Quarkus Update led to net.sf.saxon.trans.XPathException: URI scheme 'file' has been disallowed #9182

Activity

1. dcheng1248

   added

   bugSomething isn't workingSomething isn't working

   on Sep 17, 2026
2. jamesnetherton commented on Sep 17, 2026

   

   jamesnetherton

   on Sep 17, 2026

   Contributor

   More actions

   I think it comes from the Camel 4.22.0 upgrade in Camel Quarkus 3.39.0.

   Camel now restricts the Saxon transformer's access to external resources by default. It's covered in the Camel 4.22 upgrade guide:

   https://camel.apache.org/manual/camel-4x-upgrade-guide-4_22.html#_camel_xslt_saxon_secure_processing_now_applied_unconditionally

   So either use your custom TransformerFactory bean workaround. Or perhaps better, use TransformerFactoryConfigurationStrategy. That way Camel will still apply its own security config.

   TransformerFactoryConfigurationStrategy bean:

   @Produces
   @Singleton
   @Unremovable
   @Named("allowFileAccess")
   public TransformerFactoryConfigurationStrategy allowFileAccess() {
       return (factory, endpoint) -> factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "file");
   }

   Route endpoint:

   to("xslt-saxon:my.xsl?transformerFactoryConfigurationStrategy=#allowFileAccess")

   There is also a secureProcessing=false option but it does not lift all of the required restrictions.