Andrea Cosentino created CAMEL-24299:
----------------------------------------
Summary: camel-core: set SUPPORT_DTD=false in XmlStreamDetector
for consistency with other XML parsers
Key: CAMEL-24299
URL: https://issues.apache.org/jira/browse/CAMEL-24299
Project: Camel
Issue Type: Improvement
Components: camel-core
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
XmlStreamDetector (camel-xml-io-util) creates its StAX XMLInputFactory with
IS_SUPPORTING_EXTERNAL_ENTITIES=false but does not set SUPPORT_DTD=false. For
consistency with XmlConverter / XmlLineNumberParser (which disable DTDs), add
factory.setProperty(XMLInputFactory.SUPPORT_DTD, Boolean.FALSE).
Hardening/consistency; the detector only pre-scans XML and external entities
are already blocked.
_Filed by Claude Code on behalf of Andrea Cosentino._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
