[
https://issues.apache.org/jira/browse/CAMEL-24299?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Andrea Cosentino resolved CAMEL-24299.
--------------------------------------
Resolution: Fixed
Fixed on main via PR https://github.com/apache/camel/pull/25279 —
XmlStreamDetector now sets SUPPORT_DTD=false to harden against XXE. Main-only
(4.22.0).
_Claude Code on behalf of Andrea Cosentino (@oscerd)._
> camel-core: set SUPPORT_DTD=false in XmlStreamDetector for consistency with
> other XML parsers
> ---------------------------------------------------------------------------------------------
>
> Key: CAMEL-24299
> URL: https://issues.apache.org/jira/browse/CAMEL-24299
> Project: Camel
> Issue Type: Improvement
> Components: camel-core
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Minor
> Fix For: 4.22.0
>
>
> XmlStreamDetector (camel-xml-io-util) creates its StAX XMLInputFactory with
> IS_SUPPORTING_EXTERNAL_ENTITIES=false but does not set SUPPORT_DTD=false. For
> consistency with XmlConverter / XmlLineNumberParser (which disable DTDs), add
> factory.setProperty(XMLInputFactory.SUPPORT_DTD, Boolean.FALSE).
> Hardening/consistency; the detector only pre-scans XML and external entities
> are already blocked.
> _Filed by Claude Code on behalf of Andrea Cosentino._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
