/camel/component/xquery/XQueryBuilder.java
@@ -121,8 +121,21 @@ public abstract class XQueryBuilder implements Expression,
Predicate, NamespaceA
LOG.debug("Initializing XQueryBuilder {}", this);
if (configuration == null) {
configuration = new Configuration();
- configuration.setParseOptions(new
ParseOptions().withSpaceStrippingRule(isStripsAllWhiteSpace()
- ? AllElementsSpaceStrippingRule.getInstance() :
IgnorableSpaceStrippingRule.getInstance()));
+ // Harden the default Saxon Configuration against XML external
entity (XXE) processing.
+ // A message body that already arrives as a
javax.xml.transform.Source is handed straight to
+ // Saxon (see getSource and createDynamicContext) and therefore
bypasses the hardened SAX/StAX
+ // type converters that plain String, byte[] and InputStream
bodies go through. Disable DOCTYPE
+ // declarations and external entity/DTD resolution so that
untrusted XML cannot pull in local
+ // files or remote resources. This mirrors the secure defaults
already applied by Camel's
+ // XmlConverter and by camel-xslt-saxon.
+ ParseOptions parseOptions = new ParseOptions()
+ .withSpaceStrippingRule(isStripsAllWhiteSpace()
+ ? AllElementsSpaceStrippingRule.getInstance() :
IgnorableSpaceStrippingRule.getInstance())
+
.withParserFeature("http://apache.org/xml/features/disallow-doctype-decl";, true)
+
.withParserFeature("http://xml.org/sax/features/external-general-entities";,
false)
+
.withParserFeature("http://xml.org/sax/features/external-parameter-entities";,
false)
+
.withParserFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd";,
false);
+ configuration.setParseOptions(parseOptions);
LOG.debug("Created new Configuration {}", configuration);
} else {
LOG.debug("Using existing Configuration {}", configuration);
diff --git
a/components/camel-saxon/src/test/java/org/apache/camel/component/xquery/XQueryXxeTest.java
b/components/camel-saxon/src/test/java/org/apache/camel/component/xquery/XQueryXxeTest.java
new file mode 100644
index 000000000000..d0cfde091178
--- /dev/null
+++
b/components/camel-saxon/src/test/java/org/apache/camel/component/xquery/XQueryXxeTest.java
@@ -0,0 +1,95 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.xquery;
+
+import java.io.PrintWriter;
+import java.io.StringWriter;
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import org.apache.camel.Exchange;
+import org.apache.camel.support.DefaultExchange;
+import org.apache.camel.test.junit5.CamelTestSupport;
+import org.apache.camel.util.xml.StringSource;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+
+/**
+ * Verifies that {@link XQueryBuilder} does not resolve XML external entities
when the message body already arrives as a
+ * {@link javax.xml.transform.Source} (which bypasses Camel's hardened
SAX/StAX type converters and is handed straight
+ * to Saxon).
+ */
+public class XQueryXxeTest extends CamelTestSupport {
+
+ private static final String SECRET = "CANARY-XQUERY-XXE-do-not-disclose";
+
+ @TempDir
+ Path tempDir;
+
+ @Override
+ public boolean isUseRouteBuilder() {
+ return false;
+ }
+
+ @Test
+ public void testExternalEntityIsNotResolvedForSourceBody() throws
Exception {
+ Path secret = Files.writeString(tempDir.resolve("secret.txt"), SECRET);
+
+ String payload = "<?xml version=\"1.0\"?>\n"
+ + "<!DOCTYPE data [ <!ENTITY xxe SYSTEM \"" +
secret.toUri() + "\"> ]>\n"
+ + "<order status=\"pending\">&xxe;</order>";
+
+ Exchange exchange = new DefaultExchange(context);
+ // a Source-typed body is returned unchanged by getSource() and parsed
directly by Saxon
+ exchange.getIn().setBody(new StringSource(payload));
+
+ XQueryBuilder xquery = XQueryBuilder.xquery("//order").asString();
+ xquery.init(context);
+
+ String outcome;
+ try {
+ outcome = String.valueOf(xquery.evaluate(exchange));
+ } catch (Exception e) {
+ outcome = stackTraceOf(e);
+ }
+
+ // The hardened Configuration must fail closed on the DOCTYPE (or at
least never resolve the external
+ // entity); either way the contents of the local file must not leak
into the result or the error.
+ assertFalse(outcome.contains(SECRET), "External entity was resolved -
local file content leaked");
+ }
+
+ @Test
+ public void testBenignSourceBodyStillEvaluates() {
+ Exchange exchange = new DefaultExchange(context);
+ exchange.getIn().setBody(new StringSource("<order
status=\"pending\">hello-world</order>"));
+
+ XQueryBuilder xquery = XQueryBuilder.xquery("//order").asString();
+ xquery.init(context);
+
+ String result = xquery.evaluate(exchange, String.class);
+ assertEquals("hello-world", result);
+ }
+
+ private static String stackTraceOf(Throwable t) {
+ StringWriter sw = new StringWriter();
+ t.printStackTrace(new PrintWriter(sw));
+ return sw.toString();
+ }
+}
