[CAMEL-14501] gain fully control of xml parser used by saxon

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.1.0, 2.25.1
• Component/s: camel-xslt
• Estimated Complexity: Unknown
• Assignee: Freeman Yue Fang
• Reporter: Freeman Yue Fang
• Created: 05/Feb/20 17:12
• Updated: 07/Feb/20 15:18
• Resolved: 07/Feb/20 01:18

Description

currently we can configure TransformerFactory used by saxon by specifying features/attributes there. However, this can only take effect on an XML parser that Saxon creates. It has no effect if camel application creates the XML parser (that is, if the input is supplied to Saxon as a Source object)

Per saxon community discussion here ,

If you want detailed control over parsing, the best way is to create an XMLReader yourself and supply it to Saxon within a SAXSource object.

So we need to saxonReaderProperties option to camel-xslt-saxon endpoint, if saxonReaderProperties isn't null, create a XMLReader and specify features on it, so that we can gain fully control of xml parsed used by saxon. This is important to prevent XXE attack when using saxon to do xslt transform. Like by disabling uri=http://xml.org/sax/features/external-general-entities" to not access sensitive local files.