[CAMEL-19415] camel-stax: using xtokenize might be NPE on xml default namespace

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.25.4
• Fix Version/s: 3.14.9, 3.18.8, 3.20.6, 3.21.0, 4.0-RC1, 4.0.0
• Component/s: camel-stax

Environment

java 8

camel-core 2.25.4

woodstox-core-asl 4

woodstox-core 5/6

• Estimated Complexity: Unknown

Language

JAVA

• Assignee: Claus Ibsen
• Reporter: vincenttang
• Created: 05/Jun/23 13:14
• Updated: 12/Jun/23 01:45
• Resolved: 09/Jun/23 10:41

Description

Background:

camel-core use Woodstox to xtokenize the xml.

Woodstox has a property on WstxInputProperties.P_RETURN_NULL_FOR_DEFAULT_NAMESPACE

which has different value in different woodstox-core version.

—

Issue:

When using camel core to xtokenize xml, it will get the XML namespace prefix through javax.xml.stream.XMLStreamReader#getNamespacePrefix, which will use woodstox-core lib.

In org.apache.camel.support.XMLTokenExpressionIterator.XMLTokenIterator#createContextualToken with i mode,

It will then construct a namespace map and loop it .

In org.apache.camel.support.XMLTokenExpressionIterator line 404
sb.append(e.getKey().length() == 0 ? " xmlns" : " xmlns:")
As the e.getKey() has no null check, it might be null and resulting in NPE because of null.length()
—
Suggested Solution:
Add a null check at org.apache.camel.support.XMLTokenExpressionIterator line 404 e.getKey() to avoid NPE
i.e. sb.append((e.getKey() == null || e.getKey().length() == 0) ? " xmlns" : " xmlns:")