This is an automated email from the ASF dual-hosted git repository.
davsclaus pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new cbebcce9ed57 CAMEL-25827: add upgrade guide notes to 4_22 and 4_18
docs on main (#28840)
cbebcce9ed57 is described below
commit cbebcce9ed57b622c3ab5b1dd8594c6b8a212956
Author: Guillaume Nodet <[email protected]>
AuthorDate: Wed Nov 4 09:41:43 2026 +0100
CAMEL-25827: add upgrade guide notes to 4_22 and 4_18 docs on main (#28840)
---
.../ROOT/pages/camel-4x-upgrade-guide-4_18.adoc | 29 ++++++++++++++++++++++
.../ROOT/pages/camel-4x-upgrade-guide-4_22.adoc | 24 ++++++++++++++++++
2 files changed, 53 insertions(+)
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
index 9a46095523b0..5574c541fbf6 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
@@ -584,6 +584,35 @@ When `downloadFileName` is fully dynamic and has no static
directory prefix (for
`downloadFileName=${file:name}`), a relative destination must stay within the
working directory. An absolute
destination that comes from the route's own expression is not confined.
+=== camel-xslt-saxon - external resource access is restricted for a Source
message body
+
+`XsltSaxonAggregationStrategy` now configures its Saxon `TransformerFactory`
the same way the `xslt-saxon`
+endpoint configures the factory it creates: `FEATURE_SECURE_PROCESSING` is
enabled and `ACCESS_EXTERNAL_DTD`
+and `ACCESS_EXTERNAL_STYLESHEET` are set to an empty string. Previously the
strategy used the Saxon defaults,
+so the same stylesheet ran with different settings depending on whether it was
used from the endpoint or from
+the strategy. On Saxon PE/EE, `FEATURE_SECURE_PROCESSING` also disables
reflexive Java extension functions in the
+stylesheet.
+
+In addition, both the strategy and the `xslt-saxon` endpoint now parse a
message body that is already a
+`javax.xml.transform.Source` still to be parsed, for example a `StreamSource`
or the body after a
+`convertBodyTo(Source.class)`, with a reader that does not resolve references
to external resources declared
+in the document. A `DOMSource`, a `StAXSource`, or a `Source` that already
carries its own reader is left
+unchanged, and a declaration internal to the document is still applied. The
other body types (`String`,
+`byte[]`, `InputStream`) are unaffected, as they already reach the transformer
through Camel's StAX/SAX
+conversion.
+
+On the `xslt-saxon` endpoint, `secureProcessing` now controls both: setting
`secureProcessing=false` (for example so
+a Saxon PE/EE stylesheet can call Java extension functions) also restores the
previous, unrestricted parsing of a
+`Source` body. `XsltSaxonAggregationStrategy` has no switch for the `Source`
parsing: `setTransformerFactory(...)`
+replaces the factory, but the strategy's `XsltSaxonBuilder` keeps
`secureProcessing=true`, so the body is still
+parsed with the restricted reader.
+
+On 4.18.x the `xslt-saxon` endpoint factory configuration changes as well, as
it did in 4.22.0: `secureProcessing`
+(default `true`) is now applied to the Saxon `TransformerFactory` also when no
`saxonExtensionFunctions` are
+configured, including a factory set with the `transformerFactory` option, and
a factory the endpoint creates itself
+now has `ACCESS_EXTERNAL_DTD` and `ACCESS_EXTERNAL_STYLESHEET` set to an empty
string. A Saxon PE/EE stylesheet that
+calls Java extension functions now needs `secureProcessing=false`.
+
=== camel-openstack - the remaining Swift header constants follow the Camel
naming convention
The four remaining Exchange header constants of `SwiftConstants` have been
renamed to follow the Camel naming
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
index 67f37d13b32c..94cbab89deb3 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
@@ -435,6 +435,30 @@ When `downloadFileName` is fully dynamic and has no static
directory prefix (for
`downloadFileName=${file:name}`), a relative destination must stay within the
working directory. An absolute
destination that comes from the route's own expression is not confined.
+=== camel-xslt-saxon - external resource access is restricted for a Source
message body
+
+`XsltSaxonAggregationStrategy` now configures its Saxon `TransformerFactory`
the same way the `xslt-saxon`
+endpoint configures the factory it creates: `FEATURE_SECURE_PROCESSING` is
enabled and `ACCESS_EXTERNAL_DTD`
+and `ACCESS_EXTERNAL_STYLESHEET` are set to an empty string. Previously the
strategy used the Saxon defaults,
+so the same stylesheet ran with different settings depending on whether it was
used from the endpoint or from
+the strategy. On Saxon PE/EE, `FEATURE_SECURE_PROCESSING` also disables
reflexive Java extension functions in the
+stylesheet.
+
+In addition, both the strategy and the `xslt-saxon` endpoint now parse a
message body that is already a
+`javax.xml.transform.Source` still to be parsed, for example a `StreamSource`
or the body after a
+`convertBodyTo(Source.class)`, with a reader that does not resolve references
to external resources declared
+in the document. A `DOMSource`, a `StAXSource`, or a `Source` that already
carries its own reader is left
+unchanged, and a declaration internal to the document is still applied. The
other body types (`String`,
+`byte[]`, `InputStream`) are unaffected, as they already reach the transformer
through Camel's StAX/SAX
+conversion.
+
+On the `xslt-saxon` endpoint, `secureProcessing` now controls both: setting
`secureProcessing=false` (for example so
+a Saxon PE/EE stylesheet can call Java extension functions) also restores the
previous, unrestricted parsing of a
+`Source` body. The option is marked as a security knob
(`security=insecure:dev`, `insecureValue=false`), so
+`camel.main.profile=prod` reports it when it is turned off.
`XsltSaxonAggregationStrategy` has no switch for the
+`Source` parsing: `setTransformerFactory(...)` replaces the factory, but the
strategy's `XsltSaxonBuilder` keeps
+`secureProcessing=true`, so the body is still parsed with the restricted
reader.
+
=== camel-openstack - the remaining Swift header constants follow the Camel
naming convention
The four remaining Exchange header constants of `SwiftConstants` have been
renamed to follow the Camel naming
