[backport camel-4.18.x] CAMEL-24677: camel-smooks - align XML reader configuration with the other XML components

[oscerd]

Backport of #26270 to camel-4.18.x.

Original PR: #26270 — CAMEL-24677
Original author: @oscerd

Not a straight cherry-pick — adapted for camel-4.18.x

• Security marker dropped: camel-4.18.x's @UriParam does not have the security / insecureValue attributes (that infrastructure is newer) and SecurityUtils does not exist on this branch, so the allowExternalEntities endpoint option is declared without them.
• JUnit 5: the new component test uses camel-test-junit5 (this branch uses JUnit 5; main uses JUnit 6).
• The main-only 4.23 upgrade-guide entry and generated files that do not exist on this branch (newer camel-java-io/camel-yaml-io writers, the canonical/model YAML schema variants) are excluded.

The runtime fix (hardened DOM pre-parse via SmooksSecuritySupport, applied only when the config uses the default XML reader) and the allowExternalEntities option are otherwise identical to the merged PR.

Verified on camel-4.18.x

A full mvn clean install -DskipTests passes on this branch, and all generated files (catalog, endpoint-DSL, YAML-DSL deserializers/schema, XSDs) are regenerated for camel-4.18.x. The two new XML-security tests pass, confirming external entities are not resolved by default and are resolved with allowExternalEntities=true.

As a non-mechanical backport, this needs a normal review (it is not eligible for the straight-cherry-pick fast path).

🤖 Generated with Claude Code

[gnodet-bot]

Clean security backport of #26270 to camel-4.18.x. Reviewed the 8 hand-written files (SmooksSecuritySupport, SmooksProcessor, SmooksEndpoint, SmooksDataFormat × model + runtime, SmooksDataFormatReifier, both security tests) and all generated artifacts.

Security architecture is sound:

• SmooksSecuritySupport is identical to main — correct use of DocumentBuilderFactory with all external entity features disabled, proper synchronized around the non-thread-safe factory, DocumentBuilder.parse() correctly outside the lock.
• hardenXmlInput flag computed once at doStart() — no per-message overhead when the config uses a custom reader (EDI/CSV/JSON).
• getSource() reordering in SmooksProcessor matches main: Node → hardenXmlInput → byte[] → InputStream, ensuring DOM payloads bypass the security pre-parse (they're already parsed).

Backport adaptations are correct:

• No security/insecureValue attributes on @UriParam (those don't exist on 4.18.x) — the security label is set via the label attribute instead.
• JUnit 5 test framework (vs JUnit 6 on main).
• Generated files are consistent with the 4.18.x code generators.

Wiring verified: SmooksComponent.configureSmooksProcessor() calls setProperties(smooksProcessor, parameters) which injects allowExternalEntities from endpoint URI parameters into the processor.

This review was generated by an AI agent, Hermès on behalf of @gnodet.

[gnodet-bot]

Solid backport of CAMEL-24677 (XXE hardening for camel-smooks) to camel-4.18.x. Reviewed the security implementation, API threading, concurrency, and backport adaptations — no issues found.

Security: SmooksSecuritySupport.createSecureDocumentBuilderFactory() correctly disables FEATURE_SECURE_PROCESSING, external general entities, external parameter entities, and external DTD loading. The defense-in-depth approach (swallowing ParserConfigurationException when a feature isn't recognized) is appropriate.

Concurrency: The shared DocumentBuilderFactory is correctly synchronized for newDocumentBuilder() calls, and the DocumentBuilder instance is used only within the calling thread.

Payload ordering in SmooksProcessor.getSource(): Moving the instanceof Node check before the hardenXmlInput path is correct — DOM payloads have no InputStream to parse and carry no XXE risk.

Backport adaptations: @UriParam uses label = "security" instead of the main-only security/insecureValue attributes. Tests correctly use camel-test-junit5. No SecurityUtils dependency (doesn't exist on this branch).

This review was generated by an AI agent, Hermès on behalf of @gnodet.