(camel) branch camel-4.14.x updated: CAMEL-24299: camel-core - disable DTD support in XmlStreamDetector (#25322)

[ac...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

oscerd pushed a commit to branch camel-4.14.x
in repository https://gitbox.apache.org/repos/asf/camel.git


The following commit(s) were added to refs/heads/camel-4.14.x by this push:
     new 59ae31035924 CAMEL-24299: camel-core - disable DTD support in XmlStreamDetector (#25322)
59ae31035924 is described below

commit 59ae3103592403848169132cdc08d8a70cccd1b1
Author: Andrea Cosentino <an...@gmail.com>
AuthorDate: Tue Aug 4 12:39:50 2026 +0200

    CAMEL-24299: camel-core - disable DTD support in XmlStreamDetector (#25322)
    
    Backport to camel-4.14.x. Sets SUPPORT_DTD=false on the StAX input factory used by XmlStreamDetector so DTD processing is disabled when detecting the encoding/root of an XML stream, hardening the detector against XXE and DTD-based denial-of-service on untrusted input.
    
    Co-authored-by: Claude Opus 4.8 <no...@anthropic.com>
    Signed-off-by: Andrea Cosentino <an...@gmail.com>
---
 .../java/org/apache/camel/xml/io/util/XmlStreamDetector.java |  2 ++
 .../org/apache/camel/xml/io/util/XmlStreamDetectorTest.java  | 12 ++++++++++++
 2 files changed, 14 insertions(+)

diff --git a/core/camel-xml-io-util/src/main/java/org/apache/camel/xml/io/util/XmlStreamDetector.java b/core/camel-xml-io-util/src/main/java/org/apache/camel/xml/io/util/XmlStreamDetector.java
index 379802a6703d..ce20246c707d 100644
--- a/core/camel-xml-io-util/src/main/java/org/apache/camel/xml/io/util/XmlStreamDetector.java
+++ b/core/camel-xml-io-util/src/main/java/org/apache/camel/xml/io/util/XmlStreamDetector.java
@@ -67,6 +67,8 @@ public class XmlStreamDetector {
             XMLInputFactory factory = XMLInputFactory.newInstance();
             factory.setProperty(XMLInputFactory.IS_COALESCING, Boolean.TRUE);
             factory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.FALSE);
+            // disable DTD support for consistency with XmlConverter / StaxConverter (defends against DTD-based attacks)
+            factory.setProperty(XMLInputFactory.SUPPORT_DTD, Boolean.FALSE);
             reader = factory.createXMLStreamReader(xmlStream);
         } catch (XMLStreamException e) {
             information.problem = e;
diff --git a/core/camel-xml-io-util/src/test/java/org/apache/camel/xml/io/util/XmlStreamDetectorTest.java b/core/camel-xml-io-util/src/test/java/org/apache/camel/xml/io/util/XmlStreamDetectorTest.java
index adaa245a1652..3188ea07d83d 100644
--- a/core/camel-xml-io-util/src/test/java/org/apache/camel/xml/io/util/XmlStreamDetectorTest.java
+++ b/core/camel-xml-io-util/src/test/java/org/apache/camel/xml/io/util/XmlStreamDetectorTest.java
@@ -133,4 +133,16 @@ public class XmlStreamDetectorTest {
         assertEquals("http://www.w3.org/2001/XMLSchema-instance", info.getNamespaces().get("xsi"));
     }
 
+    @Test
+    void documentWithDoctypeIsRejected() throws IOException {
+        // SUPPORT_DTD=false: a DOCTYPE declaration is not processed, so the stream is reported invalid rather than
+        // expanding any DTD-defined entities (CAMEL-24299)
+        String xml = "<?xml version=\"1.0\"?>\n"
+                     + "<!DOCTYPE root [ <!ENTITY x \"expanded\"> ]>\n"
+                     + "<root>&x;</root>";
+        XmlStreamDetector detector
+                = new XmlStreamDetector(new ByteArrayInputStream(xml.getBytes(StandardCharsets.UTF_8)));
+        assertFalse(detector.information().isValid());
+    }
+
 }