[jira] [Resolved] (CAMEL-24416) camel-core - XmlConverter SAX parser factory is configured more permissively than the DOM factory in the same class

["Andrea Cosentino (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CAMEL-24416?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Andrea Cosentino resolved CAMEL-24416.
--------------------------------------
    Resolution: Fixed

> camel-core - XmlConverter SAX parser factory is configured more permissively than the DOM factory in the same class
> -------------------------------------------------------------------------------------------------------------------
>
>                 Key: CAMEL-24416
>                 URL: https://issues.apache.org/jira/browse/CAMEL-24416
>             Project: Camel
>          Issue Type: Improvement
>          Components: camel-core
>            Reporter: Andrea Cosentino
>            Assignee: Andrea Cosentino
>            Priority: Major
>             Fix For: 4.23.0
>
>
> XmlConverter contains two factory builders whose hardening has drifted apart.
> createDocumentBuilderFactory() (line 1020) sets:
> * FEATURE_SECURE_PROCESSING = true
> * http://apache.org/xml/features/disallow-doctype-decl = true
> * http://xml.org/sax/features/external-general-entities = false
> * the Xerces security manager when that class is present
> * and then applies setupFeatures() so system properties can tune it further
> createSAXParserFactory() (line 1193) sets only:
> * FEATURE_SECURE_PROCESSING = true
> * http://xml.org/sax/features/external-general-entities = false
> It does not set load-external-dtd or external-parameter-entities, does not install the Xerces security manager, and does not call setupFeatures(). toSAXSource() is a registered converter, and camel-xslt reaches for the SAXSource route first, so the looser factory is on a commonly used path.
> Proposal: bring createSAXParserFactory() in line with the DOM factory. The conservative form - adding
>     http://xml.org/sax/features/external-parameter-entities = false
>     http://apache.org/xml/features/nonvalidating/load-external-dtd = false
> plus the setupFeatures() call - closes the external-resource resolution difference without rejecting documents that carry an internal DTD subset, so it should be backport-safe. Adding disallow-doctype-decl on top would match the DOM factory exactly but would reject documents that parse today, so if it is wanted it belongs on main with an upgrade-guide entry.
> Continues the parser-consistency work in CAMEL-24299.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)