[jira] [Created] (CAMEL-24677) camel-smooks: align XML reader configuration with the other XML components

["Andrea Cosentino (Jira)" <ji...@apache.org>]

Andrea Cosentino created CAMEL-24677:
----------------------------------------

             Summary: camel-smooks: align XML reader configuration with the other XML components
                 Key: CAMEL-24677
                 URL: https://issues.apache.org/jira/browse/CAMEL-24677
             Project: Camel
          Issue Type: Improvement
          Components: camel-smooks
            Reporter: Andrea Cosentino
            Assignee: Andrea Cosentino


When the Smooks data format and the Smooks component parse XML input, the underlying SAX reader (Woodstox, resolved through Smooks) is used with its default feature configuration. The other Camel components that parse XML explicitly configure their parser factories/readers with secure defaults — disabling external general and parameter entities, restricting DTD handling, and enabling secure processing — but camel-smooks applies no such configuration.

This issue is to bring camel-smooks in line with the XML reader configuration already applied across the other XML-handling components, so the behaviour is consistent project-wide.

Affected classes:
* org.apache.camel.dataformat.smooks.SmooksDataFormat (unmarshal path)
* org.apache.camel.component.smooks.SmooksProcessor (process path)

Reference implementations that already apply secure XML reader/factory configuration:
* camel-xmlsecurity — XmlSignatureHelper
* camel-schematron — SchematronProcessorFactory
* camel-xslt-saxon — XsltSaxonEndpoint
* camel-jaxb — JaxbDataFormat
* camel-cm-sms — CMSenderOneMessageImpl

Implementation note: the SAX reader used by Smooks is Woodstox (com.ctc.wstx.sax.WstxSAXParser), which does not recognise the Xerces "disallow-doctype-decl" feature that the other components rely on. The equivalent controls on Woodstox are the "external-general-entities" / "external-parameter-entities" SAX features and the StAX supportDTD property, so the configuration has to be applied in a parser-aware way (or by supplying a preconfigured reader). A configuration option to re-enable DTD/entity processing should remain available for legacy EDI configurations that depend on it.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)