oscerd opened a new pull request, #28160:
URL: https://github.com/apache/camel/pull/28160
# CAMEL-25827: camel-xslt-saxon - restrict external resource access for a
Source message body
## Problem
`XsltSaxonAggregationStrategy` builds its Saxon `TransformerFactory` with
the Saxon defaults: it does
not enable `FEATURE_SECURE_PROCESSING` and does not set
`ACCESS_EXTERNAL_DTD` /
`ACCESS_EXTERNAL_STYLESHEET`. The `xslt-saxon` endpoint has configured those
on the factory it creates
since 4.22.0, so the same stylesheet ran with different settings depending
on whether it was used from
an endpoint or from the aggregation strategy.
Separately, a message body that is already a `javax.xml.transform.Source`
still to be parsed (for
example a `StreamSource`, or the body after a `convertBodyTo(Source.class)`)
reaches Saxon without the
StAX/SAX conversion that `String`, `byte[]` and `InputStream` bodies go
through. The transformer factory
has a `URIResolver` installed that resolves references the document declares
to other resources, so the
factory's `ACCESS_EXTERNAL_*` attributes do not cover that parse: the
reference is resolved from the
body. This affects the aggregation strategy and the `xslt-saxon` endpoint
(and `camel-xj`, which extends
it).
## Change
- Add `XsltSaxonHelper.configureExternalAccess(...)` (the
`ACCESS_EXTERNAL_DTD` /
`ACCESS_EXTERNAL_STYLESHEET` block the endpoint had inline) and
`XsltSaxonHelper.secureSource(...)`
(wraps a stream-based `Source` still to be parsed with a reader that does
not resolve references to
external resources, leaving a `DOMSource`, a `StAXSource`, or a
reader-backed `Source` unchanged).
- `XsltSaxonAggregationStrategy` now enables secure processing and calls
`configureExternalAccess(...)`
on its factory, so it is configured like the endpoint's.
- `SaxonXmlSourceHandlerFactoryImpl` runs the resolved source through
`secureSource(...)` when secure
processing is on, so a `Source` body is parsed with the restricted reader.
`XsltSaxonBuilder` threads
the flag through, and `XsltSaxonEndpoint` passes its existing
`secureProcessing` option, so
`secureProcessing=false` restores the previous parsing on the endpoint.
- The endpoint now calls the shared `configureExternalAccess(...)` instead
of its inline block, so the
endpoint and the strategy cannot drift apart.
- No option is added or changed, so the catalog and the DSLs are unchanged.
A route that needs `XsltSaxonAggregationStrategy` to use a different
`TransformerFactory` can still set
its own with `setTransformerFactory(...)`.
## Tests
- `XsltSaxonAggregationStrategySourceBodyTest` - aggregates a `Source` body
and checks that a resource
named by the body is not read into the result, while a declaration
internal to the document is still
applied.
- `XsltSaxonHelperConfigurationTest` - unit tests for
`configureExternalAccess(...)` and
`secureSource(...)` (stream-based source wrapped with a restricted reader;
an already-parsed source
left unchanged).
- `XsltSaxonDomSourceTest` updated for the new `Source` handling (a
stream-based body is now wrapped
with a restricted reader; `DOMSource` / `StAXSource` pass through).
- `components/camel-xslt-saxon` and `components/camel-xj` test suites pass.
The change is documented in
`docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc`.
_Claude Code on behalf of oscerd_
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
