Skip to content

Commit 8467d64

Browse files
committed
CAMEL-12444: Improved DTD handling in validator component.
1 parent b4c0fbb commit 8467d64

File tree

2 files changed

+14
-0
lines changed

2 files changed

+14
-0
lines changed

camel-core/src/main/java/org/apache/camel/processor/validation/SchemaReader.java

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -175,6 +175,7 @@ protected SchemaFactory createSchemaFactory() {
175175
}
176176
if (camelContext == null || !Boolean.parseBoolean(camelContext.getGlobalOptions().get(ACCESS_EXTERNAL_DTD))) {
177177
try {
178+
LOG.debug("Configuring SchemaFactory to not allow access to external DTD/Schema");
178179
factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
179180
} catch (SAXException e) {
180181
LOG.warn(e.getMessage(), e);

camel-core/src/main/java/org/apache/camel/processor/validation/ValidatingProcessor.java

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
import java.net.URL;
2323
import java.util.Collections;
2424

25+
import javax.xml.XMLConstants;
2526
import javax.xml.parsers.ParserConfigurationException;
2627
import javax.xml.transform.Result;
2728
import javax.xml.transform.Source;
@@ -53,6 +54,8 @@
5354
import org.slf4j.Logger;
5455
import org.slf4j.LoggerFactory;
5556

57+
import static org.apache.camel.processor.validation.SchemaReader.ACCESS_EXTERNAL_DTD;
58+
5659
/**
5760
* A processor which validates the XML version of the inbound message body
5861
* against some schema either in XSD or RelaxNG
@@ -100,6 +103,16 @@ protected void doProcess(Exchange exchange) throws Exception {
100103
}
101104

102105
Validator validator = schema.newValidator();
106+
// turn off access to external schema by default
107+
if (!Boolean.parseBoolean(exchange.getContext().getGlobalOptions().get(ACCESS_EXTERNAL_DTD))) {
108+
try {
109+
LOG.debug("Configuring Validator to not allow access to external DTD/Schema");
110+
validator.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
111+
validator.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
112+
} catch (SAXException e) {
113+
LOG.warn(e.getMessage(), e);
114+
}
115+
}
103116

104117
// the underlying input stream, which we need to close to avoid locking files or other resources
105118
Source source = null;

0 commit comments

Comments
 (0)