[jira] [Work started] (CAMEL-25827) camel-xslt-saxon - apply endpoint factory settings to the aggregation strategy

["Andrea Cosentino (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CAMEL-25827?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Work on CAMEL-25827 started by Andrea Cosentino.
------------------------------------------------
> camel-xslt-saxon - apply endpoint factory settings to the aggregation strategy
> ------------------------------------------------------------------------------
>
>                 Key: CAMEL-25827
>                 URL: https://issues.apache.org/jira/browse/CAMEL-25827
>             Project: Camel
>          Issue Type: Bug
>          Components: camel-xslt
>            Reporter: Andrea Cosentino
>            Assignee: Andrea Cosentino
>            Priority: Major
>             Fix For: 4.18.6, 4.22.3, 4.24.0
>
>
> h3. Current behaviour
> {{XsltSaxonAggregationStrategy}} creates a plain {{net.sf.saxon.TransformerFactoryImpl}} in its constructor and passes it to {{setTransformerFactory(...)}}. {{XsltAggregationStrategy.doInit()}} hands that factory to {{XsltBuilder.setTransformerFactory(...)}}, which stores it unchanged. The factory the strategy transforms with therefore keeps the Saxon defaults:
> * {{XMLConstants.FEATURE_SECURE_PROCESSING}} is not set;
> * {{XMLConstants.ACCESS_EXTERNAL_DTD}} and {{XMLConstants.ACCESS_EXTERNAL_STYLESHEET}} are not set.
> The other ways to run a stylesheet in {{camel-xslt}} and {{camel-xslt-saxon}} configure the factory they create:
> * {{XsltSaxonEndpoint.createXsltBuilder()}} calls {{XsltSaxonHelper.configureSecureProcessing(factory, secureProcessing)}} (the {{secureProcessing}} option defaults to {{true}}) and sets {{ACCESS_EXTERNAL_DTD}} and {{ACCESS_EXTERNAL_STYLESHEET}} to an empty string;
> * when no factory is configured, the {{xslt}} endpoint and the {{XsltAggregationStrategy}} of {{camel-xslt}} use {{XMLConverterHelper.createTransformerFactory()}}, which applies the same three settings.
> The same stylesheet therefore runs with different factory settings depending on whether it is used from an {{xslt-saxon}} endpoint or from {{XsltSaxonAggregationStrategy}}.
> h3. Proposed change
> * {{XsltSaxonHelper}}: add one method (for example {{configureTransformerFactory(...)}}) that applies what {{XsltSaxonEndpoint}} applies today: {{configureSecureProcessing(...)}} with the given flag, then {{ACCESS_EXTERNAL_DTD}} and {{ACCESS_EXTERNAL_STYLESHEET}} set to an empty string, ignoring an {{IllegalArgumentException}} from {{setAttribute}} as the endpoint does now.
> * {{XsltSaxonAggregationStrategy}}: pass the {{TransformerFactoryImpl}} created in the constructor through that method, with secure processing enabled, before calling {{setTransformerFactory(...)}}.
> * {{XsltSaxonEndpoint.createXsltBuilder()}}: call the same method instead of the inline code, so that the endpoint and the strategy share one implementation. The endpoint behaves as before: the {{secureProcessing}} option is still honoured, the {{transformerFactoryConfigurationStrategy}} and {{xpathTotalOpLimit}} steps stay where they are, and a factory the user supplies is still used as given.
> * Make sure the settings are in effect for the whole transformation, including the parsing of the input document, for every message body type the strategy accepts, and not only on the factory object. The tests below check this; where a step does not pick the settings up from the factory, configure that step the same way, in the strategy and in the endpoint.
> * A {{TransformerFactory}} set on the strategy with {{setTransformerFactory(...)}} is still used as given.
> * No option is added or changed, so the catalog and the DSLs do not change.
> h3. Maintenance branches
> * camel-4.22.x: same code as main, the change applies as is.
> * camel-4.18.x: the {{xslt-saxon}} endpoint does not apply these settings yet (it sets {{FEATURE_SECURE_PROCESSING}} only when {{saxonExtensionFunctions}} is configured, and it does not set {{ACCESS_EXTERNAL_DTD}} or {{ACCESS_EXTERNAL_STYLESHEET}}), and {{XsltSaxonHelper}} differs from main. The change is made directly on that branch and applies the helper to both the strategy and the endpoint, which {{camel-xj}} extends.
> h3. Behaviour after the change
> {{XsltSaxonAggregationStrategy}} transforms with a factory configured like the one an {{xslt-saxon}} endpoint creates with its default options, on every supported branch. A route that needs different factory settings can still set its own {{TransformerFactory}} on the strategy with {{setTransformerFactory(...)}}. The upgrade guide will describe the change.
> h3. Tests
> In {{components/camel-xslt-saxon}}, using JUnit assertions like the other tests of the module:
> * a new test (for example {{XsltSaxonAggregationStrategyConfigurationTest}}) checking that the factory used by {{XsltSaxonAggregationStrategy}} has {{FEATURE_SECURE_PROCESSING}} enabled and {{ACCESS_EXTERNAL_DTD}} and {{ACCESS_EXTERNAL_STYLESHEET}} set to an empty string, the same values as the factory {{XsltSaxonEndpoint}} creates;
> * a route test that runs an aggregation with the strategy, with message bodies of the different types it accepts, and checks that the settings are in effect during the transformation itself, not only on the factory object; the same check for the {{xslt-saxon}} endpoint;
> * the existing tests of the module, including {{XsltAggregationStrategyTest}}, keep passing.
> ----
> _Claude Code on behalf of [~acosentino]_



--
This message was sent by Atlassian Jira
(v8.20.10#820010)