You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@camel.apache.org by "Andrea Cosentino (Jira)" <ji...@apache.org> on 2026/08/04 10:42:00 UTC

[jira] [Commented] (CAMEL-24299) camel-core: set SUPPORT_DTD=false in XmlStreamDetector for consistency with other XML parsers

    [ https://issues.apache.org/jira/browse/CAMEL-24299?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18101669#comment-18101669 ] 

Andrea Cosentino commented on CAMEL-24299:
------------------------------------------

Backported to camel-4.14.x via PR https://github.com/apache/camel/pull/25322.

_Claude Code on behalf of Andrea Cosentino (@oscerd)._

> camel-core: set SUPPORT_DTD=false in XmlStreamDetector for consistency with other XML parsers
> ---------------------------------------------------------------------------------------------
>
>                 Key: CAMEL-24299
>                 URL: https://issues.apache.org/jira/browse/CAMEL-24299
>             Project: Camel
>          Issue Type: Improvement
>          Components: camel-core
>            Reporter: Andrea Cosentino
>            Assignee: Andrea Cosentino
>            Priority: Minor
>             Fix For: 4.14.9, 4.18.4, 4.22.0
>
>
> XmlStreamDetector (camel-xml-io-util) creates its StAX XMLInputFactory with IS_SUPPORTING_EXTERNAL_ENTITIES=false but does not set SUPPORT_DTD=false. For consistency with XmlConverter / XmlLineNumberParser (which disable DTDs), add factory.setProperty(XMLInputFactory.SUPPORT_DTD, Boolean.FALSE). Hardening/consistency; the detector only pre-scans XML and external entities are already blocked.
> _Filed by Claude Code on behalf of Andrea Cosentino._



--
This message was sent by Atlassian Jira
(v8.20.10#820010)