[jira] [Created] (CAMEL-24451) camel-xslt - all headers are bound as stylesheet parameters and XsltUriResolver bypasses the JAXP external-access limits

["Andrea Cosentino (Jira)" <ji...@apache.org>]

Andrea Cosentino created CAMEL-24451:
----------------------------------------

             Summary: camel-xslt - all headers are bound as stylesheet parameters and XsltUriResolver bypasses the JAXP external-access limits
                 Key: CAMEL-24451
                 URL: https://issues.apache.org/jira/browse/CAMEL-24451
             Project: Camel
          Issue Type: Bug
          Components: camel-xslt
            Reporter: Andrea Cosentino
            Assignee: Andrea Cosentino
             Fix For: 4.23.0


Two behaviours in {{XsltBuilder.configureTransformer()}} combine:

1. Every exchange property, message header and variable is bound as an XSLT parameter, with no opt-in. Message headers therefore silently shadow {{xsl:param}} defaults in the stylesheet.
2. {{XsltUriResolver}} is always installed. JAXP consults {{ACCESS_EXTERNAL_DTD}} / {{ACCESS_EXTERNAL_STYLESHEET}} only when no {{URIResolver}} returns a {{Source}}, so the resolver re-enables resolution of {{classpath:}}, {{file:}}, {{http:}}, {{ref:}} and {{bean:}} URIs regardless of those settings.

Where a stylesheet uses a parameter inside {{document()}} - a normal pattern - a message header decides what the transform reads. The stylesheet author never asked for header binding, and the operator's external-access configuration does not apply.

Proposal: gate the automatic parameter binding behind an option (an explicit parameter list, or an {{allowParametersFromHeaders}} flag defaulting to false), and make {{XsltUriResolver}} honour the configured {{ACCESS_EXTERNAL_*}} values rather than sitting in front of them. Both are behaviour changes and need upgrade-guide entries.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)