[
https://issues.apache.org/jira/browse/CAMEL-24299?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18101668#comment-18101668
]
Andrea Cosentino commented on CAMEL-24299:
------------------------------------------
Backported to maintenance branches: camel-4.18.x via
https://github.com/apache/camel/pull/25320 (f4dce1f396ee) and camel-4.14.x via
https://github.com/apache/camel/pull/25322 (59ae31035924).
> camel-core: set SUPPORT_DTD=false in XmlStreamDetector for consistency with
> other XML parsers
> ---------------------------------------------------------------------------------------------
>
> Key: CAMEL-24299
> URL: https://issues.apache.org/jira/browse/CAMEL-24299
> Project: Camel
> Issue Type: Improvement
> Components: camel-core
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Minor
> Fix For: 4.14.9, 4.18.4, 4.22.0
>
>
> XmlStreamDetector (camel-xml-io-util) creates its StAX XMLInputFactory with
> IS_SUPPORTING_EXTERNAL_ENTITIES=false but does not set SUPPORT_DTD=false. For
> consistency with XmlConverter / XmlLineNumberParser (which disable DTDs), add
> factory.setProperty(XMLInputFactory.SUPPORT_DTD, Boolean.FALSE).
> Hardening/consistency; the detector only pre-scans XML and external entities
> are already blocked.
> _Filed by Claude Code on behalf of Andrea Cosentino._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
