You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomee.apache.org by sgjava <sg...@gmail.com> on 2016/10/17 15:18:11 UTC
Cannot create a secure XMLInputFactory
Periodically I'm seeing "Cannot create a secure XMLInputFactory" in TomEE
7.0.2-SNAPSHOT. One solution is for CXF using
-Dorg.apache.cxf.stax.allowInsecureParser=1. This is an older 7.0.2 from
7/4/16.
--
View this message in context: http://tomee-openejb.979440.n4.nabble.com/Cannot-create-a-secure-XMLInputFactory-tp4680348.html
Sent from the TomEE Users mailing list archive at Nabble.com.
Re: Cannot create a secure XMLInputFactory
Posted by Christoph Nenning <Ch...@lex-com.net>.
> From: Steve Goldsmith <sg...@gmail.com>
> To: users@tomee.apache.org,
> Date: 18.10.2016 03:31
> Subject: Re: Cannot create a secure XMLInputFactory
>
> OK, I've built TomEE from source before, but I've not run it in debug
mode.
> Wouldn't it be just as easy to simply log vars f, p and o when I build
the
> source?
>
Hi,
when I want to debug tomee I usually do it like this:
- using my app-development eclipse
- prebuilt tomee setup in eclipse servers view
- beside my app projects I have another source-downloader project
- in that I configure those tomee dependencies which I want to debug (just
to have source available inside eclipse)
- open class of interesst with ctrl-shift-t
- set a breakpoint
- launch tomee in debug from servers view
- maybe trigger tomee code through my app
Regards,
Christoph
> On Mon, Oct 17, 2016 at 5:09 PM, Romain Manni-Bucau
<rm...@gmail.com>
> wrote:
>
> > cxf ones yes, that's as easy as adding cxf-core as provded dependency,
> > putting a breakpoint on the mentionned line normally and starting
tomee in
> > debug mode. Surely the most efficient way to solve it.
> >
> >
> > Romain Manni-Bucau
> > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > rmannibucau> |
> > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > <http://www.tomitribe.com> | JavaEE Factory
> > <https://javaeefactory-rmannibucau.rhcloud.com>
> >
> > 2016-10-17 22:52 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> >
> > > You mean set a breakpoint in TomEE source?
> > >
> > > On Mon, Oct 17, 2016 at 4:43 PM, Romain Manni-Bucau <
> > rmannibucau@gmail.com
> > > >
> > > wrote:
> > >
> > > > If you can put a breakpoint at
> > > > https://github.com/apache/cxf/blob/eab841d5477c5e1ed21a49918defa7
> > > > 9a0f1ad533/core/src/main/java/org/apache/cxf/staxutils/
> > > StaxUtils.java#L381
> > > > then you would know immediately why the throwable is thrown.
> > > >
> > > >
> > > > Romain Manni-Bucau
> > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > > rmannibucau> |
> > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > >
> > > > 2016-10-17 22:41 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > >
> > > > > OK, I made the following change and I still get the error:
> > > > >
> > > > > <dependency>
> > > > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > > > <artifactId>jaxb2-basics-runtime</artifactId>
> > > > > <version>0.10.0</version>
> > > > > <scope>provided</scope>
> > > > > </dependency>
> > > > >
> > > > > I even tried:
> > > > >
> > > > > <dependency>
> > > > > <groupId>org.apache.tomee</groupId>
> > > > > <artifactId>tomee-jaxrs</artifactId>
> > > > > <version>${tomee.version}</version>
> > > > > <scope>test</scope>
> > > > > <exclusions>
> > > > > <exclusion>
> > > > > <groupId>com.sun.xml.bind</groupId>
> > > > > <artifactId>jaxb-impl</artifactId>
> > > > > </exclusion>
> > > > > </exclusions>
> > > > > </dependency>
> > > > >
> > > > >
> > > > > On Mon, Oct 17, 2016 at 3:37 PM, Romain Manni-Bucau <
> > > > rmannibucau@gmail.com
> > > > > >
> > > > > wrote:
> > > > >
> > > > > > well jaxb is provided and shouldnt be delivered so you have to
> > remove
> > > > it
> > > > > > from WEB-INF/lib. scope=provided should be fine too.
> > > > > >
> > > > > >
> > > > > > Romain Manni-Bucau
> > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > > <http://rmannibucau.wordpress.com> | Github <
https://github.com/
> > > > > > rmannibucau> |
> > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
Tomitriber
> > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > >
> > > > > > 2016-10-17 20:07 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > > > >
> > > > > > > I need JAX-B runtime for code generated by
jaxws-maven-plugin and
> > > > XJC.
> > > > > > > Everything else is in test scope and not used in the
deployed
> > app.
> > > > > > >
> > > > > > > <dependency>
> > > > > > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > > > > > <artifactId>jaxb2-basics-runtime</artifactId>
> > > > > > > <version>0.10.0</version>
> > > > > > > </dependency>
> > > > > > >
> > > > > > >
> > > > > > > On Mon, Oct 17, 2016 at 1:57 PM, Romain Manni-Bucau <
> > > > > > rmannibucau@gmail.com
> > > > > > > >
> > > > > > > wrote:
> > > > > > >
> > > > > > > > yep so surely some part of the app running in a
conflicting
> > > > > > classloader.
> > > > > > > > Personally I'd just remove stax2-api, woodstox and jaxb to
> > start
> > > > > > > >
> > > > > > > >
> > > > > > > > Romain Manni-Bucau
> > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress
Blog
> > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > https://github.com/
> > > > > > > > rmannibucau> |
> > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > Tomitriber
> > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > >
> > > > > > > > 2016-10-17 19:47 GMT+02:00 Steve Goldsmith
<sg...@gmail.com>:
> > > > > > > >
> > > > > > > > > ~/java/apache-maven-3.3.9/bin/mvn dependency:tree |
egrep
> > > > > > > 'woo|xml|stax'
> > > > > > > > > [INFO] | | +-
javax.xml.bind:jaxb-api:jar:2.2.6:test
> > > > > > > > > [INFO] | | \-
com.sun.xml.bind:jaxb-impl:jar:2.2.6:test
> > > > > > > > > [INFO] | | | +- org.apache.santuario:xmlsec:
> > > > > jar:2.0.5:test
> > > > > > > > > [INFO] | | | | | +-
> > > > > > > > > org.opensaml:opensaml-xmlsec-api:jar:3.1.1:test
> > > > > > > > > [INFO] | | | | +-
org.opensaml:opensaml-xmlsec-
> > > > > > > > > impl:jar:3.1.1:test
> > > > > > > > > [INFO] | | +- org.apache.wss4j:wss4j-ws-
> > > > > > > > security-stax:jar:2.1.4:test
> > > > > > > > > [INFO] | | +-
> > > > > > > > > org.apache.wss4j:wss4j-ws-security-policy-stax:jar:2.1.
> > 4:test
> > > > > > > > > [INFO] | | | +-
xml-resolver:xml-resolver:jar:1.2:test
> > > > > > > > > [INFO] | | | +- org.apache.cxf:cxf-rt-
> > > > > > > bindings-xml:jar:3.1.6:test
> > > > > > > > > [INFO] | | \- com.sun.xml.messaging.saaj:
> > > > > > > saaj-impl:jar:1.3.18:test
> > > > > > > > > [INFO] | | | +- org.codehaus.woodstox:
> > > > > > > woodstox-core-asl:jar:4.4.1:
> > > > > > > > > test
> > > > > > > > > [INFO] | | | | \- org.codehaus.woodstox:stax2-
> > > > > > > api:jar:3.1.4:test
> > > > > > > > > [INFO] | | | \- org.apache.ws.xmlschema:
> > > > > > > > > xmlschema-core:jar:2.2.1:test
> > > > > > > > > [INFO] +-
> > > > > > > > > com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider:
> > > > > > jar:2.7.4:test
> > > > > > > > > [INFO] | +- com.fasterxml.jackson.jaxrs:
> > > > > > jackson-jaxrs-base:jar:2.7.4:
> > > > > > > > test
> > > > > > > > > [INFO] | +- com.fasterxml.jackson.core:
> > > > > jackson-core:jar:2.7.4:test
> > > > > > > > > [INFO] | +- com.fasterxml.jackson.core:
> > > > > jackson-databind:jar:2.7.4:
> > > > > > > test
> > > > > > > > > [INFO] | | \-
> > > > > > > > >
com.fasterxml.jackson.core:jackson-annotations:jar:2.7.0:
> > test
> > > > > > > > > [INFO] | \-
> > > > > > > > > com.fasterxml.jackson.module:jackson-module-jaxb-
> > > > > > > > > annotations:jar:2.7.4:test
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > On Mon, Oct 17, 2016 at 11:40 AM, Romain Manni-Bucau <
> > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > wrote:
> > > > > > > > >
> > > > > > > > > > mvn dependency:tree | egrep 'woo|xml|stax'
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress
> > Blog
> > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > https://github.com/
> > > > > > > > > > rmannibucau> |
> > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > > Tomitriber
> > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > >
> > > > > > > > > > 2016-10-17 17:36 GMT+02:00 Steve Goldsmith <
> > sgjava@gmail.com
> > > >:
> > > > > > > > > >
> > > > > > > > > > > My compile dependencies are (do you see anything
that
> > > sticks
> > > > > > out):
> > > > > > > > > > >
> > > > > > > > > > > <dependency>
> > > > > > > > > > > <groupId>org.jsr107.ri</groupId>
> > > > > > > > > > > <artifactId>cache-annotations-
> > > > ri-cdi</artifactId>
> > > > > > > > > > > <version>1.0.0</version>
> > > > > > > > > > > </dependency>
> > > > > > > > > > > <dependency>
> > > > > > > > > > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > > > > > > > > > <artifactId>jaxb2-basics-
> > runtime</artifactId>
> > > > > > > > > > > <version>0.10.0</version>
> > > > > > > > > > > </dependency>
> > > > > > > > > > > <dependency>
> > > > > > > > > > > <groupId>org.slf4j</groupId>
> > > > > > > > > > > <artifactId>slf4j-api</artifactId>
> > > > > > > > > > > <version>${slf4j.version}</version>
> > > > > > > > > > > </dependency>
> > > > > > > > > > > <dependency>
> > > > > > > > > > > <groupId>ch.qos.logback</groupId>
> > > > > > > > > > > <artifactId>logback-classic</artifactId>
> > > > > > > > > > > <version>${logback.version}</version>
> > > > > > > > > > > </dependency>
> > > > > > > > > > > <dependency>
> > > > > > > > > > > <groupId>ch.qos.logback</groupId>
> > > > > > > > > > > <artifactId>logback-core</artifactId>
> > > > > > > > > > > <version>${logback.version}</version>
> > > > > > > > > > > </dependency>
> > > > > > > > > > > <dependency>
> > > > > > > > > > > <groupId>org.apache.commons</groupId>
> > > > > > > > > > > <artifactId>commons-pool2</artifactId>
> > > > > > > > > > > <version>2.4.2</version>
> > > > > > > > > > > </dependency>
> > > > > > > > > > > <dependency>
> > > > > > > > > > > <groupId>commons-configuration</groupId>
> > > > > > > > > > > <artifactId>commons-
> > configuration</artifactId>
> > > > > > > > > > > <version>1.10</version>
> > > > > > > > > > > </dependency>
> > > > > > > > > > > <dependency>
> > > > > > > > > > > <groupId>org.jasypt</groupId>
> > > > > > > > > > > <artifactId>jasypt</artifactId>
> > > > > > > > > > > <version>1.9.3-SNAPSHOT</version>
> > > > > > > > > > > </dependency>
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > > On Mon, Oct 17, 2016 at 11:30 AM, Romain Manni-Bucau
<
> > > > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > > > wrote:
> > > > > > > > > > >
> > > > > > > > > > > > Hello
> > > > > > > > > > > >
> > > > > > > > > > > > can happen if you provide some xml libraries in
your
> > app
> > > -
> > > > > like
> > > > > > > > > > woodstox
> > > > > > > > > > > or
> > > > > > > > > > > > stax*api - and it conflicts at some point.
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> |
Blog
> > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old
Wordpress
> > > > Blog
> > > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > > https://github.com/
> > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau>
|
> > > > > > Tomitriber
> > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > > > >
> > > > > > > > > > > > 2016-10-17 17:18 GMT+02:00 sgjava
<sg...@gmail.com>:
> > > > > > > > > > > >
> > > > > > > > > > > > > Periodically I'm seeing "Cannot create a secure
> > > > > > > XMLInputFactory"
> > > > > > > > in
> > > > > > > > > > > TomEE
> > > > > > > > > > > > > 7.0.2-SNAPSHOT. One solution is for CXF using
> > > > > > > > > > > > > -Dorg.apache.cxf.stax.allowInsecureParser=1.
This is
> > > an
> > > > > > older
> > > > > > > > > 7.0.2
> > > > > > > > > > > from
> > > > > > > > > > > > > 7/4/16.
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > > --
> > > > > > > > > > > > > View this message in context:
> > > > http://tomee-openejb.979440.
> > > > > > > > > > > > > n4.nabble.com/Cannot-create-a-
> > secure-XMLInputFactory-
> > > > > > > > > tp4680348.html
> > > > > > > > > > > > > Sent from the TomEE Users mailing list archive
at
> > > > > Nabble.com.
> > > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > > --
> > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > >
> > > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > --
> > > > > > > > > Steven P. Goldsmith
> > > > > > > > >
> > > > > > > >
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > > --
> > > > > > > Steven P. Goldsmith
> > > > > > >
> > > > > >
> > > > >
> > > > >
> > > > >
> > > > > --
> > > > > Steven P. Goldsmith
> > > > >
> > > >
> > >
> > >
> > >
> > > --
> > > Steven P. Goldsmith
> > >
> >
>
>
>
> --
> Steven P. Goldsmith
This Email was scanned by Sophos Anti Virus
Re: Cannot create a secure XMLInputFactory
Posted by Steve Goldsmith <sg...@gmail.com>.
Nope, it's the same as the other services. I generate SOAP clients from
wsimport and use them in my REST services. I'm not explicitly messing with
threading or class loading. I'll see if I can get CXF debug logging in the
method you pointed out.
On Tue, Oct 18, 2016 at 10:04 AM, Romain Manni-Bucau <rm...@gmail.com>
wrote:
> depends what does this service. As mentionned it is a classloading issue so
> if you use some custom threading or loader this can be the cause.
>
>
> Romain Manni-Bucau
> @rmannibucau <https://twitter.com/rmannibucau> | Blog
> <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> <http://rmannibucau.wordpress.com> | Github <https://github.com/
> rmannibucau> |
> LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> <http://www.tomitribe.com> | JavaEE Factory
> <https://javaeefactory-rmannibucau.rhcloud.com>
>
> 2016-10-18 16:01 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
>
> > One thing that is weird is that it only effect one service on the same
> > endpoint I calling other services. Shouldn't this be happening with all
> my
> > services?
> >
> > On Tue, Oct 18, 2016 at 2:46 AM, Romain Manni-Bucau <
> rmannibucau@gmail.com
> > >
> > wrote:
> >
> > > As mentionned in the previous answer this is not in tomee sources but
> > CXF,
> > > agree it should be logged at debug level but with current code
> debugging
> > is
> > > the fastest.
> > >
> > > Side note: you dont need to build tomee from sources, just need to add
> > > cxf-core.
> > >
> > >
> > > Romain Manni-Bucau
> > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > rmannibucau> |
> > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > <http://www.tomitribe.com> | JavaEE Factory
> > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > >
> > > 2016-10-18 3:31 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > >
> > > > OK, I've built TomEE from source before, but I've not run it in debug
> > > mode.
> > > > Wouldn't it be just as easy to simply log vars f, p and o when I
> build
> > > the
> > > > source?
> > > >
> > > > On Mon, Oct 17, 2016 at 5:09 PM, Romain Manni-Bucau <
> > > rmannibucau@gmail.com
> > > > >
> > > > wrote:
> > > >
> > > > > cxf ones yes, that's as easy as adding cxf-core as provded
> > dependency,
> > > > > putting a breakpoint on the mentionned line normally and starting
> > tomee
> > > > in
> > > > > debug mode. Surely the most efficient way to solve it.
> > > > >
> > > > >
> > > > > Romain Manni-Bucau
> > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > > > rmannibucau> |
> > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > >
> > > > > 2016-10-17 22:52 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > > >
> > > > > > You mean set a breakpoint in TomEE source?
> > > > > >
> > > > > > On Mon, Oct 17, 2016 at 4:43 PM, Romain Manni-Bucau <
> > > > > rmannibucau@gmail.com
> > > > > > >
> > > > > > wrote:
> > > > > >
> > > > > > > If you can put a breakpoint at
> > > > > > > https://github.com/apache/cxf/blob/
> > eab841d5477c5e1ed21a49918defa7
> > > > > > > 9a0f1ad533/core/src/main/java/org/apache/cxf/staxutils/
> > > > > > StaxUtils.java#L381
> > > > > > > then you would know immediately why the throwable is thrown.
> > > > > > >
> > > > > > >
> > > > > > > Romain Manni-Bucau
> > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > > > <http://rmannibucau.wordpress.com> | Github <
> https://github.com/
> > > > > > > rmannibucau> |
> > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> Tomitriber
> > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > >
> > > > > > > 2016-10-17 22:41 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > > > > >
> > > > > > > > OK, I made the following change and I still get the error:
> > > > > > > >
> > > > > > > > <dependency>
> > > > > > > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > > > > > > <artifactId>jaxb2-basics-runtime</artifactId>
> > > > > > > > <version>0.10.0</version>
> > > > > > > > <scope>provided</scope>
> > > > > > > > </dependency>
> > > > > > > >
> > > > > > > > I even tried:
> > > > > > > >
> > > > > > > > <dependency>
> > > > > > > > <groupId>org.apache.tomee</groupId>
> > > > > > > > <artifactId>tomee-jaxrs</artifactId>
> > > > > > > > <version>${tomee.version}</version>
> > > > > > > > <scope>test</scope>
> > > > > > > > <exclusions>
> > > > > > > > <exclusion>
> > > > > > > > <groupId>com.sun.xml.bind</groupId>
> > > > > > > > <artifactId>jaxb-impl</artifactId>
> > > > > > > > </exclusion>
> > > > > > > > </exclusions>
> > > > > > > > </dependency>
> > > > > > > >
> > > > > > > >
> > > > > > > > On Mon, Oct 17, 2016 at 3:37 PM, Romain Manni-Bucau <
> > > > > > > rmannibucau@gmail.com
> > > > > > > > >
> > > > > > > > wrote:
> > > > > > > >
> > > > > > > > > well jaxb is provided and shouldnt be delivered so you have
> > to
> > > > > remove
> > > > > > > it
> > > > > > > > > from WEB-INF/lib. scope=provided should be fine too.
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > Romain Manni-Bucau
> > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress
> Blog
> > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > https://github.com/
> > > > > > > > > rmannibucau> |
> > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > Tomitriber
> > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > >
> > > > > > > > > 2016-10-17 20:07 GMT+02:00 Steve Goldsmith <
> sgjava@gmail.com
> > >:
> > > > > > > > >
> > > > > > > > > > I need JAX-B runtime for code generated by
> > jaxws-maven-plugin
> > > > and
> > > > > > > XJC.
> > > > > > > > > > Everything else is in test scope and not used in the
> > deployed
> > > > > app.
> > > > > > > > > >
> > > > > > > > > > <dependency>
> > > > > > > > > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > > > > > > > > <artifactId>jaxb2-basics-
> runtime</artifactId>
> > > > > > > > > > <version>0.10.0</version>
> > > > > > > > > > </dependency>
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > > On Mon, Oct 17, 2016 at 1:57 PM, Romain Manni-Bucau <
> > > > > > > > > rmannibucau@gmail.com
> > > > > > > > > > >
> > > > > > > > > > wrote:
> > > > > > > > > >
> > > > > > > > > > > yep so surely some part of the app running in a
> > conflicting
> > > > > > > > > classloader.
> > > > > > > > > > > Personally I'd just remove stax2-api, woodstox and jaxb
> > to
> > > > > start
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress
> > > Blog
> > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > https://github.com/
> > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > > > Tomitriber
> > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > > >
> > > > > > > > > > > 2016-10-17 19:47 GMT+02:00 Steve Goldsmith <
> > > sgjava@gmail.com
> > > > >:
> > > > > > > > > > >
> > > > > > > > > > > > ~/java/apache-maven-3.3.9/bin/mvn dependency:tree |
> > > egrep
> > > > > > > > > > 'woo|xml|stax'
> > > > > > > > > > > > [INFO] | | +- javax.xml.bind:jaxb-api:jar:2.
> > > 2.6:test
> > > > > > > > > > > > [INFO] | | \- com.sun.xml.bind:jaxb-impl:
> > > > jar:2.2.6:test
> > > > > > > > > > > > [INFO] | | | +- org.apache.santuario:xmlsec:
> > > > > > > > jar:2.0.5:test
> > > > > > > > > > > > [INFO] | | | | | +-
> > > > > > > > > > > > org.opensaml:opensaml-xmlsec-api:jar:3.1.1:test
> > > > > > > > > > > > [INFO] | | | | +-
> > org.opensaml:opensaml-xmlsec-
> > > > > > > > > > > > impl:jar:3.1.1:test
> > > > > > > > > > > > [INFO] | | +- org.apache.wss4j:wss4j-ws-
> > > > > > > > > > > security-stax:jar:2.1.4:test
> > > > > > > > > > > > [INFO] | | +-
> > > > > > > > > > > > org.apache.wss4j:wss4j-ws-
> > security-policy-stax:jar:2.1.
> > > > > 4:test
> > > > > > > > > > > > [INFO] | | | +- xml-resolver:xml-resolver:jar:
> > > > 1.2:test
> > > > > > > > > > > > [INFO] | | | +- org.apache.cxf:cxf-rt-
> > > > > > > > > > bindings-xml:jar:3.1.6:test
> > > > > > > > > > > > [INFO] | | \- com.sun.xml.messaging.saaj:
> > > > > > > > > > saaj-impl:jar:1.3.18:test
> > > > > > > > > > > > [INFO] | | | +- org.codehaus.woodstox:
> > > > > > > > > > woodstox-core-asl:jar:4.4.1:
> > > > > > > > > > > > test
> > > > > > > > > > > > [INFO] | | | | \- org.codehaus.woodstox:stax2-
> > > > > > > > > > api:jar:3.1.4:test
> > > > > > > > > > > > [INFO] | | | \- org.apache.ws.xmlschema:
> > > > > > > > > > > > xmlschema-core:jar:2.2.1:test
> > > > > > > > > > > > [INFO] +-
> > > > > > > > > > > > com.fasterxml.jackson.jaxrs:
> > jackson-jaxrs-json-provider:
> > > > > > > > > jar:2.7.4:test
> > > > > > > > > > > > [INFO] | +- com.fasterxml.jackson.jaxrs:
> > > > > > > > > jackson-jaxrs-base:jar:2.7.4:
> > > > > > > > > > > test
> > > > > > > > > > > > [INFO] | +- com.fasterxml.jackson.core:
> > > > > > > > jackson-core:jar:2.7.4:test
> > > > > > > > > > > > [INFO] | +- com.fasterxml.jackson.core:
> > > > > > > > jackson-databind:jar:2.7.4:
> > > > > > > > > > test
> > > > > > > > > > > > [INFO] | | \-
> > > > > > > > > > > > com.fasterxml.jackson.core:
> > > jackson-annotations:jar:2.7.0:
> > > > > test
> > > > > > > > > > > > [INFO] | \-
> > > > > > > > > > > > com.fasterxml.jackson.module:jackson-module-jaxb-
> > > > > > > > > > > > annotations:jar:2.7.4:test
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > > On Mon, Oct 17, 2016 at 11:40 AM, Romain Manni-Bucau
> <
> > > > > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > > > > wrote:
> > > > > > > > > > > >
> > > > > > > > > > > > > mvn dependency:tree | egrep 'woo|xml|stax'
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> |
> > Blog
> > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old
> > Wordpress
> > > > > Blog
> > > > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > > > https://github.com/
> > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau>
> |
> > > > > > > Tomitriber
> > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > > > > >
> > > > > > > > > > > > > 2016-10-17 17:36 GMT+02:00 Steve Goldsmith <
> > > > > sgjava@gmail.com
> > > > > > >:
> > > > > > > > > > > > >
> > > > > > > > > > > > > > My compile dependencies are (do you see anything
> > that
> > > > > > sticks
> > > > > > > > > out):
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > <groupId>org.jsr107.ri</groupId>
> > > > > > > > > > > > > > <artifactId>cache-annotations-
> > > > > > > ri-cdi</artifactId>
> > > > > > > > > > > > > > <version>1.0.0</version>
> > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > <groupId>org.jvnet.jaxb2_
> > > commons</groupId>
> > > > > > > > > > > > > > <artifactId>jaxb2-basics-
> > > > > runtime</artifactId>
> > > > > > > > > > > > > > <version>0.10.0</version>
> > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > <groupId>org.slf4j</groupId>
> > > > > > > > > > > > > > <artifactId>slf4j-api</artifactId>
> > > > > > > > > > > > > > <version>${slf4j.version}</version>
> > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > <groupId>ch.qos.logback</groupId>
> > > > > > > > > > > > > > <artifactId>logback-classic</
> > artifactId>
> > > > > > > > > > > > > > <version>${logback.version}</
> version>
> > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > <groupId>ch.qos.logback</groupId>
> > > > > > > > > > > > > > <artifactId>logback-core</
> artifactId>
> > > > > > > > > > > > > > <version>${logback.version}</
> version>
> > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > <groupId>org.apache.commons</
> groupId>
> > > > > > > > > > > > > > <artifactId>commons-pool2</
> artifactId>
> > > > > > > > > > > > > > <version>2.4.2</version>
> > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > <groupId>commons-
> > configuration</groupId>
> > > > > > > > > > > > > > <artifactId>commons-
> > > > > configuration</artifactId>
> > > > > > > > > > > > > > <version>1.10</version>
> > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > <groupId>org.jasypt</groupId>
> > > > > > > > > > > > > > <artifactId>jasypt</artifactId>
> > > > > > > > > > > > > > <version>1.9.3-SNAPSHOT</version>
> > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > On Mon, Oct 17, 2016 at 11:30 AM, Romain
> > Manni-Bucau
> > > <
> > > > > > > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > > > > > > wrote:
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > > Hello
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > can happen if you provide some xml libraries in
> > > your
> > > > > app
> > > > > > -
> > > > > > > > like
> > > > > > > > > > > > > woodstox
> > > > > > > > > > > > > > or
> > > > > > > > > > > > > > > stax*api - and it conflicts at some point.
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau>
> |
> > > > Blog
> > > > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old
> > > > Wordpress
> > > > > > > Blog
> > > > > > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > > > > > https://github.com/
> > > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/
> > rmannibucau>
> > > |
> > > > > > > > > Tomitriber
> > > > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com
> >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > 2016-10-17 17:18 GMT+02:00 sgjava <
> > > sgjava@gmail.com
> > > > >:
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > Periodically I'm seeing "Cannot create a
> secure
> > > > > > > > > > XMLInputFactory"
> > > > > > > > > > > in
> > > > > > > > > > > > > > TomEE
> > > > > > > > > > > > > > > > 7.0.2-SNAPSHOT. One solution is for CXF using
> > > > > > > > > > > > > > > > -Dorg.apache.cxf.stax.allowInsecureParser=1.
> > > This
> > > > is
> > > > > > an
> > > > > > > > > older
> > > > > > > > > > > > 7.0.2
> > > > > > > > > > > > > > from
> > > > > > > > > > > > > > > > 7/4/16.
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > > View this message in context:
> > > > > > > http://tomee-openejb.979440.
> > > > > > > > > > > > > > > > n4.nabble.com/Cannot-create-a-
> > > > > secure-XMLInputFactory-
> > > > > > > > > > > > tp4680348.html
> > > > > > > > > > > > > > > > Sent from the TomEE Users mailing list
> archive
> > at
> > > > > > > > Nabble.com.
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > --
> > > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > > --
> > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > > --
> > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > >
> > > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > > --
> > > > > > > > Steven P. Goldsmith
> > > > > > > >
> > > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > > --
> > > > > > Steven P. Goldsmith
> > > > > >
> > > > >
> > > >
> > > >
> > > >
> > > > --
> > > > Steven P. Goldsmith
> > > >
> > >
> >
> >
> >
> > --
> > Steven P. Goldsmith
> >
>
--
Steven P. Goldsmith
Re: Cannot create a secure XMLInputFactory
Posted by Romain Manni-Bucau <rm...@gmail.com>.
depends what does this service. As mentionned it is a classloading issue so
if you use some custom threading or loader this can be the cause.
Romain Manni-Bucau
@rmannibucau <https://twitter.com/rmannibucau> | Blog
<https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
<http://rmannibucau.wordpress.com> | Github <https://github.com/rmannibucau> |
LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
<http://www.tomitribe.com> | JavaEE Factory
<https://javaeefactory-rmannibucau.rhcloud.com>
2016-10-18 16:01 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> One thing that is weird is that it only effect one service on the same
> endpoint I calling other services. Shouldn't this be happening with all my
> services?
>
> On Tue, Oct 18, 2016 at 2:46 AM, Romain Manni-Bucau <rmannibucau@gmail.com
> >
> wrote:
>
> > As mentionned in the previous answer this is not in tomee sources but
> CXF,
> > agree it should be logged at debug level but with current code debugging
> is
> > the fastest.
> >
> > Side note: you dont need to build tomee from sources, just need to add
> > cxf-core.
> >
> >
> > Romain Manni-Bucau
> > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > rmannibucau> |
> > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > <http://www.tomitribe.com> | JavaEE Factory
> > <https://javaeefactory-rmannibucau.rhcloud.com>
> >
> > 2016-10-18 3:31 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> >
> > > OK, I've built TomEE from source before, but I've not run it in debug
> > mode.
> > > Wouldn't it be just as easy to simply log vars f, p and o when I build
> > the
> > > source?
> > >
> > > On Mon, Oct 17, 2016 at 5:09 PM, Romain Manni-Bucau <
> > rmannibucau@gmail.com
> > > >
> > > wrote:
> > >
> > > > cxf ones yes, that's as easy as adding cxf-core as provded
> dependency,
> > > > putting a breakpoint on the mentionned line normally and starting
> tomee
> > > in
> > > > debug mode. Surely the most efficient way to solve it.
> > > >
> > > >
> > > > Romain Manni-Bucau
> > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > > rmannibucau> |
> > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > >
> > > > 2016-10-17 22:52 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > >
> > > > > You mean set a breakpoint in TomEE source?
> > > > >
> > > > > On Mon, Oct 17, 2016 at 4:43 PM, Romain Manni-Bucau <
> > > > rmannibucau@gmail.com
> > > > > >
> > > > > wrote:
> > > > >
> > > > > > If you can put a breakpoint at
> > > > > > https://github.com/apache/cxf/blob/
> eab841d5477c5e1ed21a49918defa7
> > > > > > 9a0f1ad533/core/src/main/java/org/apache/cxf/staxutils/
> > > > > StaxUtils.java#L381
> > > > > > then you would know immediately why the throwable is thrown.
> > > > > >
> > > > > >
> > > > > > Romain Manni-Bucau
> > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > > > > rmannibucau> |
> > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > >
> > > > > > 2016-10-17 22:41 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > > > >
> > > > > > > OK, I made the following change and I still get the error:
> > > > > > >
> > > > > > > <dependency>
> > > > > > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > > > > > <artifactId>jaxb2-basics-runtime</artifactId>
> > > > > > > <version>0.10.0</version>
> > > > > > > <scope>provided</scope>
> > > > > > > </dependency>
> > > > > > >
> > > > > > > I even tried:
> > > > > > >
> > > > > > > <dependency>
> > > > > > > <groupId>org.apache.tomee</groupId>
> > > > > > > <artifactId>tomee-jaxrs</artifactId>
> > > > > > > <version>${tomee.version}</version>
> > > > > > > <scope>test</scope>
> > > > > > > <exclusions>
> > > > > > > <exclusion>
> > > > > > > <groupId>com.sun.xml.bind</groupId>
> > > > > > > <artifactId>jaxb-impl</artifactId>
> > > > > > > </exclusion>
> > > > > > > </exclusions>
> > > > > > > </dependency>
> > > > > > >
> > > > > > >
> > > > > > > On Mon, Oct 17, 2016 at 3:37 PM, Romain Manni-Bucau <
> > > > > > rmannibucau@gmail.com
> > > > > > > >
> > > > > > > wrote:
> > > > > > >
> > > > > > > > well jaxb is provided and shouldnt be delivered so you have
> to
> > > > remove
> > > > > > it
> > > > > > > > from WEB-INF/lib. scope=provided should be fine too.
> > > > > > > >
> > > > > > > >
> > > > > > > > Romain Manni-Bucau
> > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > https://github.com/
> > > > > > > > rmannibucau> |
> > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > Tomitriber
> > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > >
> > > > > > > > 2016-10-17 20:07 GMT+02:00 Steve Goldsmith <sgjava@gmail.com
> >:
> > > > > > > >
> > > > > > > > > I need JAX-B runtime for code generated by
> jaxws-maven-plugin
> > > and
> > > > > > XJC.
> > > > > > > > > Everything else is in test scope and not used in the
> deployed
> > > > app.
> > > > > > > > >
> > > > > > > > > <dependency>
> > > > > > > > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > > > > > > > <artifactId>jaxb2-basics-runtime</artifactId>
> > > > > > > > > <version>0.10.0</version>
> > > > > > > > > </dependency>
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > On Mon, Oct 17, 2016 at 1:57 PM, Romain Manni-Bucau <
> > > > > > > > rmannibucau@gmail.com
> > > > > > > > > >
> > > > > > > > > wrote:
> > > > > > > > >
> > > > > > > > > > yep so surely some part of the app running in a
> conflicting
> > > > > > > > classloader.
> > > > > > > > > > Personally I'd just remove stax2-api, woodstox and jaxb
> to
> > > > start
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress
> > Blog
> > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > https://github.com/
> > > > > > > > > > rmannibucau> |
> > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > > Tomitriber
> > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > >
> > > > > > > > > > 2016-10-17 19:47 GMT+02:00 Steve Goldsmith <
> > sgjava@gmail.com
> > > >:
> > > > > > > > > >
> > > > > > > > > > > ~/java/apache-maven-3.3.9/bin/mvn dependency:tree |
> > egrep
> > > > > > > > > 'woo|xml|stax'
> > > > > > > > > > > [INFO] | | +- javax.xml.bind:jaxb-api:jar:2.
> > 2.6:test
> > > > > > > > > > > [INFO] | | \- com.sun.xml.bind:jaxb-impl:
> > > jar:2.2.6:test
> > > > > > > > > > > [INFO] | | | +- org.apache.santuario:xmlsec:
> > > > > > > jar:2.0.5:test
> > > > > > > > > > > [INFO] | | | | | +-
> > > > > > > > > > > org.opensaml:opensaml-xmlsec-api:jar:3.1.1:test
> > > > > > > > > > > [INFO] | | | | +-
> org.opensaml:opensaml-xmlsec-
> > > > > > > > > > > impl:jar:3.1.1:test
> > > > > > > > > > > [INFO] | | +- org.apache.wss4j:wss4j-ws-
> > > > > > > > > > security-stax:jar:2.1.4:test
> > > > > > > > > > > [INFO] | | +-
> > > > > > > > > > > org.apache.wss4j:wss4j-ws-
> security-policy-stax:jar:2.1.
> > > > 4:test
> > > > > > > > > > > [INFO] | | | +- xml-resolver:xml-resolver:jar:
> > > 1.2:test
> > > > > > > > > > > [INFO] | | | +- org.apache.cxf:cxf-rt-
> > > > > > > > > bindings-xml:jar:3.1.6:test
> > > > > > > > > > > [INFO] | | \- com.sun.xml.messaging.saaj:
> > > > > > > > > saaj-impl:jar:1.3.18:test
> > > > > > > > > > > [INFO] | | | +- org.codehaus.woodstox:
> > > > > > > > > woodstox-core-asl:jar:4.4.1:
> > > > > > > > > > > test
> > > > > > > > > > > [INFO] | | | | \- org.codehaus.woodstox:stax2-
> > > > > > > > > api:jar:3.1.4:test
> > > > > > > > > > > [INFO] | | | \- org.apache.ws.xmlschema:
> > > > > > > > > > > xmlschema-core:jar:2.2.1:test
> > > > > > > > > > > [INFO] +-
> > > > > > > > > > > com.fasterxml.jackson.jaxrs:
> jackson-jaxrs-json-provider:
> > > > > > > > jar:2.7.4:test
> > > > > > > > > > > [INFO] | +- com.fasterxml.jackson.jaxrs:
> > > > > > > > jackson-jaxrs-base:jar:2.7.4:
> > > > > > > > > > test
> > > > > > > > > > > [INFO] | +- com.fasterxml.jackson.core:
> > > > > > > jackson-core:jar:2.7.4:test
> > > > > > > > > > > [INFO] | +- com.fasterxml.jackson.core:
> > > > > > > jackson-databind:jar:2.7.4:
> > > > > > > > > test
> > > > > > > > > > > [INFO] | | \-
> > > > > > > > > > > com.fasterxml.jackson.core:
> > jackson-annotations:jar:2.7.0:
> > > > test
> > > > > > > > > > > [INFO] | \-
> > > > > > > > > > > com.fasterxml.jackson.module:jackson-module-jaxb-
> > > > > > > > > > > annotations:jar:2.7.4:test
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > > On Mon, Oct 17, 2016 at 11:40 AM, Romain Manni-Bucau <
> > > > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > > > wrote:
> > > > > > > > > > >
> > > > > > > > > > > > mvn dependency:tree | egrep 'woo|xml|stax'
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> |
> Blog
> > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old
> Wordpress
> > > > Blog
> > > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > > https://github.com/
> > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > > > > Tomitriber
> > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > > > >
> > > > > > > > > > > > 2016-10-17 17:36 GMT+02:00 Steve Goldsmith <
> > > > sgjava@gmail.com
> > > > > >:
> > > > > > > > > > > >
> > > > > > > > > > > > > My compile dependencies are (do you see anything
> that
> > > > > sticks
> > > > > > > > out):
> > > > > > > > > > > > >
> > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > <groupId>org.jsr107.ri</groupId>
> > > > > > > > > > > > > <artifactId>cache-annotations-
> > > > > > ri-cdi</artifactId>
> > > > > > > > > > > > > <version>1.0.0</version>
> > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > <groupId>org.jvnet.jaxb2_
> > commons</groupId>
> > > > > > > > > > > > > <artifactId>jaxb2-basics-
> > > > runtime</artifactId>
> > > > > > > > > > > > > <version>0.10.0</version>
> > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > <groupId>org.slf4j</groupId>
> > > > > > > > > > > > > <artifactId>slf4j-api</artifactId>
> > > > > > > > > > > > > <version>${slf4j.version}</version>
> > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > <groupId>ch.qos.logback</groupId>
> > > > > > > > > > > > > <artifactId>logback-classic</
> artifactId>
> > > > > > > > > > > > > <version>${logback.version}</version>
> > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > <groupId>ch.qos.logback</groupId>
> > > > > > > > > > > > > <artifactId>logback-core</artifactId>
> > > > > > > > > > > > > <version>${logback.version}</version>
> > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > <groupId>org.apache.commons</groupId>
> > > > > > > > > > > > > <artifactId>commons-pool2</artifactId>
> > > > > > > > > > > > > <version>2.4.2</version>
> > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > <groupId>commons-
> configuration</groupId>
> > > > > > > > > > > > > <artifactId>commons-
> > > > configuration</artifactId>
> > > > > > > > > > > > > <version>1.10</version>
> > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > <groupId>org.jasypt</groupId>
> > > > > > > > > > > > > <artifactId>jasypt</artifactId>
> > > > > > > > > > > > > <version>1.9.3-SNAPSHOT</version>
> > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > > On Mon, Oct 17, 2016 at 11:30 AM, Romain
> Manni-Bucau
> > <
> > > > > > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > > > > > wrote:
> > > > > > > > > > > > >
> > > > > > > > > > > > > > Hello
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > can happen if you provide some xml libraries in
> > your
> > > > app
> > > > > -
> > > > > > > like
> > > > > > > > > > > > woodstox
> > > > > > > > > > > > > or
> > > > > > > > > > > > > > stax*api - and it conflicts at some point.
> > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> |
> > > Blog
> > > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old
> > > Wordpress
> > > > > > Blog
> > > > > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > > > > https://github.com/
> > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/
> rmannibucau>
> > |
> > > > > > > > Tomitriber
> > > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > 2016-10-17 17:18 GMT+02:00 sgjava <
> > sgjava@gmail.com
> > > >:
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > > Periodically I'm seeing "Cannot create a secure
> > > > > > > > > XMLInputFactory"
> > > > > > > > > > in
> > > > > > > > > > > > > TomEE
> > > > > > > > > > > > > > > 7.0.2-SNAPSHOT. One solution is for CXF using
> > > > > > > > > > > > > > > -Dorg.apache.cxf.stax.allowInsecureParser=1.
> > This
> > > is
> > > > > an
> > > > > > > > older
> > > > > > > > > > > 7.0.2
> > > > > > > > > > > > > from
> > > > > > > > > > > > > > > 7/4/16.
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > View this message in context:
> > > > > > http://tomee-openejb.979440.
> > > > > > > > > > > > > > > n4.nabble.com/Cannot-create-a-
> > > > secure-XMLInputFactory-
> > > > > > > > > > > tp4680348.html
> > > > > > > > > > > > > > > Sent from the TomEE Users mailing list archive
> at
> > > > > > > Nabble.com.
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > > --
> > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > > --
> > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > >
> > > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > --
> > > > > > > > > Steven P. Goldsmith
> > > > > > > > >
> > > > > > > >
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > > --
> > > > > > > Steven P. Goldsmith
> > > > > > >
> > > > > >
> > > > >
> > > > >
> > > > >
> > > > > --
> > > > > Steven P. Goldsmith
> > > > >
> > > >
> > >
> > >
> > >
> > > --
> > > Steven P. Goldsmith
> > >
> >
>
>
>
> --
> Steven P. Goldsmith
>
Re: Cannot create a secure XMLInputFactory
Posted by Steve Goldsmith <sg...@gmail.com>.
One thing that is weird is that it only effect one service on the same
endpoint I calling other services. Shouldn't this be happening with all my
services?
On Tue, Oct 18, 2016 at 2:46 AM, Romain Manni-Bucau <rm...@gmail.com>
wrote:
> As mentionned in the previous answer this is not in tomee sources but CXF,
> agree it should be logged at debug level but with current code debugging is
> the fastest.
>
> Side note: you dont need to build tomee from sources, just need to add
> cxf-core.
>
>
> Romain Manni-Bucau
> @rmannibucau <https://twitter.com/rmannibucau> | Blog
> <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> <http://rmannibucau.wordpress.com> | Github <https://github.com/
> rmannibucau> |
> LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> <http://www.tomitribe.com> | JavaEE Factory
> <https://javaeefactory-rmannibucau.rhcloud.com>
>
> 2016-10-18 3:31 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
>
> > OK, I've built TomEE from source before, but I've not run it in debug
> mode.
> > Wouldn't it be just as easy to simply log vars f, p and o when I build
> the
> > source?
> >
> > On Mon, Oct 17, 2016 at 5:09 PM, Romain Manni-Bucau <
> rmannibucau@gmail.com
> > >
> > wrote:
> >
> > > cxf ones yes, that's as easy as adding cxf-core as provded dependency,
> > > putting a breakpoint on the mentionned line normally and starting tomee
> > in
> > > debug mode. Surely the most efficient way to solve it.
> > >
> > >
> > > Romain Manni-Bucau
> > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > rmannibucau> |
> > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > <http://www.tomitribe.com> | JavaEE Factory
> > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > >
> > > 2016-10-17 22:52 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > >
> > > > You mean set a breakpoint in TomEE source?
> > > >
> > > > On Mon, Oct 17, 2016 at 4:43 PM, Romain Manni-Bucau <
> > > rmannibucau@gmail.com
> > > > >
> > > > wrote:
> > > >
> > > > > If you can put a breakpoint at
> > > > > https://github.com/apache/cxf/blob/eab841d5477c5e1ed21a49918defa7
> > > > > 9a0f1ad533/core/src/main/java/org/apache/cxf/staxutils/
> > > > StaxUtils.java#L381
> > > > > then you would know immediately why the throwable is thrown.
> > > > >
> > > > >
> > > > > Romain Manni-Bucau
> > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > > > rmannibucau> |
> > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > >
> > > > > 2016-10-17 22:41 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > > >
> > > > > > OK, I made the following change and I still get the error:
> > > > > >
> > > > > > <dependency>
> > > > > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > > > > <artifactId>jaxb2-basics-runtime</artifactId>
> > > > > > <version>0.10.0</version>
> > > > > > <scope>provided</scope>
> > > > > > </dependency>
> > > > > >
> > > > > > I even tried:
> > > > > >
> > > > > > <dependency>
> > > > > > <groupId>org.apache.tomee</groupId>
> > > > > > <artifactId>tomee-jaxrs</artifactId>
> > > > > > <version>${tomee.version}</version>
> > > > > > <scope>test</scope>
> > > > > > <exclusions>
> > > > > > <exclusion>
> > > > > > <groupId>com.sun.xml.bind</groupId>
> > > > > > <artifactId>jaxb-impl</artifactId>
> > > > > > </exclusion>
> > > > > > </exclusions>
> > > > > > </dependency>
> > > > > >
> > > > > >
> > > > > > On Mon, Oct 17, 2016 at 3:37 PM, Romain Manni-Bucau <
> > > > > rmannibucau@gmail.com
> > > > > > >
> > > > > > wrote:
> > > > > >
> > > > > > > well jaxb is provided and shouldnt be delivered so you have to
> > > remove
> > > > > it
> > > > > > > from WEB-INF/lib. scope=provided should be fine too.
> > > > > > >
> > > > > > >
> > > > > > > Romain Manni-Bucau
> > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > > > <http://rmannibucau.wordpress.com> | Github <
> https://github.com/
> > > > > > > rmannibucau> |
> > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> Tomitriber
> > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > >
> > > > > > > 2016-10-17 20:07 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > > > > >
> > > > > > > > I need JAX-B runtime for code generated by jaxws-maven-plugin
> > and
> > > > > XJC.
> > > > > > > > Everything else is in test scope and not used in the deployed
> > > app.
> > > > > > > >
> > > > > > > > <dependency>
> > > > > > > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > > > > > > <artifactId>jaxb2-basics-runtime</artifactId>
> > > > > > > > <version>0.10.0</version>
> > > > > > > > </dependency>
> > > > > > > >
> > > > > > > >
> > > > > > > > On Mon, Oct 17, 2016 at 1:57 PM, Romain Manni-Bucau <
> > > > > > > rmannibucau@gmail.com
> > > > > > > > >
> > > > > > > > wrote:
> > > > > > > >
> > > > > > > > > yep so surely some part of the app running in a conflicting
> > > > > > > classloader.
> > > > > > > > > Personally I'd just remove stax2-api, woodstox and jaxb to
> > > start
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > Romain Manni-Bucau
> > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress
> Blog
> > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > https://github.com/
> > > > > > > > > rmannibucau> |
> > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > Tomitriber
> > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > >
> > > > > > > > > 2016-10-17 19:47 GMT+02:00 Steve Goldsmith <
> sgjava@gmail.com
> > >:
> > > > > > > > >
> > > > > > > > > > ~/java/apache-maven-3.3.9/bin/mvn dependency:tree |
> egrep
> > > > > > > > 'woo|xml|stax'
> > > > > > > > > > [INFO] | | +- javax.xml.bind:jaxb-api:jar:2.
> 2.6:test
> > > > > > > > > > [INFO] | | \- com.sun.xml.bind:jaxb-impl:
> > jar:2.2.6:test
> > > > > > > > > > [INFO] | | | +- org.apache.santuario:xmlsec:
> > > > > > jar:2.0.5:test
> > > > > > > > > > [INFO] | | | | | +-
> > > > > > > > > > org.opensaml:opensaml-xmlsec-api:jar:3.1.1:test
> > > > > > > > > > [INFO] | | | | +- org.opensaml:opensaml-xmlsec-
> > > > > > > > > > impl:jar:3.1.1:test
> > > > > > > > > > [INFO] | | +- org.apache.wss4j:wss4j-ws-
> > > > > > > > > security-stax:jar:2.1.4:test
> > > > > > > > > > [INFO] | | +-
> > > > > > > > > > org.apache.wss4j:wss4j-ws-security-policy-stax:jar:2.1.
> > > 4:test
> > > > > > > > > > [INFO] | | | +- xml-resolver:xml-resolver:jar:
> > 1.2:test
> > > > > > > > > > [INFO] | | | +- org.apache.cxf:cxf-rt-
> > > > > > > > bindings-xml:jar:3.1.6:test
> > > > > > > > > > [INFO] | | \- com.sun.xml.messaging.saaj:
> > > > > > > > saaj-impl:jar:1.3.18:test
> > > > > > > > > > [INFO] | | | +- org.codehaus.woodstox:
> > > > > > > > woodstox-core-asl:jar:4.4.1:
> > > > > > > > > > test
> > > > > > > > > > [INFO] | | | | \- org.codehaus.woodstox:stax2-
> > > > > > > > api:jar:3.1.4:test
> > > > > > > > > > [INFO] | | | \- org.apache.ws.xmlschema:
> > > > > > > > > > xmlschema-core:jar:2.2.1:test
> > > > > > > > > > [INFO] +-
> > > > > > > > > > com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider:
> > > > > > > jar:2.7.4:test
> > > > > > > > > > [INFO] | +- com.fasterxml.jackson.jaxrs:
> > > > > > > jackson-jaxrs-base:jar:2.7.4:
> > > > > > > > > test
> > > > > > > > > > [INFO] | +- com.fasterxml.jackson.core:
> > > > > > jackson-core:jar:2.7.4:test
> > > > > > > > > > [INFO] | +- com.fasterxml.jackson.core:
> > > > > > jackson-databind:jar:2.7.4:
> > > > > > > > test
> > > > > > > > > > [INFO] | | \-
> > > > > > > > > > com.fasterxml.jackson.core:
> jackson-annotations:jar:2.7.0:
> > > test
> > > > > > > > > > [INFO] | \-
> > > > > > > > > > com.fasterxml.jackson.module:jackson-module-jaxb-
> > > > > > > > > > annotations:jar:2.7.4:test
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > > On Mon, Oct 17, 2016 at 11:40 AM, Romain Manni-Bucau <
> > > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > > wrote:
> > > > > > > > > >
> > > > > > > > > > > mvn dependency:tree | egrep 'woo|xml|stax'
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress
> > > Blog
> > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > https://github.com/
> > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > > > Tomitriber
> > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > > >
> > > > > > > > > > > 2016-10-17 17:36 GMT+02:00 Steve Goldsmith <
> > > sgjava@gmail.com
> > > > >:
> > > > > > > > > > >
> > > > > > > > > > > > My compile dependencies are (do you see anything that
> > > > sticks
> > > > > > > out):
> > > > > > > > > > > >
> > > > > > > > > > > > <dependency>
> > > > > > > > > > > > <groupId>org.jsr107.ri</groupId>
> > > > > > > > > > > > <artifactId>cache-annotations-
> > > > > ri-cdi</artifactId>
> > > > > > > > > > > > <version>1.0.0</version>
> > > > > > > > > > > > </dependency>
> > > > > > > > > > > > <dependency>
> > > > > > > > > > > > <groupId>org.jvnet.jaxb2_
> commons</groupId>
> > > > > > > > > > > > <artifactId>jaxb2-basics-
> > > runtime</artifactId>
> > > > > > > > > > > > <version>0.10.0</version>
> > > > > > > > > > > > </dependency>
> > > > > > > > > > > > <dependency>
> > > > > > > > > > > > <groupId>org.slf4j</groupId>
> > > > > > > > > > > > <artifactId>slf4j-api</artifactId>
> > > > > > > > > > > > <version>${slf4j.version}</version>
> > > > > > > > > > > > </dependency>
> > > > > > > > > > > > <dependency>
> > > > > > > > > > > > <groupId>ch.qos.logback</groupId>
> > > > > > > > > > > > <artifactId>logback-classic</artifactId>
> > > > > > > > > > > > <version>${logback.version}</version>
> > > > > > > > > > > > </dependency>
> > > > > > > > > > > > <dependency>
> > > > > > > > > > > > <groupId>ch.qos.logback</groupId>
> > > > > > > > > > > > <artifactId>logback-core</artifactId>
> > > > > > > > > > > > <version>${logback.version}</version>
> > > > > > > > > > > > </dependency>
> > > > > > > > > > > > <dependency>
> > > > > > > > > > > > <groupId>org.apache.commons</groupId>
> > > > > > > > > > > > <artifactId>commons-pool2</artifactId>
> > > > > > > > > > > > <version>2.4.2</version>
> > > > > > > > > > > > </dependency>
> > > > > > > > > > > > <dependency>
> > > > > > > > > > > > <groupId>commons-configuration</groupId>
> > > > > > > > > > > > <artifactId>commons-
> > > configuration</artifactId>
> > > > > > > > > > > > <version>1.10</version>
> > > > > > > > > > > > </dependency>
> > > > > > > > > > > > <dependency>
> > > > > > > > > > > > <groupId>org.jasypt</groupId>
> > > > > > > > > > > > <artifactId>jasypt</artifactId>
> > > > > > > > > > > > <version>1.9.3-SNAPSHOT</version>
> > > > > > > > > > > > </dependency>
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > > On Mon, Oct 17, 2016 at 11:30 AM, Romain Manni-Bucau
> <
> > > > > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > > > > wrote:
> > > > > > > > > > > >
> > > > > > > > > > > > > Hello
> > > > > > > > > > > > >
> > > > > > > > > > > > > can happen if you provide some xml libraries in
> your
> > > app
> > > > -
> > > > > > like
> > > > > > > > > > > woodstox
> > > > > > > > > > > > or
> > > > > > > > > > > > > stax*api - and it conflicts at some point.
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> |
> > Blog
> > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old
> > Wordpress
> > > > > Blog
> > > > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > > > https://github.com/
> > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau>
> |
> > > > > > > Tomitriber
> > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > > > > >
> > > > > > > > > > > > > 2016-10-17 17:18 GMT+02:00 sgjava <
> sgjava@gmail.com
> > >:
> > > > > > > > > > > > >
> > > > > > > > > > > > > > Periodically I'm seeing "Cannot create a secure
> > > > > > > > XMLInputFactory"
> > > > > > > > > in
> > > > > > > > > > > > TomEE
> > > > > > > > > > > > > > 7.0.2-SNAPSHOT. One solution is for CXF using
> > > > > > > > > > > > > > -Dorg.apache.cxf.stax.allowInsecureParser=1.
> This
> > is
> > > > an
> > > > > > > older
> > > > > > > > > > 7.0.2
> > > > > > > > > > > > from
> > > > > > > > > > > > > > 7/4/16.
> > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > --
> > > > > > > > > > > > > > View this message in context:
> > > > > http://tomee-openejb.979440.
> > > > > > > > > > > > > > n4.nabble.com/Cannot-create-a-
> > > secure-XMLInputFactory-
> > > > > > > > > > tp4680348.html
> > > > > > > > > > > > > > Sent from the TomEE Users mailing list archive at
> > > > > > Nabble.com.
> > > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > > --
> > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > > --
> > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > >
> > > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > > --
> > > > > > > > Steven P. Goldsmith
> > > > > > > >
> > > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > > --
> > > > > > Steven P. Goldsmith
> > > > > >
> > > > >
> > > >
> > > >
> > > >
> > > > --
> > > > Steven P. Goldsmith
> > > >
> > >
> >
> >
> >
> > --
> > Steven P. Goldsmith
> >
>
--
Steven P. Goldsmith
Re: Cannot create a secure XMLInputFactory
Posted by Steve Goldsmith <sg...@gmail.com>.
Yea, unfortunately this is one of those hard to reproduce stand alone apps
since I rely on propritary services for the SOAP clients. I'll keep digging
based on the error string. I'll check for all instances of it in CXF.
On Tue, Oct 18, 2016 at 4:50 PM, Romain Manni-Bucau <rm...@gmail.com>
wrote:
> maybe try to reproduce the issue and share a project on github, would
> probably be more efficient
>
>
> Romain Manni-Bucau
> @rmannibucau <https://twitter.com/rmannibucau> | Blog
> <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> <http://rmannibucau.wordpress.com> | Github <https://github.com/
> rmannibucau> |
> LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> <http://www.tomitribe.com> | JavaEE Factory
> <https://javaeefactory-rmannibucau.rhcloud.com>
>
> 2016-10-18 22:37 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
>
> > This string also exists in createXMLInputFactory, but it's not logging
> > there either (in the exception code) :) I added:
> >
> > public static XMLInputFactory createXMLInputFactory(boolean nsAware)
> {
> > XMLInputFactory factory = null;
> > try {
> > factory = XMLInputFactory.newInstance();
> > System.out.println("XMLInputFactory " +
> > factory.getClass().getName());
> >
> > and get:
> >
> > XMLInputFactory com.ctc.wstx.stax.WstxInputFactory
> >
> >
> >
> >
> > On Tue, Oct 18, 2016 at 4:10 PM, Romain Manni-Bucau <
> rmannibucau@gmail.com
> > >
> > wrote:
> >
> > > Well i dont see this output as well
> > >
> > > Le 18 oct. 2016 20:28, "Steve Goldsmith" <sg...@gmail.com> a écrit :
> > >
> > > > It didn't throw an exception there then because I added
> > > > System.out.println("setProperty error" + t.getStackTrace()); in the
> > > catch
> > > > section. This method swallows exceptions any ways, so it couldn't be
> > the
> > > > one throwing the exception?
> > > >
> > > > On Tue, Oct 18, 2016 at 2:18 PM, Romain Manni-Bucau <
> > > rmannibucau@gmail.com
> > > > >
> > > > wrote:
> > > >
> > > > > I dont see any error there or am i abused by gmail formatting?
> > > > >
> > > > > Le 18 oct. 2016 19:28, "Steve Goldsmith" <sg...@gmail.com> a
> écrit
> > :
> > > > >
> > > > > > OK, I made the change:
> > > > > >
> > > > > > private static boolean setProperty(XMLInputFactory f, String
> p,
> > > > > Object
> > > > > > o) {
> > > > > > try {
> > > > > > System.out.println("setProperty f: " + f + " p: " +
> p
> > +
> > > "
> > > > > o:"
> > > > > > +
> > > > > > o);
> > > > > > f.setProperty(p, o);
> > > > > > return true;
> > > > > > } catch (Throwable t) {
> > > > > > System.out.println("setProperty error" +
> > > > t.getStackTrace());
> > > > > > //ignore
> > > > > > }
> > > > > > return false;
> > > > > > }
> > > > > >
> > > > > > and it dumps this:
> > > > > >
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > com.ctc.wstx.maxAttributesPerElement o:500
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > com.ctc.wstx.maxAttributeSize o:65536
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > com.ctc.wstx.maxChildrenPerElement o:50000
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > com.ctc.wstx.maxElementCount o:9223372036854775807
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > com.ctc.wstx.maxElementDepth o:100
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > com.ctc.wstx.maxCharacters o:9223372036854775807
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > com.ctc.wstx.maxTextLength o:134217728
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > com.ctc.wstx.minTextSegment o:64
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > javax.xml.stream.isNamespaceAware o:true
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > javax.xml.stream.supportDTD o:false
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > javax.xml.stream.isReplacingEntityReferences o:false
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > javax.xml.stream.isSupportingExternalEntities o:false
> > > > > >
> > > > > >
> > > > > >
> > > > > > On Tue, Oct 18, 2016 at 12:14 PM, Romain Manni-Bucau <
> > > > > > rmannibucau@gmail.com>
> > > > > > wrote:
> > > > > >
> > > > > > > for tomee embedded yes
> > > > > > >
> > > > > > >
> > > > > > > Romain Manni-Bucau
> > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > > > <http://rmannibucau.wordpress.com> | Github <
> https://github.com/
> > > > > > > rmannibucau> |
> > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> Tomitriber
> > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > >
> > > > > > > 2016-10-18 18:11 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > > > > >
> > > > > > > > In other words, if I build a debug logging version of cxf how
> > > > would I
> > > > > > > > incorporate that into my TomEE embedded test? Can I just add
> > the
> > > > > > > dependency
> > > > > > > > in Maven or do I have to exclude the version bundled in
> TomEE?
> > > > > > > >
> > > > > > > > On Tue, Oct 18, 2016 at 11:52 AM, Romain Manni-Bucau <
> > > > > > > > rmannibucau@gmail.com>
> > > > > > > > wrote:
> > > > > > > >
> > > > > > > > > you should switch them I guess.
> > > > > > > > >
> > > > > > > > > Generally speaking if you include cxf dependencies in your
> > > > > > application
> > > > > > > > > there is a property in tomee to ask it to isolate the
> webapp
> > > from
> > > > > the
> > > > > > > > > container for cxf - not sure I got your question right.
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > Romain Manni-Bucau
> > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress
> Blog
> > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > https://github.com/
> > > > > > > > > rmannibucau> |
> > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > Tomitriber
> > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > >
> > > > > > > > > 2016-10-18 17:40 GMT+02:00 Steve Goldsmith <
> sgjava@gmail.com
> > >:
> > > > > > > > >
> > > > > > > > > > Do I have to exclude current CXF in TomEE dependencies or
> > > just
> > > > > > > include
> > > > > > > > > the
> > > > > > > > > > debug version I'm building?
> > > > > > > > > >
> > > > > > > > > > On Tue, Oct 18, 2016 at 2:46 AM, Romain Manni-Bucau <
> > > > > > > > > rmannibucau@gmail.com
> > > > > > > > > > >
> > > > > > > > > > wrote:
> > > > > > > > > >
> > > > > > > > > > > As mentionned in the previous answer this is not in
> tomee
> > > > > sources
> > > > > > > but
> > > > > > > > > > CXF,
> > > > > > > > > > > agree it should be logged at debug level but with
> current
> > > > code
> > > > > > > > > debugging
> > > > > > > > > > is
> > > > > > > > > > > the fastest.
> > > > > > > > > > >
> > > > > > > > > > > Side note: you dont need to build tomee from sources,
> > just
> > > > need
> > > > > > to
> > > > > > > > add
> > > > > > > > > > > cxf-core.
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress
> > > Blog
> > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > https://github.com/
> > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > > > Tomitriber
> > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > > >
> > > > > > > > > > > 2016-10-18 3:31 GMT+02:00 Steve Goldsmith <
> > > sgjava@gmail.com
> > > > >:
> > > > > > > > > > >
> > > > > > > > > > > > OK, I've built TomEE from source before, but I've not
> > run
> > > > it
> > > > > in
> > > > > > > > debug
> > > > > > > > > > > mode.
> > > > > > > > > > > > Wouldn't it be just as easy to simply log vars f, p
> > and o
> > > > > when
> > > > > > I
> > > > > > > > > build
> > > > > > > > > > > the
> > > > > > > > > > > > source?
> > > > > > > > > > > >
> > > > > > > > > > > > On Mon, Oct 17, 2016 at 5:09 PM, Romain Manni-Bucau <
> > > > > > > > > > > rmannibucau@gmail.com
> > > > > > > > > > > > >
> > > > > > > > > > > > wrote:
> > > > > > > > > > > >
> > > > > > > > > > > > > cxf ones yes, that's as easy as adding cxf-core as
> > > > provded
> > > > > > > > > > dependency,
> > > > > > > > > > > > > putting a breakpoint on the mentionned line
> normally
> > > and
> > > > > > > starting
> > > > > > > > > > tomee
> > > > > > > > > > > > in
> > > > > > > > > > > > > debug mode. Surely the most efficient way to solve
> > it.
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> |
> > Blog
> > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old
> > Wordpress
> > > > > Blog
> > > > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > > > https://github.com/
> > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau>
> |
> > > > > > > Tomitriber
> > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > > > > >
> > > > > > > > > > > > > 2016-10-17 22:52 GMT+02:00 Steve Goldsmith <
> > > > > sgjava@gmail.com
> > > > > > >:
> > > > > > > > > > > > >
> > > > > > > > > > > > > > You mean set a breakpoint in TomEE source?
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > On Mon, Oct 17, 2016 at 4:43 PM, Romain
> > Manni-Bucau <
> > > > > > > > > > > > > rmannibucau@gmail.com
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > wrote:
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > > If you can put a breakpoint at
> > > > > > > > > > > > > > > https://github.com/apache/cxf/blob/
> > > > > > > > > > eab841d5477c5e1ed21a49918defa7
> > > > > > > > > > > > > > > 9a0f1ad533/core/src/main/java/
> > > > > org/apache/cxf/staxutils/
> > > > > > > > > > > > > > StaxUtils.java#L381
> > > > > > > > > > > > > > > then you would know immediately why the
> throwable
> > > is
> > > > > > > thrown.
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau>
> |
> > > > Blog
> > > > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old
> > > > Wordpress
> > > > > > > Blog
> > > > > > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > > > > > https://github.com/
> > > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/
> > rmannibucau>
> > > |
> > > > > > > > > Tomitriber
> > > > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com
> >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > 2016-10-17 22:41 GMT+02:00 Steve Goldsmith <
> > > > > > > sgjava@gmail.com
> > > > > > > > >:
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > OK, I made the following change and I still
> get
> > > the
> > > > > > > error:
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > <groupId>org.jvnet.jaxb2_
> > > > > commons</groupId>
> > > > > > > > > > > > > > > > <artifactId>jaxb2-basics-
> > > > > > > runtime</artifactId>
> > > > > > > > > > > > > > > > <version>0.10.0</version>
> > > > > > > > > > > > > > > > <scope>provided</scope>
> > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > I even tried:
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > <groupId>org.apache.tomee</
> > groupId>
> > > > > > > > > > > > > > > > <artifactId>tomee-jaxrs</
> > artifactId>
> > > > > > > > > > > > > > > > <version>${tomee.version}</
> > version>
> > > > > > > > > > > > > > > > <scope>test</scope>
> > > > > > > > > > > > > > > > <exclusions>
> > > > > > > > > > > > > > > > <exclusion>
> > > > > > > > > > > > > > > >
> <groupId>com.sun.xml.bind</
> > > > > > groupId>
> > > > > > > > > > > > > > > > <artifactId>jaxb-impl</
> > > > > artifactId>
> > > > > > > > > > > > > > > > </exclusion>
> > > > > > > > > > > > > > > > </exclusions>
> > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > On Mon, Oct 17, 2016 at 3:37 PM, Romain
> > > > Manni-Bucau <
> > > > > > > > > > > > > > > rmannibucau@gmail.com
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > wrote:
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > well jaxb is provided and shouldnt be
> > delivered
> > > > so
> > > > > > you
> > > > > > > > have
> > > > > > > > > > to
> > > > > > > > > > > > > remove
> > > > > > > > > > > > > > > it
> > > > > > > > > > > > > > > > > from WEB-INF/lib. scope=provided should be
> > fine
> > > > > too.
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > > > > @rmannibucau <https://twitter.com/
> > rmannibucau>
> > > |
> > > > > > Blog
> > > > > > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> |
> Old
> > > > > > Wordpress
> > > > > > > > > Blog
> > > > > > > > > > > > > > > > > <http://rmannibucau.wordpress.com> |
> Github
> > <
> > > > > > > > > > > https://github.com/
> > > > > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/
> > > > rmannibucau>
> > > > > |
> > > > > > > > > > > Tomitriber
> > > > > > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE
> Factory
> > > > > > > > > > > > > > > > > <https://javaeefactory-
> > rmannibucau.rhcloud.com
> > > >
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > 2016-10-17 20:07 GMT+02:00 Steve Goldsmith
> <
> > > > > > > > > sgjava@gmail.com
> > > > > > > > > > >:
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > I need JAX-B runtime for code generated
> by
> > > > > > > > > > jaxws-maven-plugin
> > > > > > > > > > > > and
> > > > > > > > > > > > > > > XJC.
> > > > > > > > > > > > > > > > > > Everything else is in test scope and not
> > used
> > > > in
> > > > > > the
> > > > > > > > > > deployed
> > > > > > > > > > > > > app.
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > <groupId>org.jvnet.jaxb2_
> > > > > > > commons</groupId>
> > > > > > > > > > > > > > > > > > <artifactId>jaxb2-basics-
> > > > > > > > > runtime</artifactId>
> > > > > > > > > > > > > > > > > > <version>0.10.0</version>
> > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > On Mon, Oct 17, 2016 at 1:57 PM, Romain
> > > > > > Manni-Bucau <
> > > > > > > > > > > > > > > > > rmannibucau@gmail.com
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > wrote:
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > yep so surely some part of the app
> > running
> > > > in a
> > > > > > > > > > conflicting
> > > > > > > > > > > > > > > > > classloader.
> > > > > > > > > > > > > > > > > > > Personally I'd just remove stax2-api,
> > > > woodstox
> > > > > > and
> > > > > > > > jaxb
> > > > > > > > > > to
> > > > > > > > > > > > > start
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > > > > > > @rmannibucau <https://twitter.com/
> > > > rmannibucau>
> > > > > |
> > > > > > > > Blog
> > > > > > > > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com>
> |
> > > Old
> > > > > > > > Wordpress
> > > > > > > > > > > Blog
> > > > > > > > > > > > > > > > > > > <http://rmannibucau.wordpress.com> |
> > > Github
> > > > <
> > > > > > > > > > > > > https://github.com/
> > > > > > > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/
> > > > > > rmannibucau>
> > > > > > > |
> > > > > > > > > > > > > Tomitriber
> > > > > > > > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE
> > > Factory
> > > > > > > > > > > > > > > > > > > <https://javaeefactory-
> > > > rmannibucau.rhcloud.com
> > > > > >
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > 2016-10-17 19:47 GMT+02:00 Steve
> > Goldsmith
> > > <
> > > > > > > > > > > sgjava@gmail.com
> > > > > > > > > > > > >:
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > ~/java/apache-maven-3.3.9/bin/mvn
> > > > > > > dependency:tree
> > > > > > > > |
> > > > > > > > > > > egrep
> > > > > > > > > > > > > > > > > > 'woo|xml|stax'
> > > > > > > > > > > > > > > > > > > > [INFO] | | +-
> > > > > > javax.xml.bind:jaxb-api:jar:2.
> > > > > > > > > > > 2.6:test
> > > > > > > > > > > > > > > > > > > > [INFO] | | \-
> > > > > com.sun.xml.bind:jaxb-impl:
> > > > > > > > > > > > jar:2.2.6:test
> > > > > > > > > > > > > > > > > > > > [INFO] | | | +-
> > > > > > > > org.apache.santuario:xmlsec:
> > > > > > > > > > > > > > > > jar:2.0.5:test
> > > > > > > > > > > > > > > > > > > > [INFO] | | | | | +-
> > > > > > > > > > > > > > > > > > > > org.opensaml:opensaml-xmlsec-
> > > > > > api:jar:3.1.1:test
> > > > > > > > > > > > > > > > > > > > [INFO] | | | | +-
> > > > > > > > > > org.opensaml:opensaml-xmlsec-
> > > > > > > > > > > > > > > > > > > > impl:jar:3.1.1:test
> > > > > > > > > > > > > > > > > > > > [INFO] | | +-
> > > > org.apache.wss4j:wss4j-ws-
> > > > > > > > > > > > > > > > > > > security-stax:jar:2.1.4:test
> > > > > > > > > > > > > > > > > > > > [INFO] | | +-
> > > > > > > > > > > > > > > > > > > > org.apache.wss4j:wss4j-ws-
> > > > > > > > > > security-policy-stax:jar:2.1.
> > > > > > > > > > > > > 4:test
> > > > > > > > > > > > > > > > > > > > [INFO] | | | +-
> > > > > > > > xml-resolver:xml-resolver:jar:
> > > > > > > > > > > > 1.2:test
> > > > > > > > > > > > > > > > > > > > [INFO] | | | +-
> > > > org.apache.cxf:cxf-rt-
> > > > > > > > > > > > > > > > > > bindings-xml:jar:3.1.6:test
> > > > > > > > > > > > > > > > > > > > [INFO] | | \-
> > > > > com.sun.xml.messaging.saaj:
> > > > > > > > > > > > > > > > > > saaj-impl:jar:1.3.18:test
> > > > > > > > > > > > > > > > > > > > [INFO] | | | +-
> > > > org.codehaus.woodstox:
> > > > > > > > > > > > > > > > > > woodstox-core-asl:jar:4.4.1:
> > > > > > > > > > > > > > > > > > > > test
> > > > > > > > > > > > > > > > > > > > [INFO] | | | | \-
> > > > > > > > org.codehaus.woodstox:stax2-
> > > > > > > > > > > > > > > > > > api:jar:3.1.4:test
> > > > > > > > > > > > > > > > > > > > [INFO] | | | \-
> > > > > org.apache.ws.xmlschema:
> > > > > > > > > > > > > > > > > > > > xmlschema-core:jar:2.2.1:test
> > > > > > > > > > > > > > > > > > > > [INFO] +-
> > > > > > > > > > > > > > > > > > > > com.fasterxml.jackson.jaxrs:
> > > > > > > > > > jackson-jaxrs-json-provider:
> > > > > > > > > > > > > > > > > jar:2.7.4:test
> > > > > > > > > > > > > > > > > > > > [INFO] | +-
> > com.fasterxml.jackson.jaxrs:
> > > > > > > > > > > > > > > > > jackson-jaxrs-base:jar:2.7.4:
> > > > > > > > > > > > > > > > > > > test
> > > > > > > > > > > > > > > > > > > > [INFO] | +-
> > com.fasterxml.jackson.core:
> > > > > > > > > > > > > > > > jackson-core:jar:2.7.4:test
> > > > > > > > > > > > > > > > > > > > [INFO] | +-
> > com.fasterxml.jackson.core:
> > > > > > > > > > > > > > > > jackson-databind:jar:2.7.4:
> > > > > > > > > > > > > > > > > > test
> > > > > > > > > > > > > > > > > > > > [INFO] | | \-
> > > > > > > > > > > > > > > > > > > > com.fasterxml.jackson.core:
> > > > > > > > > > > jackson-annotations:jar:2.7.0:
> > > > > > > > > > > > > test
> > > > > > > > > > > > > > > > > > > > [INFO] | \-
> > > > > > > > > > > > > > > > > > > > com.fasterxml.jackson.module:
> > > > > > > jackson-module-jaxb-
> > > > > > > > > > > > > > > > > > > > annotations:jar:2.7.4:test
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > On Mon, Oct 17, 2016 at 11:40 AM,
> > Romain
> > > > > > > > Manni-Bucau
> > > > > > > > > <
> > > > > > > > > > > > > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > > > > > > > > > > > > wrote:
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > mvn dependency:tree | egrep
> > > > 'woo|xml|stax'
> > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > > > > > > > > @rmannibucau <https://twitter.com/
> > > > > > rmannibucau>
> > > > > > > |
> > > > > > > > > > Blog
> > > > > > > > > > > > > > > > > > > > > <https://blog-rmannibucau.
> > rhcloud.com>
> > > |
> > > > > Old
> > > > > > > > > > Wordpress
> > > > > > > > > > > > > Blog
> > > > > > > > > > > > > > > > > > > > > <http://rmannibucau.wordpress.com>
> |
> > > > > Github
> > > > > > <
> > > > > > > > > > > > > > > https://github.com/
> > > > > > > > > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > > > > > > > > LinkedIn <
> > https://www.linkedin.com/in/
> > > > > > > > rmannibucau>
> > > > > > > > > |
> > > > > > > > > > > > > > > Tomitriber
> > > > > > > > > > > > > > > > > > > > > <http://www.tomitribe.com> |
> JavaEE
> > > > > Factory
> > > > > > > > > > > > > > > > > > > > > <https://javaeefactory-
> > > > > > rmannibucau.rhcloud.com
> > > > > > > >
> > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > 2016-10-17 17:36 GMT+02:00 Steve
> > > > Goldsmith
> > > > > <
> > > > > > > > > > > > > sgjava@gmail.com
> > > > > > > > > > > > > > >:
> > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > My compile dependencies are (do
> you
> > > see
> > > > > > > > anything
> > > > > > > > > > that
> > > > > > > > > > > > > > sticks
> > > > > > > > > > > > > > > > > out):
> > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > > > >
> > <groupId>org.jsr107.ri</
> > > > > > groupId>
> > > > > > > > > > > > > > > > > > > > > >
> > > > > <artifactId>cache-annotations-
> > > > > > > > > > > > > > > ri-cdi</artifactId>
> > > > > > > > > > > > > > > > > > > > > >
> > <version>1.0.0</version>
> > > > > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > > > >
> > <groupId>org.jvnet.jaxb2_
> > > > > > > > > > > commons</groupId>
> > > > > > > > > > > > > > > > > > > > > >
> > <artifactId>jaxb2-basics-
> > > > > > > > > > > > > runtime</artifactId>
> > > > > > > > > > > > > > > > > > > > > >
> > <version>0.10.0</version>
> > > > > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > > > >
> > > > <groupId>org.slf4j</groupId>
> > > > > > > > > > > > > > > > > > > > > >
> <artifactId>slf4j-api</
> > > > > > > artifactId>
> > > > > > > > > > > > > > > > > > > > > >
> > > <version>${slf4j.version}</
> > > > > > > > version>
> > > > > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > > > >
> > <groupId>ch.qos.logback</
> > > > > > > groupId>
> > > > > > > > > > > > > > > > > > > > > >
> > > > <artifactId>logback-classic</
> > > > > > > > > > artifactId>
> > > > > > > > > > > > > > > > > > > > > >
> > > > <version>${logback.version}</
> > > > > > > > > version>
> > > > > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > > > >
> > <groupId>ch.qos.logback</
> > > > > > > groupId>
> > > > > > > > > > > > > > > > > > > > > >
> > > <artifactId>logback-core</
> > > > > > > > > artifactId>
> > > > > > > > > > > > > > > > > > > > > >
> > > > <version>${logback.version}</
> > > > > > > > > version>
> > > > > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > > > >
> > > > <groupId>org.apache.commons</
> > > > > > > > > groupId>
> > > > > > > > > > > > > > > > > > > > > >
> > > <artifactId>commons-pool2</
> > > > > > > > > artifactId>
> > > > > > > > > > > > > > > > > > > > > >
> > <version>2.4.2</version>
> > > > > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > > > > <groupId>commons-
> > > > > > > > > > configuration</groupId>
> > > > > > > > > > > > > > > > > > > > > > <artifactId>commons-
> > > > > > > > > > > > > configuration</artifactId>
> > > > > > > > > > > > > > > > > > > > > >
> <version>1.10</version>
> > > > > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > > > >
> > > > <groupId>org.jasypt</groupId>
> > > > > > > > > > > > > > > > > > > > > > <artifactId>jasypt</
> > > > > > artifactId>
> > > > > > > > > > > > > > > > > > > > > >
> > <version>1.9.3-SNAPSHOT</
> > > > > > > version>
> > > > > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > On Mon, Oct 17, 2016 at 11:30 AM,
> > > > Romain
> > > > > > > > > > Manni-Bucau
> > > > > > > > > > > <
> > > > > > > > > > > > > > > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > > > > > > > > > > > > > > wrote:
> > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > > Hello
> > > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > > can happen if you provide some
> > xml
> > > > > > > libraries
> > > > > > > > in
> > > > > > > > > > > your
> > > > > > > > > > > > > app
> > > > > > > > > > > > > > -
> > > > > > > > > > > > > > > > like
> > > > > > > > > > > > > > > > > > > > > woodstox
> > > > > > > > > > > > > > > > > > > > > > or
> > > > > > > > > > > > > > > > > > > > > > > stax*api - and it conflicts at
> > some
> > > > > > point.
> > > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > > > > > > > > > > @rmannibucau <
> > https://twitter.com/
> > > > > > > > rmannibucau>
> > > > > > > > > |
> > > > > > > > > > > > Blog
> > > > > > > > > > > > > > > > > > > > > > > <https://blog-rmannibucau.
> > > > rhcloud.com>
> > > > > |
> > > > > > > Old
> > > > > > > > > > > > Wordpress
> > > > > > > > > > > > > > > Blog
> > > > > > > > > > > > > > > > > > > > > > > <http://rmannibucau.wordpress.
> > com>
> > > |
> > > > > > > Github
> > > > > > > > <
> > > > > > > > > > > > > > > > > https://github.com/
> > > > > > > > > > > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > > > > > > > > > > LinkedIn <
> > > > https://www.linkedin.com/in/
> > > > > > > > > > rmannibucau>
> > > > > > > > > > > |
> > > > > > > > > > > > > > > > > Tomitriber
> > > > > > > > > > > > > > > > > > > > > > > <http://www.tomitribe.com> |
> > > JavaEE
> > > > > > > Factory
> > > > > > > > > > > > > > > > > > > > > > > <https://javaeefactory-
> > > > > > > > rmannibucau.rhcloud.com
> > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > > 2016-10-17 17:18 GMT+02:00
> > sgjava <
> > > > > > > > > > > sgjava@gmail.com
> > > > > > > > > > > > >:
> > > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > > > Periodically I'm seeing
> "Cannot
> > > > > create
> > > > > > a
> > > > > > > > > secure
> > > > > > > > > > > > > > > > > > XMLInputFactory"
> > > > > > > > > > > > > > > > > > > in
> > > > > > > > > > > > > > > > > > > > > > TomEE
> > > > > > > > > > > > > > > > > > > > > > > > 7.0.2-SNAPSHOT. One solution
> is
> > > for
> > > > > CXF
> > > > > > > > using
> > > > > > > > > > > > > > > > > > > > > > > > -Dorg.apache.cxf.stax.
> > > > > > > > allowInsecureParser=1.
> > > > > > > > > > > This
> > > > > > > > > > > > is
> > > > > > > > > > > > > > an
> > > > > > > > > > > > > > > > > older
> > > > > > > > > > > > > > > > > > > > 7.0.2
> > > > > > > > > > > > > > > > > > > > > > from
> > > > > > > > > > > > > > > > > > > > > > > > 7/4/16.
> > > > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > > > > > > > > > > View this message in context:
> > > > > > > > > > > > > > > http://tomee-openejb.979440.
> > > > > > > > > > > > > > > > > > > > > > > >
> n4.nabble.com/Cannot-create-a-
> > > > > > > > > > > > > secure-XMLInputFactory-
> > > > > > > > > > > > > > > > > > > > tp4680348.html
> > > > > > > > > > > > > > > > > > > > > > > > Sent from the TomEE Users
> > mailing
> > > > > list
> > > > > > > > > archive
> > > > > > > > > > at
> > > > > > > > > > > > > > > > Nabble.com.
> > > > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > --
> > > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > > --
> > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > > --
> > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > >
> > > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > > --
> > > > > > > > Steven P. Goldsmith
> > > > > > > >
> > > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > > --
> > > > > > Steven P. Goldsmith
> > > > > >
> > > > >
> > > >
> > > >
> > > >
> > > > --
> > > > Steven P. Goldsmith
> > > >
> > >
> >
> >
> >
> > --
> > Steven P. Goldsmith
> >
>
--
Steven P. Goldsmith
Re: Cannot create a secure XMLInputFactory
Posted by Steve Goldsmith <sg...@gmail.com>.
I've done a little more digging and the cxf-core jar I built is not
throwing the "Cannot create a secure XMLInputFactory".
Note the comment:
private static boolean setRestrictionProperties(XMLInputFactory
factory) {
//For now, we can only support Woodstox 4.2.x and newer as none of
the other
//stax parsers support these settings
[INFO] +- org.apache.cxf:cxf-core:jar:3.2.0-SNAPSHOT:test
[INFO] | +- org.codehaus.woodstox:woodstox-core-asl:jar:4.4.1:test
[INFO] | | \- org.codehaus.woodstox:stax2-api:jar:3.1.4:test
Shouldn't stax2-api be 4.2.x or higher?
On Tue, Oct 18, 2016 at 4:50 PM, Romain Manni-Bucau <rm...@gmail.com>
wrote:
> maybe try to reproduce the issue and share a project on github, would
> probably be more efficient
>
>
> Romain Manni-Bucau
> @rmannibucau <https://twitter.com/rmannibucau> | Blog
> <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> <http://rmannibucau.wordpress.com> | Github <https://github.com/
> rmannibucau> |
> LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> <http://www.tomitribe.com> | JavaEE Factory
> <https://javaeefactory-rmannibucau.rhcloud.com>
>
> 2016-10-18 22:37 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
>
> > This string also exists in createXMLInputFactory, but it's not logging
> > there either (in the exception code) :) I added:
> >
> > public static XMLInputFactory createXMLInputFactory(boolean nsAware)
> {
> > XMLInputFactory factory = null;
> > try {
> > factory = XMLInputFactory.newInstance();
> > System.out.println("XMLInputFactory " +
> > factory.getClass().getName());
> >
> > and get:
> >
> > XMLInputFactory com.ctc.wstx.stax.WstxInputFactory
> >
> >
> >
> >
> > On Tue, Oct 18, 2016 at 4:10 PM, Romain Manni-Bucau <
> rmannibucau@gmail.com
> > >
> > wrote:
> >
> > > Well i dont see this output as well
> > >
> > > Le 18 oct. 2016 20:28, "Steve Goldsmith" <sg...@gmail.com> a écrit :
> > >
> > > > It didn't throw an exception there then because I added
> > > > System.out.println("setProperty error" + t.getStackTrace()); in the
> > > catch
> > > > section. This method swallows exceptions any ways, so it couldn't be
> > the
> > > > one throwing the exception?
> > > >
> > > > On Tue, Oct 18, 2016 at 2:18 PM, Romain Manni-Bucau <
> > > rmannibucau@gmail.com
> > > > >
> > > > wrote:
> > > >
> > > > > I dont see any error there or am i abused by gmail formatting?
> > > > >
> > > > > Le 18 oct. 2016 19:28, "Steve Goldsmith" <sg...@gmail.com> a
> écrit
> > :
> > > > >
> > > > > > OK, I made the change:
> > > > > >
> > > > > > private static boolean setProperty(XMLInputFactory f, String
> p,
> > > > > Object
> > > > > > o) {
> > > > > > try {
> > > > > > System.out.println("setProperty f: " + f + " p: " +
> p
> > +
> > > "
> > > > > o:"
> > > > > > +
> > > > > > o);
> > > > > > f.setProperty(p, o);
> > > > > > return true;
> > > > > > } catch (Throwable t) {
> > > > > > System.out.println("setProperty error" +
> > > > t.getStackTrace());
> > > > > > //ignore
> > > > > > }
> > > > > > return false;
> > > > > > }
> > > > > >
> > > > > > and it dumps this:
> > > > > >
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > com.ctc.wstx.maxAttributesPerElement o:500
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > com.ctc.wstx.maxAttributeSize o:65536
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > com.ctc.wstx.maxChildrenPerElement o:50000
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > com.ctc.wstx.maxElementCount o:9223372036854775807
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > com.ctc.wstx.maxElementDepth o:100
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > com.ctc.wstx.maxCharacters o:9223372036854775807
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > com.ctc.wstx.maxTextLength o:134217728
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > com.ctc.wstx.minTextSegment o:64
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > javax.xml.stream.isNamespaceAware o:true
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > javax.xml.stream.supportDTD o:false
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > javax.xml.stream.isReplacingEntityReferences o:false
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > javax.xml.stream.isSupportingExternalEntities o:false
> > > > > >
> > > > > >
> > > > > >
> > > > > > On Tue, Oct 18, 2016 at 12:14 PM, Romain Manni-Bucau <
> > > > > > rmannibucau@gmail.com>
> > > > > > wrote:
> > > > > >
> > > > > > > for tomee embedded yes
> > > > > > >
> > > > > > >
> > > > > > > Romain Manni-Bucau
> > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > > > <http://rmannibucau.wordpress.com> | Github <
> https://github.com/
> > > > > > > rmannibucau> |
> > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> Tomitriber
> > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > >
> > > > > > > 2016-10-18 18:11 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > > > > >
> > > > > > > > In other words, if I build a debug logging version of cxf how
> > > > would I
> > > > > > > > incorporate that into my TomEE embedded test? Can I just add
> > the
> > > > > > > dependency
> > > > > > > > in Maven or do I have to exclude the version bundled in
> TomEE?
> > > > > > > >
> > > > > > > > On Tue, Oct 18, 2016 at 11:52 AM, Romain Manni-Bucau <
> > > > > > > > rmannibucau@gmail.com>
> > > > > > > > wrote:
> > > > > > > >
> > > > > > > > > you should switch them I guess.
> > > > > > > > >
> > > > > > > > > Generally speaking if you include cxf dependencies in your
> > > > > > application
> > > > > > > > > there is a property in tomee to ask it to isolate the
> webapp
> > > from
> > > > > the
> > > > > > > > > container for cxf - not sure I got your question right.
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > Romain Manni-Bucau
> > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress
> Blog
> > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > https://github.com/
> > > > > > > > > rmannibucau> |
> > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > Tomitriber
> > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > >
> > > > > > > > > 2016-10-18 17:40 GMT+02:00 Steve Goldsmith <
> sgjava@gmail.com
> > >:
> > > > > > > > >
> > > > > > > > > > Do I have to exclude current CXF in TomEE dependencies or
> > > just
> > > > > > > include
> > > > > > > > > the
> > > > > > > > > > debug version I'm building?
> > > > > > > > > >
> > > > > > > > > > On Tue, Oct 18, 2016 at 2:46 AM, Romain Manni-Bucau <
> > > > > > > > > rmannibucau@gmail.com
> > > > > > > > > > >
> > > > > > > > > > wrote:
> > > > > > > > > >
> > > > > > > > > > > As mentionned in the previous answer this is not in
> tomee
> > > > > sources
> > > > > > > but
> > > > > > > > > > CXF,
> > > > > > > > > > > agree it should be logged at debug level but with
> current
> > > > code
> > > > > > > > > debugging
> > > > > > > > > > is
> > > > > > > > > > > the fastest.
> > > > > > > > > > >
> > > > > > > > > > > Side note: you dont need to build tomee from sources,
> > just
> > > > need
> > > > > > to
> > > > > > > > add
> > > > > > > > > > > cxf-core.
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress
> > > Blog
> > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > https://github.com/
> > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > > > Tomitriber
> > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > > >
> > > > > > > > > > > 2016-10-18 3:31 GMT+02:00 Steve Goldsmith <
> > > sgjava@gmail.com
> > > > >:
> > > > > > > > > > >
> > > > > > > > > > > > OK, I've built TomEE from source before, but I've not
> > run
> > > > it
> > > > > in
> > > > > > > > debug
> > > > > > > > > > > mode.
> > > > > > > > > > > > Wouldn't it be just as easy to simply log vars f, p
> > and o
> > > > > when
> > > > > > I
> > > > > > > > > build
> > > > > > > > > > > the
> > > > > > > > > > > > source?
> > > > > > > > > > > >
> > > > > > > > > > > > On Mon, Oct 17, 2016 at 5:09 PM, Romain Manni-Bucau <
> > > > > > > > > > > rmannibucau@gmail.com
> > > > > > > > > > > > >
> > > > > > > > > > > > wrote:
> > > > > > > > > > > >
> > > > > > > > > > > > > cxf ones yes, that's as easy as adding cxf-core as
> > > > provded
> > > > > > > > > > dependency,
> > > > > > > > > > > > > putting a breakpoint on the mentionned line
> normally
> > > and
> > > > > > > starting
> > > > > > > > > > tomee
> > > > > > > > > > > > in
> > > > > > > > > > > > > debug mode. Surely the most efficient way to solve
> > it.
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> |
> > Blog
> > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old
> > Wordpress
> > > > > Blog
> > > > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > > > https://github.com/
> > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau>
> |
> > > > > > > Tomitriber
> > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > > > > >
> > > > > > > > > > > > > 2016-10-17 22:52 GMT+02:00 Steve Goldsmith <
> > > > > sgjava@gmail.com
> > > > > > >:
> > > > > > > > > > > > >
> > > > > > > > > > > > > > You mean set a breakpoint in TomEE source?
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > On Mon, Oct 17, 2016 at 4:43 PM, Romain
> > Manni-Bucau <
> > > > > > > > > > > > > rmannibucau@gmail.com
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > wrote:
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > > If you can put a breakpoint at
> > > > > > > > > > > > > > > https://github.com/apache/cxf/blob/
> > > > > > > > > > eab841d5477c5e1ed21a49918defa7
> > > > > > > > > > > > > > > 9a0f1ad533/core/src/main/java/
> > > > > org/apache/cxf/staxutils/
> > > > > > > > > > > > > > StaxUtils.java#L381
> > > > > > > > > > > > > > > then you would know immediately why the
> throwable
> > > is
> > > > > > > thrown.
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau>
> |
> > > > Blog
> > > > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old
> > > > Wordpress
> > > > > > > Blog
> > > > > > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > > > > > https://github.com/
> > > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/
> > rmannibucau>
> > > |
> > > > > > > > > Tomitriber
> > > > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com
> >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > 2016-10-17 22:41 GMT+02:00 Steve Goldsmith <
> > > > > > > sgjava@gmail.com
> > > > > > > > >:
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > OK, I made the following change and I still
> get
> > > the
> > > > > > > error:
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > <groupId>org.jvnet.jaxb2_
> > > > > commons</groupId>
> > > > > > > > > > > > > > > > <artifactId>jaxb2-basics-
> > > > > > > runtime</artifactId>
> > > > > > > > > > > > > > > > <version>0.10.0</version>
> > > > > > > > > > > > > > > > <scope>provided</scope>
> > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > I even tried:
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > <groupId>org.apache.tomee</
> > groupId>
> > > > > > > > > > > > > > > > <artifactId>tomee-jaxrs</
> > artifactId>
> > > > > > > > > > > > > > > > <version>${tomee.version}</
> > version>
> > > > > > > > > > > > > > > > <scope>test</scope>
> > > > > > > > > > > > > > > > <exclusions>
> > > > > > > > > > > > > > > > <exclusion>
> > > > > > > > > > > > > > > >
> <groupId>com.sun.xml.bind</
> > > > > > groupId>
> > > > > > > > > > > > > > > > <artifactId>jaxb-impl</
> > > > > artifactId>
> > > > > > > > > > > > > > > > </exclusion>
> > > > > > > > > > > > > > > > </exclusions>
> > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > On Mon, Oct 17, 2016 at 3:37 PM, Romain
> > > > Manni-Bucau <
> > > > > > > > > > > > > > > rmannibucau@gmail.com
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > wrote:
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > well jaxb is provided and shouldnt be
> > delivered
> > > > so
> > > > > > you
> > > > > > > > have
> > > > > > > > > > to
> > > > > > > > > > > > > remove
> > > > > > > > > > > > > > > it
> > > > > > > > > > > > > > > > > from WEB-INF/lib. scope=provided should be
> > fine
> > > > > too.
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > > > > @rmannibucau <https://twitter.com/
> > rmannibucau>
> > > |
> > > > > > Blog
> > > > > > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> |
> Old
> > > > > > Wordpress
> > > > > > > > > Blog
> > > > > > > > > > > > > > > > > <http://rmannibucau.wordpress.com> |
> Github
> > <
> > > > > > > > > > > https://github.com/
> > > > > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/
> > > > rmannibucau>
> > > > > |
> > > > > > > > > > > Tomitriber
> > > > > > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE
> Factory
> > > > > > > > > > > > > > > > > <https://javaeefactory-
> > rmannibucau.rhcloud.com
> > > >
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > 2016-10-17 20:07 GMT+02:00 Steve Goldsmith
> <
> > > > > > > > > sgjava@gmail.com
> > > > > > > > > > >:
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > I need JAX-B runtime for code generated
> by
> > > > > > > > > > jaxws-maven-plugin
> > > > > > > > > > > > and
> > > > > > > > > > > > > > > XJC.
> > > > > > > > > > > > > > > > > > Everything else is in test scope and not
> > used
> > > > in
> > > > > > the
> > > > > > > > > > deployed
> > > > > > > > > > > > > app.
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > <groupId>org.jvnet.jaxb2_
> > > > > > > commons</groupId>
> > > > > > > > > > > > > > > > > > <artifactId>jaxb2-basics-
> > > > > > > > > runtime</artifactId>
> > > > > > > > > > > > > > > > > > <version>0.10.0</version>
> > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > On Mon, Oct 17, 2016 at 1:57 PM, Romain
> > > > > > Manni-Bucau <
> > > > > > > > > > > > > > > > > rmannibucau@gmail.com
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > wrote:
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > yep so surely some part of the app
> > running
> > > > in a
> > > > > > > > > > conflicting
> > > > > > > > > > > > > > > > > classloader.
> > > > > > > > > > > > > > > > > > > Personally I'd just remove stax2-api,
> > > > woodstox
> > > > > > and
> > > > > > > > jaxb
> > > > > > > > > > to
> > > > > > > > > > > > > start
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > > > > > > @rmannibucau <https://twitter.com/
> > > > rmannibucau>
> > > > > |
> > > > > > > > Blog
> > > > > > > > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com>
> |
> > > Old
> > > > > > > > Wordpress
> > > > > > > > > > > Blog
> > > > > > > > > > > > > > > > > > > <http://rmannibucau.wordpress.com> |
> > > Github
> > > > <
> > > > > > > > > > > > > https://github.com/
> > > > > > > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/
> > > > > > rmannibucau>
> > > > > > > |
> > > > > > > > > > > > > Tomitriber
> > > > > > > > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE
> > > Factory
> > > > > > > > > > > > > > > > > > > <https://javaeefactory-
> > > > rmannibucau.rhcloud.com
> > > > > >
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > 2016-10-17 19:47 GMT+02:00 Steve
> > Goldsmith
> > > <
> > > > > > > > > > > sgjava@gmail.com
> > > > > > > > > > > > >:
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > ~/java/apache-maven-3.3.9/bin/mvn
> > > > > > > dependency:tree
> > > > > > > > |
> > > > > > > > > > > egrep
> > > > > > > > > > > > > > > > > > 'woo|xml|stax'
> > > > > > > > > > > > > > > > > > > > [INFO] | | +-
> > > > > > javax.xml.bind:jaxb-api:jar:2.
> > > > > > > > > > > 2.6:test
> > > > > > > > > > > > > > > > > > > > [INFO] | | \-
> > > > > com.sun.xml.bind:jaxb-impl:
> > > > > > > > > > > > jar:2.2.6:test
> > > > > > > > > > > > > > > > > > > > [INFO] | | | +-
> > > > > > > > org.apache.santuario:xmlsec:
> > > > > > > > > > > > > > > > jar:2.0.5:test
> > > > > > > > > > > > > > > > > > > > [INFO] | | | | | +-
> > > > > > > > > > > > > > > > > > > > org.opensaml:opensaml-xmlsec-
> > > > > > api:jar:3.1.1:test
> > > > > > > > > > > > > > > > > > > > [INFO] | | | | +-
> > > > > > > > > > org.opensaml:opensaml-xmlsec-
> > > > > > > > > > > > > > > > > > > > impl:jar:3.1.1:test
> > > > > > > > > > > > > > > > > > > > [INFO] | | +-
> > > > org.apache.wss4j:wss4j-ws-
> > > > > > > > > > > > > > > > > > > security-stax:jar:2.1.4:test
> > > > > > > > > > > > > > > > > > > > [INFO] | | +-
> > > > > > > > > > > > > > > > > > > > org.apache.wss4j:wss4j-ws-
> > > > > > > > > > security-policy-stax:jar:2.1.
> > > > > > > > > > > > > 4:test
> > > > > > > > > > > > > > > > > > > > [INFO] | | | +-
> > > > > > > > xml-resolver:xml-resolver:jar:
> > > > > > > > > > > > 1.2:test
> > > > > > > > > > > > > > > > > > > > [INFO] | | | +-
> > > > org.apache.cxf:cxf-rt-
> > > > > > > > > > > > > > > > > > bindings-xml:jar:3.1.6:test
> > > > > > > > > > > > > > > > > > > > [INFO] | | \-
> > > > > com.sun.xml.messaging.saaj:
> > > > > > > > > > > > > > > > > > saaj-impl:jar:1.3.18:test
> > > > > > > > > > > > > > > > > > > > [INFO] | | | +-
> > > > org.codehaus.woodstox:
> > > > > > > > > > > > > > > > > > woodstox-core-asl:jar:4.4.1:
> > > > > > > > > > > > > > > > > > > > test
> > > > > > > > > > > > > > > > > > > > [INFO] | | | | \-
> > > > > > > > org.codehaus.woodstox:stax2-
> > > > > > > > > > > > > > > > > > api:jar:3.1.4:test
> > > > > > > > > > > > > > > > > > > > [INFO] | | | \-
> > > > > org.apache.ws.xmlschema:
> > > > > > > > > > > > > > > > > > > > xmlschema-core:jar:2.2.1:test
> > > > > > > > > > > > > > > > > > > > [INFO] +-
> > > > > > > > > > > > > > > > > > > > com.fasterxml.jackson.jaxrs:
> > > > > > > > > > jackson-jaxrs-json-provider:
> > > > > > > > > > > > > > > > > jar:2.7.4:test
> > > > > > > > > > > > > > > > > > > > [INFO] | +-
> > com.fasterxml.jackson.jaxrs:
> > > > > > > > > > > > > > > > > jackson-jaxrs-base:jar:2.7.4:
> > > > > > > > > > > > > > > > > > > test
> > > > > > > > > > > > > > > > > > > > [INFO] | +-
> > com.fasterxml.jackson.core:
> > > > > > > > > > > > > > > > jackson-core:jar:2.7.4:test
> > > > > > > > > > > > > > > > > > > > [INFO] | +-
> > com.fasterxml.jackson.core:
> > > > > > > > > > > > > > > > jackson-databind:jar:2.7.4:
> > > > > > > > > > > > > > > > > > test
> > > > > > > > > > > > > > > > > > > > [INFO] | | \-
> > > > > > > > > > > > > > > > > > > > com.fasterxml.jackson.core:
> > > > > > > > > > > jackson-annotations:jar:2.7.0:
> > > > > > > > > > > > > test
> > > > > > > > > > > > > > > > > > > > [INFO] | \-
> > > > > > > > > > > > > > > > > > > > com.fasterxml.jackson.module:
> > > > > > > jackson-module-jaxb-
> > > > > > > > > > > > > > > > > > > > annotations:jar:2.7.4:test
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > On Mon, Oct 17, 2016 at 11:40 AM,
> > Romain
> > > > > > > > Manni-Bucau
> > > > > > > > > <
> > > > > > > > > > > > > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > > > > > > > > > > > > wrote:
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > mvn dependency:tree | egrep
> > > > 'woo|xml|stax'
> > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > > > > > > > > @rmannibucau <https://twitter.com/
> > > > > > rmannibucau>
> > > > > > > |
> > > > > > > > > > Blog
> > > > > > > > > > > > > > > > > > > > > <https://blog-rmannibucau.
> > rhcloud.com>
> > > |
> > > > > Old
> > > > > > > > > > Wordpress
> > > > > > > > > > > > > Blog
> > > > > > > > > > > > > > > > > > > > > <http://rmannibucau.wordpress.com>
> |
> > > > > Github
> > > > > > <
> > > > > > > > > > > > > > > https://github.com/
> > > > > > > > > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > > > > > > > > LinkedIn <
> > https://www.linkedin.com/in/
> > > > > > > > rmannibucau>
> > > > > > > > > |
> > > > > > > > > > > > > > > Tomitriber
> > > > > > > > > > > > > > > > > > > > > <http://www.tomitribe.com> |
> JavaEE
> > > > > Factory
> > > > > > > > > > > > > > > > > > > > > <https://javaeefactory-
> > > > > > rmannibucau.rhcloud.com
> > > > > > > >
> > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > 2016-10-17 17:36 GMT+02:00 Steve
> > > > Goldsmith
> > > > > <
> > > > > > > > > > > > > sgjava@gmail.com
> > > > > > > > > > > > > > >:
> > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > My compile dependencies are (do
> you
> > > see
> > > > > > > > anything
> > > > > > > > > > that
> > > > > > > > > > > > > > sticks
> > > > > > > > > > > > > > > > > out):
> > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > > > >
> > <groupId>org.jsr107.ri</
> > > > > > groupId>
> > > > > > > > > > > > > > > > > > > > > >
> > > > > <artifactId>cache-annotations-
> > > > > > > > > > > > > > > ri-cdi</artifactId>
> > > > > > > > > > > > > > > > > > > > > >
> > <version>1.0.0</version>
> > > > > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > > > >
> > <groupId>org.jvnet.jaxb2_
> > > > > > > > > > > commons</groupId>
> > > > > > > > > > > > > > > > > > > > > >
> > <artifactId>jaxb2-basics-
> > > > > > > > > > > > > runtime</artifactId>
> > > > > > > > > > > > > > > > > > > > > >
> > <version>0.10.0</version>
> > > > > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > > > >
> > > > <groupId>org.slf4j</groupId>
> > > > > > > > > > > > > > > > > > > > > >
> <artifactId>slf4j-api</
> > > > > > > artifactId>
> > > > > > > > > > > > > > > > > > > > > >
> > > <version>${slf4j.version}</
> > > > > > > > version>
> > > > > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > > > >
> > <groupId>ch.qos.logback</
> > > > > > > groupId>
> > > > > > > > > > > > > > > > > > > > > >
> > > > <artifactId>logback-classic</
> > > > > > > > > > artifactId>
> > > > > > > > > > > > > > > > > > > > > >
> > > > <version>${logback.version}</
> > > > > > > > > version>
> > > > > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > > > >
> > <groupId>ch.qos.logback</
> > > > > > > groupId>
> > > > > > > > > > > > > > > > > > > > > >
> > > <artifactId>logback-core</
> > > > > > > > > artifactId>
> > > > > > > > > > > > > > > > > > > > > >
> > > > <version>${logback.version}</
> > > > > > > > > version>
> > > > > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > > > >
> > > > <groupId>org.apache.commons</
> > > > > > > > > groupId>
> > > > > > > > > > > > > > > > > > > > > >
> > > <artifactId>commons-pool2</
> > > > > > > > > artifactId>
> > > > > > > > > > > > > > > > > > > > > >
> > <version>2.4.2</version>
> > > > > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > > > > <groupId>commons-
> > > > > > > > > > configuration</groupId>
> > > > > > > > > > > > > > > > > > > > > > <artifactId>commons-
> > > > > > > > > > > > > configuration</artifactId>
> > > > > > > > > > > > > > > > > > > > > >
> <version>1.10</version>
> > > > > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > > > >
> > > > <groupId>org.jasypt</groupId>
> > > > > > > > > > > > > > > > > > > > > > <artifactId>jasypt</
> > > > > > artifactId>
> > > > > > > > > > > > > > > > > > > > > >
> > <version>1.9.3-SNAPSHOT</
> > > > > > > version>
> > > > > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > On Mon, Oct 17, 2016 at 11:30 AM,
> > > > Romain
> > > > > > > > > > Manni-Bucau
> > > > > > > > > > > <
> > > > > > > > > > > > > > > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > > > > > > > > > > > > > > wrote:
> > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > > Hello
> > > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > > can happen if you provide some
> > xml
> > > > > > > libraries
> > > > > > > > in
> > > > > > > > > > > your
> > > > > > > > > > > > > app
> > > > > > > > > > > > > > -
> > > > > > > > > > > > > > > > like
> > > > > > > > > > > > > > > > > > > > > woodstox
> > > > > > > > > > > > > > > > > > > > > > or
> > > > > > > > > > > > > > > > > > > > > > > stax*api - and it conflicts at
> > some
> > > > > > point.
> > > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > > > > > > > > > > @rmannibucau <
> > https://twitter.com/
> > > > > > > > rmannibucau>
> > > > > > > > > |
> > > > > > > > > > > > Blog
> > > > > > > > > > > > > > > > > > > > > > > <https://blog-rmannibucau.
> > > > rhcloud.com>
> > > > > |
> > > > > > > Old
> > > > > > > > > > > > Wordpress
> > > > > > > > > > > > > > > Blog
> > > > > > > > > > > > > > > > > > > > > > > <http://rmannibucau.wordpress.
> > com>
> > > |
> > > > > > > Github
> > > > > > > > <
> > > > > > > > > > > > > > > > > https://github.com/
> > > > > > > > > > > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > > > > > > > > > > LinkedIn <
> > > > https://www.linkedin.com/in/
> > > > > > > > > > rmannibucau>
> > > > > > > > > > > |
> > > > > > > > > > > > > > > > > Tomitriber
> > > > > > > > > > > > > > > > > > > > > > > <http://www.tomitribe.com> |
> > > JavaEE
> > > > > > > Factory
> > > > > > > > > > > > > > > > > > > > > > > <https://javaeefactory-
> > > > > > > > rmannibucau.rhcloud.com
> > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > > 2016-10-17 17:18 GMT+02:00
> > sgjava <
> > > > > > > > > > > sgjava@gmail.com
> > > > > > > > > > > > >:
> > > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > > > Periodically I'm seeing
> "Cannot
> > > > > create
> > > > > > a
> > > > > > > > > secure
> > > > > > > > > > > > > > > > > > XMLInputFactory"
> > > > > > > > > > > > > > > > > > > in
> > > > > > > > > > > > > > > > > > > > > > TomEE
> > > > > > > > > > > > > > > > > > > > > > > > 7.0.2-SNAPSHOT. One solution
> is
> > > for
> > > > > CXF
> > > > > > > > using
> > > > > > > > > > > > > > > > > > > > > > > > -Dorg.apache.cxf.stax.
> > > > > > > > allowInsecureParser=1.
> > > > > > > > > > > This
> > > > > > > > > > > > is
> > > > > > > > > > > > > > an
> > > > > > > > > > > > > > > > > older
> > > > > > > > > > > > > > > > > > > > 7.0.2
> > > > > > > > > > > > > > > > > > > > > > from
> > > > > > > > > > > > > > > > > > > > > > > > 7/4/16.
> > > > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > > > > > > > > > > View this message in context:
> > > > > > > > > > > > > > > http://tomee-openejb.979440.
> > > > > > > > > > > > > > > > > > > > > > > >
> n4.nabble.com/Cannot-create-a-
> > > > > > > > > > > > > secure-XMLInputFactory-
> > > > > > > > > > > > > > > > > > > > tp4680348.html
> > > > > > > > > > > > > > > > > > > > > > > > Sent from the TomEE Users
> > mailing
> > > > > list
> > > > > > > > > archive
> > > > > > > > > > at
> > > > > > > > > > > > > > > > Nabble.com.
> > > > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > --
> > > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > > --
> > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > > --
> > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > >
> > > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > > --
> > > > > > > > Steven P. Goldsmith
> > > > > > > >
> > > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > > --
> > > > > > Steven P. Goldsmith
> > > > > >
> > > > >
> > > >
> > > >
> > > >
> > > > --
> > > > Steven P. Goldsmith
> > > >
> > >
> >
> >
> >
> > --
> > Steven P. Goldsmith
> >
>
--
Steven P. Goldsmith
Re: Cannot create a secure XMLInputFactory
Posted by Romain Manni-Bucau <rm...@gmail.com>.
maybe try to reproduce the issue and share a project on github, would
probably be more efficient
Romain Manni-Bucau
@rmannibucau <https://twitter.com/rmannibucau> | Blog
<https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
<http://rmannibucau.wordpress.com> | Github <https://github.com/rmannibucau> |
LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
<http://www.tomitribe.com> | JavaEE Factory
<https://javaeefactory-rmannibucau.rhcloud.com>
2016-10-18 22:37 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> This string also exists in createXMLInputFactory, but it's not logging
> there either (in the exception code) :) I added:
>
> public static XMLInputFactory createXMLInputFactory(boolean nsAware) {
> XMLInputFactory factory = null;
> try {
> factory = XMLInputFactory.newInstance();
> System.out.println("XMLInputFactory " +
> factory.getClass().getName());
>
> and get:
>
> XMLInputFactory com.ctc.wstx.stax.WstxInputFactory
>
>
>
>
> On Tue, Oct 18, 2016 at 4:10 PM, Romain Manni-Bucau <rmannibucau@gmail.com
> >
> wrote:
>
> > Well i dont see this output as well
> >
> > Le 18 oct. 2016 20:28, "Steve Goldsmith" <sg...@gmail.com> a écrit :
> >
> > > It didn't throw an exception there then because I added
> > > System.out.println("setProperty error" + t.getStackTrace()); in the
> > catch
> > > section. This method swallows exceptions any ways, so it couldn't be
> the
> > > one throwing the exception?
> > >
> > > On Tue, Oct 18, 2016 at 2:18 PM, Romain Manni-Bucau <
> > rmannibucau@gmail.com
> > > >
> > > wrote:
> > >
> > > > I dont see any error there or am i abused by gmail formatting?
> > > >
> > > > Le 18 oct. 2016 19:28, "Steve Goldsmith" <sg...@gmail.com> a écrit
> :
> > > >
> > > > > OK, I made the change:
> > > > >
> > > > > private static boolean setProperty(XMLInputFactory f, String p,
> > > > Object
> > > > > o) {
> > > > > try {
> > > > > System.out.println("setProperty f: " + f + " p: " + p
> +
> > "
> > > > o:"
> > > > > +
> > > > > o);
> > > > > f.setProperty(p, o);
> > > > > return true;
> > > > > } catch (Throwable t) {
> > > > > System.out.println("setProperty error" +
> > > t.getStackTrace());
> > > > > //ignore
> > > > > }
> > > > > return false;
> > > > > }
> > > > >
> > > > > and it dumps this:
> > > > >
> > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > com.ctc.wstx.maxAttributesPerElement o:500
> > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > com.ctc.wstx.maxAttributeSize o:65536
> > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > com.ctc.wstx.maxChildrenPerElement o:50000
> > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > com.ctc.wstx.maxElementCount o:9223372036854775807
> > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > com.ctc.wstx.maxElementDepth o:100
> > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > com.ctc.wstx.maxCharacters o:9223372036854775807
> > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > com.ctc.wstx.maxTextLength o:134217728
> > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > com.ctc.wstx.minTextSegment o:64
> > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > javax.xml.stream.isNamespaceAware o:true
> > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > javax.xml.stream.supportDTD o:false
> > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > javax.xml.stream.isReplacingEntityReferences o:false
> > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > javax.xml.stream.isSupportingExternalEntities o:false
> > > > >
> > > > >
> > > > >
> > > > > On Tue, Oct 18, 2016 at 12:14 PM, Romain Manni-Bucau <
> > > > > rmannibucau@gmail.com>
> > > > > wrote:
> > > > >
> > > > > > for tomee embedded yes
> > > > > >
> > > > > >
> > > > > > Romain Manni-Bucau
> > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > > > > rmannibucau> |
> > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > >
> > > > > > 2016-10-18 18:11 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > > > >
> > > > > > > In other words, if I build a debug logging version of cxf how
> > > would I
> > > > > > > incorporate that into my TomEE embedded test? Can I just add
> the
> > > > > > dependency
> > > > > > > in Maven or do I have to exclude the version bundled in TomEE?
> > > > > > >
> > > > > > > On Tue, Oct 18, 2016 at 11:52 AM, Romain Manni-Bucau <
> > > > > > > rmannibucau@gmail.com>
> > > > > > > wrote:
> > > > > > >
> > > > > > > > you should switch them I guess.
> > > > > > > >
> > > > > > > > Generally speaking if you include cxf dependencies in your
> > > > > application
> > > > > > > > there is a property in tomee to ask it to isolate the webapp
> > from
> > > > the
> > > > > > > > container for cxf - not sure I got your question right.
> > > > > > > >
> > > > > > > >
> > > > > > > > Romain Manni-Bucau
> > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > https://github.com/
> > > > > > > > rmannibucau> |
> > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > Tomitriber
> > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > >
> > > > > > > > 2016-10-18 17:40 GMT+02:00 Steve Goldsmith <sgjava@gmail.com
> >:
> > > > > > > >
> > > > > > > > > Do I have to exclude current CXF in TomEE dependencies or
> > just
> > > > > > include
> > > > > > > > the
> > > > > > > > > debug version I'm building?
> > > > > > > > >
> > > > > > > > > On Tue, Oct 18, 2016 at 2:46 AM, Romain Manni-Bucau <
> > > > > > > > rmannibucau@gmail.com
> > > > > > > > > >
> > > > > > > > > wrote:
> > > > > > > > >
> > > > > > > > > > As mentionned in the previous answer this is not in tomee
> > > > sources
> > > > > > but
> > > > > > > > > CXF,
> > > > > > > > > > agree it should be logged at debug level but with current
> > > code
> > > > > > > > debugging
> > > > > > > > > is
> > > > > > > > > > the fastest.
> > > > > > > > > >
> > > > > > > > > > Side note: you dont need to build tomee from sources,
> just
> > > need
> > > > > to
> > > > > > > add
> > > > > > > > > > cxf-core.
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress
> > Blog
> > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > https://github.com/
> > > > > > > > > > rmannibucau> |
> > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > > Tomitriber
> > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > >
> > > > > > > > > > 2016-10-18 3:31 GMT+02:00 Steve Goldsmith <
> > sgjava@gmail.com
> > > >:
> > > > > > > > > >
> > > > > > > > > > > OK, I've built TomEE from source before, but I've not
> run
> > > it
> > > > in
> > > > > > > debug
> > > > > > > > > > mode.
> > > > > > > > > > > Wouldn't it be just as easy to simply log vars f, p
> and o
> > > > when
> > > > > I
> > > > > > > > build
> > > > > > > > > > the
> > > > > > > > > > > source?
> > > > > > > > > > >
> > > > > > > > > > > On Mon, Oct 17, 2016 at 5:09 PM, Romain Manni-Bucau <
> > > > > > > > > > rmannibucau@gmail.com
> > > > > > > > > > > >
> > > > > > > > > > > wrote:
> > > > > > > > > > >
> > > > > > > > > > > > cxf ones yes, that's as easy as adding cxf-core as
> > > provded
> > > > > > > > > dependency,
> > > > > > > > > > > > putting a breakpoint on the mentionned line normally
> > and
> > > > > > starting
> > > > > > > > > tomee
> > > > > > > > > > > in
> > > > > > > > > > > > debug mode. Surely the most efficient way to solve
> it.
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> |
> Blog
> > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old
> Wordpress
> > > > Blog
> > > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > > https://github.com/
> > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > > > > Tomitriber
> > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > > > >
> > > > > > > > > > > > 2016-10-17 22:52 GMT+02:00 Steve Goldsmith <
> > > > sgjava@gmail.com
> > > > > >:
> > > > > > > > > > > >
> > > > > > > > > > > > > You mean set a breakpoint in TomEE source?
> > > > > > > > > > > > >
> > > > > > > > > > > > > On Mon, Oct 17, 2016 at 4:43 PM, Romain
> Manni-Bucau <
> > > > > > > > > > > > rmannibucau@gmail.com
> > > > > > > > > > > > > >
> > > > > > > > > > > > > wrote:
> > > > > > > > > > > > >
> > > > > > > > > > > > > > If you can put a breakpoint at
> > > > > > > > > > > > > > https://github.com/apache/cxf/blob/
> > > > > > > > > eab841d5477c5e1ed21a49918defa7
> > > > > > > > > > > > > > 9a0f1ad533/core/src/main/java/
> > > > org/apache/cxf/staxutils/
> > > > > > > > > > > > > StaxUtils.java#L381
> > > > > > > > > > > > > > then you would know immediately why the throwable
> > is
> > > > > > thrown.
> > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> |
> > > Blog
> > > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old
> > > Wordpress
> > > > > > Blog
> > > > > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > > > > https://github.com/
> > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/
> rmannibucau>
> > |
> > > > > > > > Tomitriber
> > > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > 2016-10-17 22:41 GMT+02:00 Steve Goldsmith <
> > > > > > sgjava@gmail.com
> > > > > > > >:
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > > OK, I made the following change and I still get
> > the
> > > > > > error:
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > <groupId>org.jvnet.jaxb2_
> > > > commons</groupId>
> > > > > > > > > > > > > > > <artifactId>jaxb2-basics-
> > > > > > runtime</artifactId>
> > > > > > > > > > > > > > > <version>0.10.0</version>
> > > > > > > > > > > > > > > <scope>provided</scope>
> > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > I even tried:
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > <groupId>org.apache.tomee</
> groupId>
> > > > > > > > > > > > > > > <artifactId>tomee-jaxrs</
> artifactId>
> > > > > > > > > > > > > > > <version>${tomee.version}</
> version>
> > > > > > > > > > > > > > > <scope>test</scope>
> > > > > > > > > > > > > > > <exclusions>
> > > > > > > > > > > > > > > <exclusion>
> > > > > > > > > > > > > > > <groupId>com.sun.xml.bind</
> > > > > groupId>
> > > > > > > > > > > > > > > <artifactId>jaxb-impl</
> > > > artifactId>
> > > > > > > > > > > > > > > </exclusion>
> > > > > > > > > > > > > > > </exclusions>
> > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > On Mon, Oct 17, 2016 at 3:37 PM, Romain
> > > Manni-Bucau <
> > > > > > > > > > > > > > rmannibucau@gmail.com
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > wrote:
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > well jaxb is provided and shouldnt be
> delivered
> > > so
> > > > > you
> > > > > > > have
> > > > > > > > > to
> > > > > > > > > > > > remove
> > > > > > > > > > > > > > it
> > > > > > > > > > > > > > > > from WEB-INF/lib. scope=provided should be
> fine
> > > > too.
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > > > @rmannibucau <https://twitter.com/
> rmannibucau>
> > |
> > > > > Blog
> > > > > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old
> > > > > Wordpress
> > > > > > > > Blog
> > > > > > > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github
> <
> > > > > > > > > > https://github.com/
> > > > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/
> > > rmannibucau>
> > > > |
> > > > > > > > > > Tomitriber
> > > > > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > > > > > > <https://javaeefactory-
> rmannibucau.rhcloud.com
> > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > 2016-10-17 20:07 GMT+02:00 Steve Goldsmith <
> > > > > > > > sgjava@gmail.com
> > > > > > > > > >:
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > I need JAX-B runtime for code generated by
> > > > > > > > > jaxws-maven-plugin
> > > > > > > > > > > and
> > > > > > > > > > > > > > XJC.
> > > > > > > > > > > > > > > > > Everything else is in test scope and not
> used
> > > in
> > > > > the
> > > > > > > > > deployed
> > > > > > > > > > > > app.
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > <groupId>org.jvnet.jaxb2_
> > > > > > commons</groupId>
> > > > > > > > > > > > > > > > > <artifactId>jaxb2-basics-
> > > > > > > > runtime</artifactId>
> > > > > > > > > > > > > > > > > <version>0.10.0</version>
> > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > On Mon, Oct 17, 2016 at 1:57 PM, Romain
> > > > > Manni-Bucau <
> > > > > > > > > > > > > > > > rmannibucau@gmail.com
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > wrote:
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > yep so surely some part of the app
> running
> > > in a
> > > > > > > > > conflicting
> > > > > > > > > > > > > > > > classloader.
> > > > > > > > > > > > > > > > > > Personally I'd just remove stax2-api,
> > > woodstox
> > > > > and
> > > > > > > jaxb
> > > > > > > > > to
> > > > > > > > > > > > start
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > > > > > @rmannibucau <https://twitter.com/
> > > rmannibucau>
> > > > |
> > > > > > > Blog
> > > > > > > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> |
> > Old
> > > > > > > Wordpress
> > > > > > > > > > Blog
> > > > > > > > > > > > > > > > > > <http://rmannibucau.wordpress.com> |
> > Github
> > > <
> > > > > > > > > > > > https://github.com/
> > > > > > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/
> > > > > rmannibucau>
> > > > > > |
> > > > > > > > > > > > Tomitriber
> > > > > > > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE
> > Factory
> > > > > > > > > > > > > > > > > > <https://javaeefactory-
> > > rmannibucau.rhcloud.com
> > > > >
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > 2016-10-17 19:47 GMT+02:00 Steve
> Goldsmith
> > <
> > > > > > > > > > sgjava@gmail.com
> > > > > > > > > > > >:
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > ~/java/apache-maven-3.3.9/bin/mvn
> > > > > > dependency:tree
> > > > > > > |
> > > > > > > > > > egrep
> > > > > > > > > > > > > > > > > 'woo|xml|stax'
> > > > > > > > > > > > > > > > > > > [INFO] | | +-
> > > > > javax.xml.bind:jaxb-api:jar:2.
> > > > > > > > > > 2.6:test
> > > > > > > > > > > > > > > > > > > [INFO] | | \-
> > > > com.sun.xml.bind:jaxb-impl:
> > > > > > > > > > > jar:2.2.6:test
> > > > > > > > > > > > > > > > > > > [INFO] | | | +-
> > > > > > > org.apache.santuario:xmlsec:
> > > > > > > > > > > > > > > jar:2.0.5:test
> > > > > > > > > > > > > > > > > > > [INFO] | | | | | +-
> > > > > > > > > > > > > > > > > > > org.opensaml:opensaml-xmlsec-
> > > > > api:jar:3.1.1:test
> > > > > > > > > > > > > > > > > > > [INFO] | | | | +-
> > > > > > > > > org.opensaml:opensaml-xmlsec-
> > > > > > > > > > > > > > > > > > > impl:jar:3.1.1:test
> > > > > > > > > > > > > > > > > > > [INFO] | | +-
> > > org.apache.wss4j:wss4j-ws-
> > > > > > > > > > > > > > > > > > security-stax:jar:2.1.4:test
> > > > > > > > > > > > > > > > > > > [INFO] | | +-
> > > > > > > > > > > > > > > > > > > org.apache.wss4j:wss4j-ws-
> > > > > > > > > security-policy-stax:jar:2.1.
> > > > > > > > > > > > 4:test
> > > > > > > > > > > > > > > > > > > [INFO] | | | +-
> > > > > > > xml-resolver:xml-resolver:jar:
> > > > > > > > > > > 1.2:test
> > > > > > > > > > > > > > > > > > > [INFO] | | | +-
> > > org.apache.cxf:cxf-rt-
> > > > > > > > > > > > > > > > > bindings-xml:jar:3.1.6:test
> > > > > > > > > > > > > > > > > > > [INFO] | | \-
> > > > com.sun.xml.messaging.saaj:
> > > > > > > > > > > > > > > > > saaj-impl:jar:1.3.18:test
> > > > > > > > > > > > > > > > > > > [INFO] | | | +-
> > > org.codehaus.woodstox:
> > > > > > > > > > > > > > > > > woodstox-core-asl:jar:4.4.1:
> > > > > > > > > > > > > > > > > > > test
> > > > > > > > > > > > > > > > > > > [INFO] | | | | \-
> > > > > > > org.codehaus.woodstox:stax2-
> > > > > > > > > > > > > > > > > api:jar:3.1.4:test
> > > > > > > > > > > > > > > > > > > [INFO] | | | \-
> > > > org.apache.ws.xmlschema:
> > > > > > > > > > > > > > > > > > > xmlschema-core:jar:2.2.1:test
> > > > > > > > > > > > > > > > > > > [INFO] +-
> > > > > > > > > > > > > > > > > > > com.fasterxml.jackson.jaxrs:
> > > > > > > > > jackson-jaxrs-json-provider:
> > > > > > > > > > > > > > > > jar:2.7.4:test
> > > > > > > > > > > > > > > > > > > [INFO] | +-
> com.fasterxml.jackson.jaxrs:
> > > > > > > > > > > > > > > > jackson-jaxrs-base:jar:2.7.4:
> > > > > > > > > > > > > > > > > > test
> > > > > > > > > > > > > > > > > > > [INFO] | +-
> com.fasterxml.jackson.core:
> > > > > > > > > > > > > > > jackson-core:jar:2.7.4:test
> > > > > > > > > > > > > > > > > > > [INFO] | +-
> com.fasterxml.jackson.core:
> > > > > > > > > > > > > > > jackson-databind:jar:2.7.4:
> > > > > > > > > > > > > > > > > test
> > > > > > > > > > > > > > > > > > > [INFO] | | \-
> > > > > > > > > > > > > > > > > > > com.fasterxml.jackson.core:
> > > > > > > > > > jackson-annotations:jar:2.7.0:
> > > > > > > > > > > > test
> > > > > > > > > > > > > > > > > > > [INFO] | \-
> > > > > > > > > > > > > > > > > > > com.fasterxml.jackson.module:
> > > > > > jackson-module-jaxb-
> > > > > > > > > > > > > > > > > > > annotations:jar:2.7.4:test
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > On Mon, Oct 17, 2016 at 11:40 AM,
> Romain
> > > > > > > Manni-Bucau
> > > > > > > > <
> > > > > > > > > > > > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > > > > > > > > > > > wrote:
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > mvn dependency:tree | egrep
> > > 'woo|xml|stax'
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > > > > > > > @rmannibucau <https://twitter.com/
> > > > > rmannibucau>
> > > > > > |
> > > > > > > > > Blog
> > > > > > > > > > > > > > > > > > > > <https://blog-rmannibucau.
> rhcloud.com>
> > |
> > > > Old
> > > > > > > > > Wordpress
> > > > > > > > > > > > Blog
> > > > > > > > > > > > > > > > > > > > <http://rmannibucau.wordpress.com> |
> > > > Github
> > > > > <
> > > > > > > > > > > > > > https://github.com/
> > > > > > > > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > > > > > > > LinkedIn <
> https://www.linkedin.com/in/
> > > > > > > rmannibucau>
> > > > > > > > |
> > > > > > > > > > > > > > Tomitriber
> > > > > > > > > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE
> > > > Factory
> > > > > > > > > > > > > > > > > > > > <https://javaeefactory-
> > > > > rmannibucau.rhcloud.com
> > > > > > >
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > 2016-10-17 17:36 GMT+02:00 Steve
> > > Goldsmith
> > > > <
> > > > > > > > > > > > sgjava@gmail.com
> > > > > > > > > > > > > >:
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > My compile dependencies are (do you
> > see
> > > > > > > anything
> > > > > > > > > that
> > > > > > > > > > > > > sticks
> > > > > > > > > > > > > > > > out):
> > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > > >
> <groupId>org.jsr107.ri</
> > > > > groupId>
> > > > > > > > > > > > > > > > > > > > >
> > > > <artifactId>cache-annotations-
> > > > > > > > > > > > > > ri-cdi</artifactId>
> > > > > > > > > > > > > > > > > > > > >
> <version>1.0.0</version>
> > > > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > > >
> <groupId>org.jvnet.jaxb2_
> > > > > > > > > > commons</groupId>
> > > > > > > > > > > > > > > > > > > > >
> <artifactId>jaxb2-basics-
> > > > > > > > > > > > runtime</artifactId>
> > > > > > > > > > > > > > > > > > > > >
> <version>0.10.0</version>
> > > > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > > >
> > > <groupId>org.slf4j</groupId>
> > > > > > > > > > > > > > > > > > > > > <artifactId>slf4j-api</
> > > > > > artifactId>
> > > > > > > > > > > > > > > > > > > > >
> > <version>${slf4j.version}</
> > > > > > > version>
> > > > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > > >
> <groupId>ch.qos.logback</
> > > > > > groupId>
> > > > > > > > > > > > > > > > > > > > >
> > > <artifactId>logback-classic</
> > > > > > > > > artifactId>
> > > > > > > > > > > > > > > > > > > > >
> > > <version>${logback.version}</
> > > > > > > > version>
> > > > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > > >
> <groupId>ch.qos.logback</
> > > > > > groupId>
> > > > > > > > > > > > > > > > > > > > >
> > <artifactId>logback-core</
> > > > > > > > artifactId>
> > > > > > > > > > > > > > > > > > > > >
> > > <version>${logback.version}</
> > > > > > > > version>
> > > > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > > >
> > > <groupId>org.apache.commons</
> > > > > > > > groupId>
> > > > > > > > > > > > > > > > > > > > >
> > <artifactId>commons-pool2</
> > > > > > > > artifactId>
> > > > > > > > > > > > > > > > > > > > >
> <version>2.4.2</version>
> > > > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > > > <groupId>commons-
> > > > > > > > > configuration</groupId>
> > > > > > > > > > > > > > > > > > > > > <artifactId>commons-
> > > > > > > > > > > > configuration</artifactId>
> > > > > > > > > > > > > > > > > > > > > <version>1.10</version>
> > > > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > > >
> > > <groupId>org.jasypt</groupId>
> > > > > > > > > > > > > > > > > > > > > <artifactId>jasypt</
> > > > > artifactId>
> > > > > > > > > > > > > > > > > > > > >
> <version>1.9.3-SNAPSHOT</
> > > > > > version>
> > > > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > On Mon, Oct 17, 2016 at 11:30 AM,
> > > Romain
> > > > > > > > > Manni-Bucau
> > > > > > > > > > <
> > > > > > > > > > > > > > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > > > > > > > > > > > > > wrote:
> > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > Hello
> > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > can happen if you provide some
> xml
> > > > > > libraries
> > > > > > > in
> > > > > > > > > > your
> > > > > > > > > > > > app
> > > > > > > > > > > > > -
> > > > > > > > > > > > > > > like
> > > > > > > > > > > > > > > > > > > > woodstox
> > > > > > > > > > > > > > > > > > > > > or
> > > > > > > > > > > > > > > > > > > > > > stax*api - and it conflicts at
> some
> > > > > point.
> > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > > > > > > > > > @rmannibucau <
> https://twitter.com/
> > > > > > > rmannibucau>
> > > > > > > > |
> > > > > > > > > > > Blog
> > > > > > > > > > > > > > > > > > > > > > <https://blog-rmannibucau.
> > > rhcloud.com>
> > > > |
> > > > > > Old
> > > > > > > > > > > Wordpress
> > > > > > > > > > > > > > Blog
> > > > > > > > > > > > > > > > > > > > > > <http://rmannibucau.wordpress.
> com>
> > |
> > > > > > Github
> > > > > > > <
> > > > > > > > > > > > > > > > https://github.com/
> > > > > > > > > > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > > > > > > > > > LinkedIn <
> > > https://www.linkedin.com/in/
> > > > > > > > > rmannibucau>
> > > > > > > > > > |
> > > > > > > > > > > > > > > > Tomitriber
> > > > > > > > > > > > > > > > > > > > > > <http://www.tomitribe.com> |
> > JavaEE
> > > > > > Factory
> > > > > > > > > > > > > > > > > > > > > > <https://javaeefactory-
> > > > > > > rmannibucau.rhcloud.com
> > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > 2016-10-17 17:18 GMT+02:00
> sgjava <
> > > > > > > > > > sgjava@gmail.com
> > > > > > > > > > > >:
> > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > > Periodically I'm seeing "Cannot
> > > > create
> > > > > a
> > > > > > > > secure
> > > > > > > > > > > > > > > > > XMLInputFactory"
> > > > > > > > > > > > > > > > > > in
> > > > > > > > > > > > > > > > > > > > > TomEE
> > > > > > > > > > > > > > > > > > > > > > > 7.0.2-SNAPSHOT. One solution is
> > for
> > > > CXF
> > > > > > > using
> > > > > > > > > > > > > > > > > > > > > > > -Dorg.apache.cxf.stax.
> > > > > > > allowInsecureParser=1.
> > > > > > > > > > This
> > > > > > > > > > > is
> > > > > > > > > > > > > an
> > > > > > > > > > > > > > > > older
> > > > > > > > > > > > > > > > > > > 7.0.2
> > > > > > > > > > > > > > > > > > > > > from
> > > > > > > > > > > > > > > > > > > > > > > 7/4/16.
> > > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > > > > > > > > > View this message in context:
> > > > > > > > > > > > > > http://tomee-openejb.979440.
> > > > > > > > > > > > > > > > > > > > > > > n4.nabble.com/Cannot-create-a-
> > > > > > > > > > > > secure-XMLInputFactory-
> > > > > > > > > > > > > > > > > > > tp4680348.html
> > > > > > > > > > > > > > > > > > > > > > > Sent from the TomEE Users
> mailing
> > > > list
> > > > > > > > archive
> > > > > > > > > at
> > > > > > > > > > > > > > > Nabble.com.
> > > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > > --
> > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > > --
> > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > >
> > > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > --
> > > > > > > > > Steven P. Goldsmith
> > > > > > > > >
> > > > > > > >
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > > --
> > > > > > > Steven P. Goldsmith
> > > > > > >
> > > > > >
> > > > >
> > > > >
> > > > >
> > > > > --
> > > > > Steven P. Goldsmith
> > > > >
> > > >
> > >
> > >
> > >
> > > --
> > > Steven P. Goldsmith
> > >
> >
>
>
>
> --
> Steven P. Goldsmith
>
Re: Cannot create a secure XMLInputFactory
Posted by Steve Goldsmith <sg...@gmail.com>.
This string also exists in createXMLInputFactory, but it's not logging
there either (in the exception code) :) I added:
public static XMLInputFactory createXMLInputFactory(boolean nsAware) {
XMLInputFactory factory = null;
try {
factory = XMLInputFactory.newInstance();
System.out.println("XMLInputFactory " +
factory.getClass().getName());
and get:
XMLInputFactory com.ctc.wstx.stax.WstxInputFactory
On Tue, Oct 18, 2016 at 4:10 PM, Romain Manni-Bucau <rm...@gmail.com>
wrote:
> Well i dont see this output as well
>
> Le 18 oct. 2016 20:28, "Steve Goldsmith" <sg...@gmail.com> a écrit :
>
> > It didn't throw an exception there then because I added
> > System.out.println("setProperty error" + t.getStackTrace()); in the
> catch
> > section. This method swallows exceptions any ways, so it couldn't be the
> > one throwing the exception?
> >
> > On Tue, Oct 18, 2016 at 2:18 PM, Romain Manni-Bucau <
> rmannibucau@gmail.com
> > >
> > wrote:
> >
> > > I dont see any error there or am i abused by gmail formatting?
> > >
> > > Le 18 oct. 2016 19:28, "Steve Goldsmith" <sg...@gmail.com> a écrit :
> > >
> > > > OK, I made the change:
> > > >
> > > > private static boolean setProperty(XMLInputFactory f, String p,
> > > Object
> > > > o) {
> > > > try {
> > > > System.out.println("setProperty f: " + f + " p: " + p +
> "
> > > o:"
> > > > +
> > > > o);
> > > > f.setProperty(p, o);
> > > > return true;
> > > > } catch (Throwable t) {
> > > > System.out.println("setProperty error" +
> > t.getStackTrace());
> > > > //ignore
> > > > }
> > > > return false;
> > > > }
> > > >
> > > > and it dumps this:
> > > >
> > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > com.ctc.wstx.maxAttributesPerElement o:500
> > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > com.ctc.wstx.maxAttributeSize o:65536
> > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > com.ctc.wstx.maxChildrenPerElement o:50000
> > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > com.ctc.wstx.maxElementCount o:9223372036854775807
> > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > com.ctc.wstx.maxElementDepth o:100
> > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > com.ctc.wstx.maxCharacters o:9223372036854775807
> > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > com.ctc.wstx.maxTextLength o:134217728
> > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > com.ctc.wstx.minTextSegment o:64
> > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > javax.xml.stream.isNamespaceAware o:true
> > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > javax.xml.stream.supportDTD o:false
> > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > javax.xml.stream.isReplacingEntityReferences o:false
> > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > javax.xml.stream.isSupportingExternalEntities o:false
> > > >
> > > >
> > > >
> > > > On Tue, Oct 18, 2016 at 12:14 PM, Romain Manni-Bucau <
> > > > rmannibucau@gmail.com>
> > > > wrote:
> > > >
> > > > > for tomee embedded yes
> > > > >
> > > > >
> > > > > Romain Manni-Bucau
> > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > > > rmannibucau> |
> > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > >
> > > > > 2016-10-18 18:11 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > > >
> > > > > > In other words, if I build a debug logging version of cxf how
> > would I
> > > > > > incorporate that into my TomEE embedded test? Can I just add the
> > > > > dependency
> > > > > > in Maven or do I have to exclude the version bundled in TomEE?
> > > > > >
> > > > > > On Tue, Oct 18, 2016 at 11:52 AM, Romain Manni-Bucau <
> > > > > > rmannibucau@gmail.com>
> > > > > > wrote:
> > > > > >
> > > > > > > you should switch them I guess.
> > > > > > >
> > > > > > > Generally speaking if you include cxf dependencies in your
> > > > application
> > > > > > > there is a property in tomee to ask it to isolate the webapp
> from
> > > the
> > > > > > > container for cxf - not sure I got your question right.
> > > > > > >
> > > > > > >
> > > > > > > Romain Manni-Bucau
> > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > > > <http://rmannibucau.wordpress.com> | Github <
> https://github.com/
> > > > > > > rmannibucau> |
> > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> Tomitriber
> > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > >
> > > > > > > 2016-10-18 17:40 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > > > > >
> > > > > > > > Do I have to exclude current CXF in TomEE dependencies or
> just
> > > > > include
> > > > > > > the
> > > > > > > > debug version I'm building?
> > > > > > > >
> > > > > > > > On Tue, Oct 18, 2016 at 2:46 AM, Romain Manni-Bucau <
> > > > > > > rmannibucau@gmail.com
> > > > > > > > >
> > > > > > > > wrote:
> > > > > > > >
> > > > > > > > > As mentionned in the previous answer this is not in tomee
> > > sources
> > > > > but
> > > > > > > > CXF,
> > > > > > > > > agree it should be logged at debug level but with current
> > code
> > > > > > > debugging
> > > > > > > > is
> > > > > > > > > the fastest.
> > > > > > > > >
> > > > > > > > > Side note: you dont need to build tomee from sources, just
> > need
> > > > to
> > > > > > add
> > > > > > > > > cxf-core.
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > Romain Manni-Bucau
> > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress
> Blog
> > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > https://github.com/
> > > > > > > > > rmannibucau> |
> > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > Tomitriber
> > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > >
> > > > > > > > > 2016-10-18 3:31 GMT+02:00 Steve Goldsmith <
> sgjava@gmail.com
> > >:
> > > > > > > > >
> > > > > > > > > > OK, I've built TomEE from source before, but I've not run
> > it
> > > in
> > > > > > debug
> > > > > > > > > mode.
> > > > > > > > > > Wouldn't it be just as easy to simply log vars f, p and o
> > > when
> > > > I
> > > > > > > build
> > > > > > > > > the
> > > > > > > > > > source?
> > > > > > > > > >
> > > > > > > > > > On Mon, Oct 17, 2016 at 5:09 PM, Romain Manni-Bucau <
> > > > > > > > > rmannibucau@gmail.com
> > > > > > > > > > >
> > > > > > > > > > wrote:
> > > > > > > > > >
> > > > > > > > > > > cxf ones yes, that's as easy as adding cxf-core as
> > provded
> > > > > > > > dependency,
> > > > > > > > > > > putting a breakpoint on the mentionned line normally
> and
> > > > > starting
> > > > > > > > tomee
> > > > > > > > > > in
> > > > > > > > > > > debug mode. Surely the most efficient way to solve it.
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress
> > > Blog
> > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > https://github.com/
> > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > > > Tomitriber
> > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > > >
> > > > > > > > > > > 2016-10-17 22:52 GMT+02:00 Steve Goldsmith <
> > > sgjava@gmail.com
> > > > >:
> > > > > > > > > > >
> > > > > > > > > > > > You mean set a breakpoint in TomEE source?
> > > > > > > > > > > >
> > > > > > > > > > > > On Mon, Oct 17, 2016 at 4:43 PM, Romain Manni-Bucau <
> > > > > > > > > > > rmannibucau@gmail.com
> > > > > > > > > > > > >
> > > > > > > > > > > > wrote:
> > > > > > > > > > > >
> > > > > > > > > > > > > If you can put a breakpoint at
> > > > > > > > > > > > > https://github.com/apache/cxf/blob/
> > > > > > > > eab841d5477c5e1ed21a49918defa7
> > > > > > > > > > > > > 9a0f1ad533/core/src/main/java/
> > > org/apache/cxf/staxutils/
> > > > > > > > > > > > StaxUtils.java#L381
> > > > > > > > > > > > > then you would know immediately why the throwable
> is
> > > > > thrown.
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> |
> > Blog
> > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old
> > Wordpress
> > > > > Blog
> > > > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > > > https://github.com/
> > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau>
> |
> > > > > > > Tomitriber
> > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > > > > >
> > > > > > > > > > > > > 2016-10-17 22:41 GMT+02:00 Steve Goldsmith <
> > > > > sgjava@gmail.com
> > > > > > >:
> > > > > > > > > > > > >
> > > > > > > > > > > > > > OK, I made the following change and I still get
> the
> > > > > error:
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > <groupId>org.jvnet.jaxb2_
> > > commons</groupId>
> > > > > > > > > > > > > > <artifactId>jaxb2-basics-
> > > > > runtime</artifactId>
> > > > > > > > > > > > > > <version>0.10.0</version>
> > > > > > > > > > > > > > <scope>provided</scope>
> > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > I even tried:
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > <groupId>org.apache.tomee</groupId>
> > > > > > > > > > > > > > <artifactId>tomee-jaxrs</artifactId>
> > > > > > > > > > > > > > <version>${tomee.version}</version>
> > > > > > > > > > > > > > <scope>test</scope>
> > > > > > > > > > > > > > <exclusions>
> > > > > > > > > > > > > > <exclusion>
> > > > > > > > > > > > > > <groupId>com.sun.xml.bind</
> > > > groupId>
> > > > > > > > > > > > > > <artifactId>jaxb-impl</
> > > artifactId>
> > > > > > > > > > > > > > </exclusion>
> > > > > > > > > > > > > > </exclusions>
> > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > On Mon, Oct 17, 2016 at 3:37 PM, Romain
> > Manni-Bucau <
> > > > > > > > > > > > > rmannibucau@gmail.com
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > wrote:
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > > well jaxb is provided and shouldnt be delivered
> > so
> > > > you
> > > > > > have
> > > > > > > > to
> > > > > > > > > > > remove
> > > > > > > > > > > > > it
> > > > > > > > > > > > > > > from WEB-INF/lib. scope=provided should be fine
> > > too.
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau>
> |
> > > > Blog
> > > > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old
> > > > Wordpress
> > > > > > > Blog
> > > > > > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > > > > > https://github.com/
> > > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/
> > rmannibucau>
> > > |
> > > > > > > > > Tomitriber
> > > > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com
> >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > 2016-10-17 20:07 GMT+02:00 Steve Goldsmith <
> > > > > > > sgjava@gmail.com
> > > > > > > > >:
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > I need JAX-B runtime for code generated by
> > > > > > > > jaxws-maven-plugin
> > > > > > > > > > and
> > > > > > > > > > > > > XJC.
> > > > > > > > > > > > > > > > Everything else is in test scope and not used
> > in
> > > > the
> > > > > > > > deployed
> > > > > > > > > > > app.
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > <groupId>org.jvnet.jaxb2_
> > > > > commons</groupId>
> > > > > > > > > > > > > > > > <artifactId>jaxb2-basics-
> > > > > > > runtime</artifactId>
> > > > > > > > > > > > > > > > <version>0.10.0</version>
> > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > On Mon, Oct 17, 2016 at 1:57 PM, Romain
> > > > Manni-Bucau <
> > > > > > > > > > > > > > > rmannibucau@gmail.com
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > wrote:
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > yep so surely some part of the app running
> > in a
> > > > > > > > conflicting
> > > > > > > > > > > > > > > classloader.
> > > > > > > > > > > > > > > > > Personally I'd just remove stax2-api,
> > woodstox
> > > > and
> > > > > > jaxb
> > > > > > > > to
> > > > > > > > > > > start
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > > > > @rmannibucau <https://twitter.com/
> > rmannibucau>
> > > |
> > > > > > Blog
> > > > > > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> |
> Old
> > > > > > Wordpress
> > > > > > > > > Blog
> > > > > > > > > > > > > > > > > <http://rmannibucau.wordpress.com> |
> Github
> > <
> > > > > > > > > > > https://github.com/
> > > > > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/
> > > > rmannibucau>
> > > > > |
> > > > > > > > > > > Tomitriber
> > > > > > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE
> Factory
> > > > > > > > > > > > > > > > > <https://javaeefactory-
> > rmannibucau.rhcloud.com
> > > >
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > 2016-10-17 19:47 GMT+02:00 Steve Goldsmith
> <
> > > > > > > > > sgjava@gmail.com
> > > > > > > > > > >:
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > ~/java/apache-maven-3.3.9/bin/mvn
> > > > > dependency:tree
> > > > > > |
> > > > > > > > > egrep
> > > > > > > > > > > > > > > > 'woo|xml|stax'
> > > > > > > > > > > > > > > > > > [INFO] | | +-
> > > > javax.xml.bind:jaxb-api:jar:2.
> > > > > > > > > 2.6:test
> > > > > > > > > > > > > > > > > > [INFO] | | \-
> > > com.sun.xml.bind:jaxb-impl:
> > > > > > > > > > jar:2.2.6:test
> > > > > > > > > > > > > > > > > > [INFO] | | | +-
> > > > > > org.apache.santuario:xmlsec:
> > > > > > > > > > > > > > jar:2.0.5:test
> > > > > > > > > > > > > > > > > > [INFO] | | | | | +-
> > > > > > > > > > > > > > > > > > org.opensaml:opensaml-xmlsec-
> > > > api:jar:3.1.1:test
> > > > > > > > > > > > > > > > > > [INFO] | | | | +-
> > > > > > > > org.opensaml:opensaml-xmlsec-
> > > > > > > > > > > > > > > > > > impl:jar:3.1.1:test
> > > > > > > > > > > > > > > > > > [INFO] | | +-
> > org.apache.wss4j:wss4j-ws-
> > > > > > > > > > > > > > > > > security-stax:jar:2.1.4:test
> > > > > > > > > > > > > > > > > > [INFO] | | +-
> > > > > > > > > > > > > > > > > > org.apache.wss4j:wss4j-ws-
> > > > > > > > security-policy-stax:jar:2.1.
> > > > > > > > > > > 4:test
> > > > > > > > > > > > > > > > > > [INFO] | | | +-
> > > > > > xml-resolver:xml-resolver:jar:
> > > > > > > > > > 1.2:test
> > > > > > > > > > > > > > > > > > [INFO] | | | +-
> > org.apache.cxf:cxf-rt-
> > > > > > > > > > > > > > > > bindings-xml:jar:3.1.6:test
> > > > > > > > > > > > > > > > > > [INFO] | | \-
> > > com.sun.xml.messaging.saaj:
> > > > > > > > > > > > > > > > saaj-impl:jar:1.3.18:test
> > > > > > > > > > > > > > > > > > [INFO] | | | +-
> > org.codehaus.woodstox:
> > > > > > > > > > > > > > > > woodstox-core-asl:jar:4.4.1:
> > > > > > > > > > > > > > > > > > test
> > > > > > > > > > > > > > > > > > [INFO] | | | | \-
> > > > > > org.codehaus.woodstox:stax2-
> > > > > > > > > > > > > > > > api:jar:3.1.4:test
> > > > > > > > > > > > > > > > > > [INFO] | | | \-
> > > org.apache.ws.xmlschema:
> > > > > > > > > > > > > > > > > > xmlschema-core:jar:2.2.1:test
> > > > > > > > > > > > > > > > > > [INFO] +-
> > > > > > > > > > > > > > > > > > com.fasterxml.jackson.jaxrs:
> > > > > > > > jackson-jaxrs-json-provider:
> > > > > > > > > > > > > > > jar:2.7.4:test
> > > > > > > > > > > > > > > > > > [INFO] | +- com.fasterxml.jackson.jaxrs:
> > > > > > > > > > > > > > > jackson-jaxrs-base:jar:2.7.4:
> > > > > > > > > > > > > > > > > test
> > > > > > > > > > > > > > > > > > [INFO] | +- com.fasterxml.jackson.core:
> > > > > > > > > > > > > > jackson-core:jar:2.7.4:test
> > > > > > > > > > > > > > > > > > [INFO] | +- com.fasterxml.jackson.core:
> > > > > > > > > > > > > > jackson-databind:jar:2.7.4:
> > > > > > > > > > > > > > > > test
> > > > > > > > > > > > > > > > > > [INFO] | | \-
> > > > > > > > > > > > > > > > > > com.fasterxml.jackson.core:
> > > > > > > > > jackson-annotations:jar:2.7.0:
> > > > > > > > > > > test
> > > > > > > > > > > > > > > > > > [INFO] | \-
> > > > > > > > > > > > > > > > > > com.fasterxml.jackson.module:
> > > > > jackson-module-jaxb-
> > > > > > > > > > > > > > > > > > annotations:jar:2.7.4:test
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > On Mon, Oct 17, 2016 at 11:40 AM, Romain
> > > > > > Manni-Bucau
> > > > > > > <
> > > > > > > > > > > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > > > > > > > > > > wrote:
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > mvn dependency:tree | egrep
> > 'woo|xml|stax'
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > > > > > > @rmannibucau <https://twitter.com/
> > > > rmannibucau>
> > > > > |
> > > > > > > > Blog
> > > > > > > > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com>
> |
> > > Old
> > > > > > > > Wordpress
> > > > > > > > > > > Blog
> > > > > > > > > > > > > > > > > > > <http://rmannibucau.wordpress.com> |
> > > Github
> > > > <
> > > > > > > > > > > > > https://github.com/
> > > > > > > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/
> > > > > > rmannibucau>
> > > > > > > |
> > > > > > > > > > > > > Tomitriber
> > > > > > > > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE
> > > Factory
> > > > > > > > > > > > > > > > > > > <https://javaeefactory-
> > > > rmannibucau.rhcloud.com
> > > > > >
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > 2016-10-17 17:36 GMT+02:00 Steve
> > Goldsmith
> > > <
> > > > > > > > > > > sgjava@gmail.com
> > > > > > > > > > > > >:
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > My compile dependencies are (do you
> see
> > > > > > anything
> > > > > > > > that
> > > > > > > > > > > > sticks
> > > > > > > > > > > > > > > out):
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > > <groupId>org.jsr107.ri</
> > > > groupId>
> > > > > > > > > > > > > > > > > > > >
> > > <artifactId>cache-annotations-
> > > > > > > > > > > > > ri-cdi</artifactId>
> > > > > > > > > > > > > > > > > > > > <version>1.0.0</version>
> > > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > > <groupId>org.jvnet.jaxb2_
> > > > > > > > > commons</groupId>
> > > > > > > > > > > > > > > > > > > > <artifactId>jaxb2-basics-
> > > > > > > > > > > runtime</artifactId>
> > > > > > > > > > > > > > > > > > > > <version>0.10.0</version>
> > > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > >
> > <groupId>org.slf4j</groupId>
> > > > > > > > > > > > > > > > > > > > <artifactId>slf4j-api</
> > > > > artifactId>
> > > > > > > > > > > > > > > > > > > >
> <version>${slf4j.version}</
> > > > > > version>
> > > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > > <groupId>ch.qos.logback</
> > > > > groupId>
> > > > > > > > > > > > > > > > > > > >
> > <artifactId>logback-classic</
> > > > > > > > artifactId>
> > > > > > > > > > > > > > > > > > > >
> > <version>${logback.version}</
> > > > > > > version>
> > > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > > <groupId>ch.qos.logback</
> > > > > groupId>
> > > > > > > > > > > > > > > > > > > >
> <artifactId>logback-core</
> > > > > > > artifactId>
> > > > > > > > > > > > > > > > > > > >
> > <version>${logback.version}</
> > > > > > > version>
> > > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > >
> > <groupId>org.apache.commons</
> > > > > > > groupId>
> > > > > > > > > > > > > > > > > > > >
> <artifactId>commons-pool2</
> > > > > > > artifactId>
> > > > > > > > > > > > > > > > > > > > <version>2.4.2</version>
> > > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > > <groupId>commons-
> > > > > > > > configuration</groupId>
> > > > > > > > > > > > > > > > > > > > <artifactId>commons-
> > > > > > > > > > > configuration</artifactId>
> > > > > > > > > > > > > > > > > > > > <version>1.10</version>
> > > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > >
> > <groupId>org.jasypt</groupId>
> > > > > > > > > > > > > > > > > > > > <artifactId>jasypt</
> > > > artifactId>
> > > > > > > > > > > > > > > > > > > > <version>1.9.3-SNAPSHOT</
> > > > > version>
> > > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > On Mon, Oct 17, 2016 at 11:30 AM,
> > Romain
> > > > > > > > Manni-Bucau
> > > > > > > > > <
> > > > > > > > > > > > > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > > > > > > > > > > > > wrote:
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > Hello
> > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > can happen if you provide some xml
> > > > > libraries
> > > > > > in
> > > > > > > > > your
> > > > > > > > > > > app
> > > > > > > > > > > > -
> > > > > > > > > > > > > > like
> > > > > > > > > > > > > > > > > > > woodstox
> > > > > > > > > > > > > > > > > > > > or
> > > > > > > > > > > > > > > > > > > > > stax*api - and it conflicts at some
> > > > point.
> > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > > > > > > > > @rmannibucau <https://twitter.com/
> > > > > > rmannibucau>
> > > > > > > |
> > > > > > > > > > Blog
> > > > > > > > > > > > > > > > > > > > > <https://blog-rmannibucau.
> > rhcloud.com>
> > > |
> > > > > Old
> > > > > > > > > > Wordpress
> > > > > > > > > > > > > Blog
> > > > > > > > > > > > > > > > > > > > > <http://rmannibucau.wordpress.com>
> |
> > > > > Github
> > > > > > <
> > > > > > > > > > > > > > > https://github.com/
> > > > > > > > > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > > > > > > > > LinkedIn <
> > https://www.linkedin.com/in/
> > > > > > > > rmannibucau>
> > > > > > > > > |
> > > > > > > > > > > > > > > Tomitriber
> > > > > > > > > > > > > > > > > > > > > <http://www.tomitribe.com> |
> JavaEE
> > > > > Factory
> > > > > > > > > > > > > > > > > > > > > <https://javaeefactory-
> > > > > > rmannibucau.rhcloud.com
> > > > > > > >
> > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > 2016-10-17 17:18 GMT+02:00 sgjava <
> > > > > > > > > sgjava@gmail.com
> > > > > > > > > > >:
> > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > Periodically I'm seeing "Cannot
> > > create
> > > > a
> > > > > > > secure
> > > > > > > > > > > > > > > > XMLInputFactory"
> > > > > > > > > > > > > > > > > in
> > > > > > > > > > > > > > > > > > > > TomEE
> > > > > > > > > > > > > > > > > > > > > > 7.0.2-SNAPSHOT. One solution is
> for
> > > CXF
> > > > > > using
> > > > > > > > > > > > > > > > > > > > > > -Dorg.apache.cxf.stax.
> > > > > > allowInsecureParser=1.
> > > > > > > > > This
> > > > > > > > > > is
> > > > > > > > > > > > an
> > > > > > > > > > > > > > > older
> > > > > > > > > > > > > > > > > > 7.0.2
> > > > > > > > > > > > > > > > > > > > from
> > > > > > > > > > > > > > > > > > > > > > 7/4/16.
> > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > > > > > > > > View this message in context:
> > > > > > > > > > > > > http://tomee-openejb.979440.
> > > > > > > > > > > > > > > > > > > > > > n4.nabble.com/Cannot-create-a-
> > > > > > > > > > > secure-XMLInputFactory-
> > > > > > > > > > > > > > > > > > tp4680348.html
> > > > > > > > > > > > > > > > > > > > > > Sent from the TomEE Users mailing
> > > list
> > > > > > > archive
> > > > > > > > at
> > > > > > > > > > > > > > Nabble.com.
> > > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > --
> > > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > > --
> > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > > --
> > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > >
> > > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > > --
> > > > > > > > Steven P. Goldsmith
> > > > > > > >
> > > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > > --
> > > > > > Steven P. Goldsmith
> > > > > >
> > > > >
> > > >
> > > >
> > > >
> > > > --
> > > > Steven P. Goldsmith
> > > >
> > >
> >
> >
> >
> > --
> > Steven P. Goldsmith
> >
>
--
Steven P. Goldsmith
Re: Cannot create a secure XMLInputFactory
Posted by Romain Manni-Bucau <rm...@gmail.com>.
Well i dont see this output as well
Le 18 oct. 2016 20:28, "Steve Goldsmith" <sg...@gmail.com> a écrit :
> It didn't throw an exception there then because I added
> System.out.println("setProperty error" + t.getStackTrace()); in the catch
> section. This method swallows exceptions any ways, so it couldn't be the
> one throwing the exception?
>
> On Tue, Oct 18, 2016 at 2:18 PM, Romain Manni-Bucau <rmannibucau@gmail.com
> >
> wrote:
>
> > I dont see any error there or am i abused by gmail formatting?
> >
> > Le 18 oct. 2016 19:28, "Steve Goldsmith" <sg...@gmail.com> a écrit :
> >
> > > OK, I made the change:
> > >
> > > private static boolean setProperty(XMLInputFactory f, String p,
> > Object
> > > o) {
> > > try {
> > > System.out.println("setProperty f: " + f + " p: " + p + "
> > o:"
> > > +
> > > o);
> > > f.setProperty(p, o);
> > > return true;
> > > } catch (Throwable t) {
> > > System.out.println("setProperty error" +
> t.getStackTrace());
> > > //ignore
> > > }
> > > return false;
> > > }
> > >
> > > and it dumps this:
> > >
> > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > com.ctc.wstx.maxAttributesPerElement o:500
> > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > com.ctc.wstx.maxAttributeSize o:65536
> > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > com.ctc.wstx.maxChildrenPerElement o:50000
> > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > com.ctc.wstx.maxElementCount o:9223372036854775807
> > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > com.ctc.wstx.maxElementDepth o:100
> > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > com.ctc.wstx.maxCharacters o:9223372036854775807
> > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > com.ctc.wstx.maxTextLength o:134217728
> > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > com.ctc.wstx.minTextSegment o:64
> > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > javax.xml.stream.isNamespaceAware o:true
> > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > javax.xml.stream.supportDTD o:false
> > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > javax.xml.stream.isReplacingEntityReferences o:false
> > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > javax.xml.stream.isSupportingExternalEntities o:false
> > >
> > >
> > >
> > > On Tue, Oct 18, 2016 at 12:14 PM, Romain Manni-Bucau <
> > > rmannibucau@gmail.com>
> > > wrote:
> > >
> > > > for tomee embedded yes
> > > >
> > > >
> > > > Romain Manni-Bucau
> > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > > rmannibucau> |
> > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > >
> > > > 2016-10-18 18:11 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > >
> > > > > In other words, if I build a debug logging version of cxf how
> would I
> > > > > incorporate that into my TomEE embedded test? Can I just add the
> > > > dependency
> > > > > in Maven or do I have to exclude the version bundled in TomEE?
> > > > >
> > > > > On Tue, Oct 18, 2016 at 11:52 AM, Romain Manni-Bucau <
> > > > > rmannibucau@gmail.com>
> > > > > wrote:
> > > > >
> > > > > > you should switch them I guess.
> > > > > >
> > > > > > Generally speaking if you include cxf dependencies in your
> > > application
> > > > > > there is a property in tomee to ask it to isolate the webapp from
> > the
> > > > > > container for cxf - not sure I got your question right.
> > > > > >
> > > > > >
> > > > > > Romain Manni-Bucau
> > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > > > > rmannibucau> |
> > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > >
> > > > > > 2016-10-18 17:40 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > > > >
> > > > > > > Do I have to exclude current CXF in TomEE dependencies or just
> > > > include
> > > > > > the
> > > > > > > debug version I'm building?
> > > > > > >
> > > > > > > On Tue, Oct 18, 2016 at 2:46 AM, Romain Manni-Bucau <
> > > > > > rmannibucau@gmail.com
> > > > > > > >
> > > > > > > wrote:
> > > > > > >
> > > > > > > > As mentionned in the previous answer this is not in tomee
> > sources
> > > > but
> > > > > > > CXF,
> > > > > > > > agree it should be logged at debug level but with current
> code
> > > > > > debugging
> > > > > > > is
> > > > > > > > the fastest.
> > > > > > > >
> > > > > > > > Side note: you dont need to build tomee from sources, just
> need
> > > to
> > > > > add
> > > > > > > > cxf-core.
> > > > > > > >
> > > > > > > >
> > > > > > > > Romain Manni-Bucau
> > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > https://github.com/
> > > > > > > > rmannibucau> |
> > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > Tomitriber
> > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > >
> > > > > > > > 2016-10-18 3:31 GMT+02:00 Steve Goldsmith <sgjava@gmail.com
> >:
> > > > > > > >
> > > > > > > > > OK, I've built TomEE from source before, but I've not run
> it
> > in
> > > > > debug
> > > > > > > > mode.
> > > > > > > > > Wouldn't it be just as easy to simply log vars f, p and o
> > when
> > > I
> > > > > > build
> > > > > > > > the
> > > > > > > > > source?
> > > > > > > > >
> > > > > > > > > On Mon, Oct 17, 2016 at 5:09 PM, Romain Manni-Bucau <
> > > > > > > > rmannibucau@gmail.com
> > > > > > > > > >
> > > > > > > > > wrote:
> > > > > > > > >
> > > > > > > > > > cxf ones yes, that's as easy as adding cxf-core as
> provded
> > > > > > > dependency,
> > > > > > > > > > putting a breakpoint on the mentionned line normally and
> > > > starting
> > > > > > > tomee
> > > > > > > > > in
> > > > > > > > > > debug mode. Surely the most efficient way to solve it.
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress
> > Blog
> > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > https://github.com/
> > > > > > > > > > rmannibucau> |
> > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > > Tomitriber
> > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > >
> > > > > > > > > > 2016-10-17 22:52 GMT+02:00 Steve Goldsmith <
> > sgjava@gmail.com
> > > >:
> > > > > > > > > >
> > > > > > > > > > > You mean set a breakpoint in TomEE source?
> > > > > > > > > > >
> > > > > > > > > > > On Mon, Oct 17, 2016 at 4:43 PM, Romain Manni-Bucau <
> > > > > > > > > > rmannibucau@gmail.com
> > > > > > > > > > > >
> > > > > > > > > > > wrote:
> > > > > > > > > > >
> > > > > > > > > > > > If you can put a breakpoint at
> > > > > > > > > > > > https://github.com/apache/cxf/blob/
> > > > > > > eab841d5477c5e1ed21a49918defa7
> > > > > > > > > > > > 9a0f1ad533/core/src/main/java/
> > org/apache/cxf/staxutils/
> > > > > > > > > > > StaxUtils.java#L381
> > > > > > > > > > > > then you would know immediately why the throwable is
> > > > thrown.
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> |
> Blog
> > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old
> Wordpress
> > > > Blog
> > > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > > https://github.com/
> > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > > > > Tomitriber
> > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > > > >
> > > > > > > > > > > > 2016-10-17 22:41 GMT+02:00 Steve Goldsmith <
> > > > sgjava@gmail.com
> > > > > >:
> > > > > > > > > > > >
> > > > > > > > > > > > > OK, I made the following change and I still get the
> > > > error:
> > > > > > > > > > > > >
> > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > <groupId>org.jvnet.jaxb2_
> > commons</groupId>
> > > > > > > > > > > > > <artifactId>jaxb2-basics-
> > > > runtime</artifactId>
> > > > > > > > > > > > > <version>0.10.0</version>
> > > > > > > > > > > > > <scope>provided</scope>
> > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > >
> > > > > > > > > > > > > I even tried:
> > > > > > > > > > > > >
> > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > <groupId>org.apache.tomee</groupId>
> > > > > > > > > > > > > <artifactId>tomee-jaxrs</artifactId>
> > > > > > > > > > > > > <version>${tomee.version}</version>
> > > > > > > > > > > > > <scope>test</scope>
> > > > > > > > > > > > > <exclusions>
> > > > > > > > > > > > > <exclusion>
> > > > > > > > > > > > > <groupId>com.sun.xml.bind</
> > > groupId>
> > > > > > > > > > > > > <artifactId>jaxb-impl</
> > artifactId>
> > > > > > > > > > > > > </exclusion>
> > > > > > > > > > > > > </exclusions>
> > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > > On Mon, Oct 17, 2016 at 3:37 PM, Romain
> Manni-Bucau <
> > > > > > > > > > > > rmannibucau@gmail.com
> > > > > > > > > > > > > >
> > > > > > > > > > > > > wrote:
> > > > > > > > > > > > >
> > > > > > > > > > > > > > well jaxb is provided and shouldnt be delivered
> so
> > > you
> > > > > have
> > > > > > > to
> > > > > > > > > > remove
> > > > > > > > > > > > it
> > > > > > > > > > > > > > from WEB-INF/lib. scope=provided should be fine
> > too.
> > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> |
> > > Blog
> > > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old
> > > Wordpress
> > > > > > Blog
> > > > > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > > > > https://github.com/
> > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/
> rmannibucau>
> > |
> > > > > > > > Tomitriber
> > > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > 2016-10-17 20:07 GMT+02:00 Steve Goldsmith <
> > > > > > sgjava@gmail.com
> > > > > > > >:
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > > I need JAX-B runtime for code generated by
> > > > > > > jaxws-maven-plugin
> > > > > > > > > and
> > > > > > > > > > > > XJC.
> > > > > > > > > > > > > > > Everything else is in test scope and not used
> in
> > > the
> > > > > > > deployed
> > > > > > > > > > app.
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > <groupId>org.jvnet.jaxb2_
> > > > commons</groupId>
> > > > > > > > > > > > > > > <artifactId>jaxb2-basics-
> > > > > > runtime</artifactId>
> > > > > > > > > > > > > > > <version>0.10.0</version>
> > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > On Mon, Oct 17, 2016 at 1:57 PM, Romain
> > > Manni-Bucau <
> > > > > > > > > > > > > > rmannibucau@gmail.com
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > wrote:
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > yep so surely some part of the app running
> in a
> > > > > > > conflicting
> > > > > > > > > > > > > > classloader.
> > > > > > > > > > > > > > > > Personally I'd just remove stax2-api,
> woodstox
> > > and
> > > > > jaxb
> > > > > > > to
> > > > > > > > > > start
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > > > @rmannibucau <https://twitter.com/
> rmannibucau>
> > |
> > > > > Blog
> > > > > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old
> > > > > Wordpress
> > > > > > > > Blog
> > > > > > > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github
> <
> > > > > > > > > > https://github.com/
> > > > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/
> > > rmannibucau>
> > > > |
> > > > > > > > > > Tomitriber
> > > > > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > > > > > > <https://javaeefactory-
> rmannibucau.rhcloud.com
> > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > 2016-10-17 19:47 GMT+02:00 Steve Goldsmith <
> > > > > > > > sgjava@gmail.com
> > > > > > > > > >:
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > ~/java/apache-maven-3.3.9/bin/mvn
> > > > dependency:tree
> > > > > |
> > > > > > > > egrep
> > > > > > > > > > > > > > > 'woo|xml|stax'
> > > > > > > > > > > > > > > > > [INFO] | | +-
> > > javax.xml.bind:jaxb-api:jar:2.
> > > > > > > > 2.6:test
> > > > > > > > > > > > > > > > > [INFO] | | \-
> > com.sun.xml.bind:jaxb-impl:
> > > > > > > > > jar:2.2.6:test
> > > > > > > > > > > > > > > > > [INFO] | | | +-
> > > > > org.apache.santuario:xmlsec:
> > > > > > > > > > > > > jar:2.0.5:test
> > > > > > > > > > > > > > > > > [INFO] | | | | | +-
> > > > > > > > > > > > > > > > > org.opensaml:opensaml-xmlsec-
> > > api:jar:3.1.1:test
> > > > > > > > > > > > > > > > > [INFO] | | | | +-
> > > > > > > org.opensaml:opensaml-xmlsec-
> > > > > > > > > > > > > > > > > impl:jar:3.1.1:test
> > > > > > > > > > > > > > > > > [INFO] | | +-
> org.apache.wss4j:wss4j-ws-
> > > > > > > > > > > > > > > > security-stax:jar:2.1.4:test
> > > > > > > > > > > > > > > > > [INFO] | | +-
> > > > > > > > > > > > > > > > > org.apache.wss4j:wss4j-ws-
> > > > > > > security-policy-stax:jar:2.1.
> > > > > > > > > > 4:test
> > > > > > > > > > > > > > > > > [INFO] | | | +-
> > > > > xml-resolver:xml-resolver:jar:
> > > > > > > > > 1.2:test
> > > > > > > > > > > > > > > > > [INFO] | | | +-
> org.apache.cxf:cxf-rt-
> > > > > > > > > > > > > > > bindings-xml:jar:3.1.6:test
> > > > > > > > > > > > > > > > > [INFO] | | \-
> > com.sun.xml.messaging.saaj:
> > > > > > > > > > > > > > > saaj-impl:jar:1.3.18:test
> > > > > > > > > > > > > > > > > [INFO] | | | +-
> org.codehaus.woodstox:
> > > > > > > > > > > > > > > woodstox-core-asl:jar:4.4.1:
> > > > > > > > > > > > > > > > > test
> > > > > > > > > > > > > > > > > [INFO] | | | | \-
> > > > > org.codehaus.woodstox:stax2-
> > > > > > > > > > > > > > > api:jar:3.1.4:test
> > > > > > > > > > > > > > > > > [INFO] | | | \-
> > org.apache.ws.xmlschema:
> > > > > > > > > > > > > > > > > xmlschema-core:jar:2.2.1:test
> > > > > > > > > > > > > > > > > [INFO] +-
> > > > > > > > > > > > > > > > > com.fasterxml.jackson.jaxrs:
> > > > > > > jackson-jaxrs-json-provider:
> > > > > > > > > > > > > > jar:2.7.4:test
> > > > > > > > > > > > > > > > > [INFO] | +- com.fasterxml.jackson.jaxrs:
> > > > > > > > > > > > > > jackson-jaxrs-base:jar:2.7.4:
> > > > > > > > > > > > > > > > test
> > > > > > > > > > > > > > > > > [INFO] | +- com.fasterxml.jackson.core:
> > > > > > > > > > > > > jackson-core:jar:2.7.4:test
> > > > > > > > > > > > > > > > > [INFO] | +- com.fasterxml.jackson.core:
> > > > > > > > > > > > > jackson-databind:jar:2.7.4:
> > > > > > > > > > > > > > > test
> > > > > > > > > > > > > > > > > [INFO] | | \-
> > > > > > > > > > > > > > > > > com.fasterxml.jackson.core:
> > > > > > > > jackson-annotations:jar:2.7.0:
> > > > > > > > > > test
> > > > > > > > > > > > > > > > > [INFO] | \-
> > > > > > > > > > > > > > > > > com.fasterxml.jackson.module:
> > > > jackson-module-jaxb-
> > > > > > > > > > > > > > > > > annotations:jar:2.7.4:test
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > On Mon, Oct 17, 2016 at 11:40 AM, Romain
> > > > > Manni-Bucau
> > > > > > <
> > > > > > > > > > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > > > > > > > > > wrote:
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > mvn dependency:tree | egrep
> 'woo|xml|stax'
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > > > > > @rmannibucau <https://twitter.com/
> > > rmannibucau>
> > > > |
> > > > > > > Blog
> > > > > > > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> |
> > Old
> > > > > > > Wordpress
> > > > > > > > > > Blog
> > > > > > > > > > > > > > > > > > <http://rmannibucau.wordpress.com> |
> > Github
> > > <
> > > > > > > > > > > > https://github.com/
> > > > > > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/
> > > > > rmannibucau>
> > > > > > |
> > > > > > > > > > > > Tomitriber
> > > > > > > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE
> > Factory
> > > > > > > > > > > > > > > > > > <https://javaeefactory-
> > > rmannibucau.rhcloud.com
> > > > >
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > 2016-10-17 17:36 GMT+02:00 Steve
> Goldsmith
> > <
> > > > > > > > > > sgjava@gmail.com
> > > > > > > > > > > >:
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > My compile dependencies are (do you see
> > > > > anything
> > > > > > > that
> > > > > > > > > > > sticks
> > > > > > > > > > > > > > out):
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > <groupId>org.jsr107.ri</
> > > groupId>
> > > > > > > > > > > > > > > > > > >
> > <artifactId>cache-annotations-
> > > > > > > > > > > > ri-cdi</artifactId>
> > > > > > > > > > > > > > > > > > > <version>1.0.0</version>
> > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > <groupId>org.jvnet.jaxb2_
> > > > > > > > commons</groupId>
> > > > > > > > > > > > > > > > > > > <artifactId>jaxb2-basics-
> > > > > > > > > > runtime</artifactId>
> > > > > > > > > > > > > > > > > > > <version>0.10.0</version>
> > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > >
> <groupId>org.slf4j</groupId>
> > > > > > > > > > > > > > > > > > > <artifactId>slf4j-api</
> > > > artifactId>
> > > > > > > > > > > > > > > > > > > <version>${slf4j.version}</
> > > > > version>
> > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > <groupId>ch.qos.logback</
> > > > groupId>
> > > > > > > > > > > > > > > > > > >
> <artifactId>logback-classic</
> > > > > > > artifactId>
> > > > > > > > > > > > > > > > > > >
> <version>${logback.version}</
> > > > > > version>
> > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > <groupId>ch.qos.logback</
> > > > groupId>
> > > > > > > > > > > > > > > > > > > <artifactId>logback-core</
> > > > > > artifactId>
> > > > > > > > > > > > > > > > > > >
> <version>${logback.version}</
> > > > > > version>
> > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > >
> <groupId>org.apache.commons</
> > > > > > groupId>
> > > > > > > > > > > > > > > > > > > <artifactId>commons-pool2</
> > > > > > artifactId>
> > > > > > > > > > > > > > > > > > > <version>2.4.2</version>
> > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > > <groupId>commons-
> > > > > > > configuration</groupId>
> > > > > > > > > > > > > > > > > > > <artifactId>commons-
> > > > > > > > > > configuration</artifactId>
> > > > > > > > > > > > > > > > > > > <version>1.10</version>
> > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > >
> <groupId>org.jasypt</groupId>
> > > > > > > > > > > > > > > > > > > <artifactId>jasypt</
> > > artifactId>
> > > > > > > > > > > > > > > > > > > <version>1.9.3-SNAPSHOT</
> > > > version>
> > > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > On Mon, Oct 17, 2016 at 11:30 AM,
> Romain
> > > > > > > Manni-Bucau
> > > > > > > > <
> > > > > > > > > > > > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > > > > > > > > > > > wrote:
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > Hello
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > can happen if you provide some xml
> > > > libraries
> > > > > in
> > > > > > > > your
> > > > > > > > > > app
> > > > > > > > > > > -
> > > > > > > > > > > > > like
> > > > > > > > > > > > > > > > > > woodstox
> > > > > > > > > > > > > > > > > > > or
> > > > > > > > > > > > > > > > > > > > stax*api - and it conflicts at some
> > > point.
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > > > > > > > @rmannibucau <https://twitter.com/
> > > > > rmannibucau>
> > > > > > |
> > > > > > > > > Blog
> > > > > > > > > > > > > > > > > > > > <https://blog-rmannibucau.
> rhcloud.com>
> > |
> > > > Old
> > > > > > > > > Wordpress
> > > > > > > > > > > > Blog
> > > > > > > > > > > > > > > > > > > > <http://rmannibucau.wordpress.com> |
> > > > Github
> > > > > <
> > > > > > > > > > > > > > https://github.com/
> > > > > > > > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > > > > > > > LinkedIn <
> https://www.linkedin.com/in/
> > > > > > > rmannibucau>
> > > > > > > > |
> > > > > > > > > > > > > > Tomitriber
> > > > > > > > > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE
> > > > Factory
> > > > > > > > > > > > > > > > > > > > <https://javaeefactory-
> > > > > rmannibucau.rhcloud.com
> > > > > > >
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > 2016-10-17 17:18 GMT+02:00 sgjava <
> > > > > > > > sgjava@gmail.com
> > > > > > > > > >:
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > Periodically I'm seeing "Cannot
> > create
> > > a
> > > > > > secure
> > > > > > > > > > > > > > > XMLInputFactory"
> > > > > > > > > > > > > > > > in
> > > > > > > > > > > > > > > > > > > TomEE
> > > > > > > > > > > > > > > > > > > > > 7.0.2-SNAPSHOT. One solution is for
> > CXF
> > > > > using
> > > > > > > > > > > > > > > > > > > > > -Dorg.apache.cxf.stax.
> > > > > allowInsecureParser=1.
> > > > > > > > This
> > > > > > > > > is
> > > > > > > > > > > an
> > > > > > > > > > > > > > older
> > > > > > > > > > > > > > > > > 7.0.2
> > > > > > > > > > > > > > > > > > > from
> > > > > > > > > > > > > > > > > > > > > 7/4/16.
> > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > > > > > > > View this message in context:
> > > > > > > > > > > > http://tomee-openejb.979440.
> > > > > > > > > > > > > > > > > > > > > n4.nabble.com/Cannot-create-a-
> > > > > > > > > > secure-XMLInputFactory-
> > > > > > > > > > > > > > > > > tp4680348.html
> > > > > > > > > > > > > > > > > > > > > Sent from the TomEE Users mailing
> > list
> > > > > > archive
> > > > > > > at
> > > > > > > > > > > > > Nabble.com.
> > > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > > --
> > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > > --
> > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > >
> > > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > --
> > > > > > > > > Steven P. Goldsmith
> > > > > > > > >
> > > > > > > >
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > > --
> > > > > > > Steven P. Goldsmith
> > > > > > >
> > > > > >
> > > > >
> > > > >
> > > > >
> > > > > --
> > > > > Steven P. Goldsmith
> > > > >
> > > >
> > >
> > >
> > >
> > > --
> > > Steven P. Goldsmith
> > >
> >
>
>
>
> --
> Steven P. Goldsmith
>
Re: Cannot create a secure XMLInputFactory
Posted by Steve Goldsmith <sg...@gmail.com>.
It didn't throw an exception there then because I added
System.out.println("setProperty error" + t.getStackTrace()); in the catch
section. This method swallows exceptions any ways, so it couldn't be the
one throwing the exception?
On Tue, Oct 18, 2016 at 2:18 PM, Romain Manni-Bucau <rm...@gmail.com>
wrote:
> I dont see any error there or am i abused by gmail formatting?
>
> Le 18 oct. 2016 19:28, "Steve Goldsmith" <sg...@gmail.com> a écrit :
>
> > OK, I made the change:
> >
> > private static boolean setProperty(XMLInputFactory f, String p,
> Object
> > o) {
> > try {
> > System.out.println("setProperty f: " + f + " p: " + p + "
> o:"
> > +
> > o);
> > f.setProperty(p, o);
> > return true;
> > } catch (Throwable t) {
> > System.out.println("setProperty error" + t.getStackTrace());
> > //ignore
> > }
> > return false;
> > }
> >
> > and it dumps this:
> >
> > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > com.ctc.wstx.maxAttributesPerElement o:500
> > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > com.ctc.wstx.maxAttributeSize o:65536
> > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > com.ctc.wstx.maxChildrenPerElement o:50000
> > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > com.ctc.wstx.maxElementCount o:9223372036854775807
> > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > com.ctc.wstx.maxElementDepth o:100
> > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > com.ctc.wstx.maxCharacters o:9223372036854775807
> > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > com.ctc.wstx.maxTextLength o:134217728
> > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > com.ctc.wstx.minTextSegment o:64
> > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > javax.xml.stream.isNamespaceAware o:true
> > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > javax.xml.stream.supportDTD o:false
> > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > javax.xml.stream.isReplacingEntityReferences o:false
> > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > javax.xml.stream.isSupportingExternalEntities o:false
> >
> >
> >
> > On Tue, Oct 18, 2016 at 12:14 PM, Romain Manni-Bucau <
> > rmannibucau@gmail.com>
> > wrote:
> >
> > > for tomee embedded yes
> > >
> > >
> > > Romain Manni-Bucau
> > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > rmannibucau> |
> > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > <http://www.tomitribe.com> | JavaEE Factory
> > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > >
> > > 2016-10-18 18:11 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > >
> > > > In other words, if I build a debug logging version of cxf how would I
> > > > incorporate that into my TomEE embedded test? Can I just add the
> > > dependency
> > > > in Maven or do I have to exclude the version bundled in TomEE?
> > > >
> > > > On Tue, Oct 18, 2016 at 11:52 AM, Romain Manni-Bucau <
> > > > rmannibucau@gmail.com>
> > > > wrote:
> > > >
> > > > > you should switch them I guess.
> > > > >
> > > > > Generally speaking if you include cxf dependencies in your
> > application
> > > > > there is a property in tomee to ask it to isolate the webapp from
> the
> > > > > container for cxf - not sure I got your question right.
> > > > >
> > > > >
> > > > > Romain Manni-Bucau
> > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > > > rmannibucau> |
> > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > >
> > > > > 2016-10-18 17:40 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > > >
> > > > > > Do I have to exclude current CXF in TomEE dependencies or just
> > > include
> > > > > the
> > > > > > debug version I'm building?
> > > > > >
> > > > > > On Tue, Oct 18, 2016 at 2:46 AM, Romain Manni-Bucau <
> > > > > rmannibucau@gmail.com
> > > > > > >
> > > > > > wrote:
> > > > > >
> > > > > > > As mentionned in the previous answer this is not in tomee
> sources
> > > but
> > > > > > CXF,
> > > > > > > agree it should be logged at debug level but with current code
> > > > > debugging
> > > > > > is
> > > > > > > the fastest.
> > > > > > >
> > > > > > > Side note: you dont need to build tomee from sources, just need
> > to
> > > > add
> > > > > > > cxf-core.
> > > > > > >
> > > > > > >
> > > > > > > Romain Manni-Bucau
> > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > > > <http://rmannibucau.wordpress.com> | Github <
> https://github.com/
> > > > > > > rmannibucau> |
> > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> Tomitriber
> > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > >
> > > > > > > 2016-10-18 3:31 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > > > > >
> > > > > > > > OK, I've built TomEE from source before, but I've not run it
> in
> > > > debug
> > > > > > > mode.
> > > > > > > > Wouldn't it be just as easy to simply log vars f, p and o
> when
> > I
> > > > > build
> > > > > > > the
> > > > > > > > source?
> > > > > > > >
> > > > > > > > On Mon, Oct 17, 2016 at 5:09 PM, Romain Manni-Bucau <
> > > > > > > rmannibucau@gmail.com
> > > > > > > > >
> > > > > > > > wrote:
> > > > > > > >
> > > > > > > > > cxf ones yes, that's as easy as adding cxf-core as provded
> > > > > > dependency,
> > > > > > > > > putting a breakpoint on the mentionned line normally and
> > > starting
> > > > > > tomee
> > > > > > > > in
> > > > > > > > > debug mode. Surely the most efficient way to solve it.
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > Romain Manni-Bucau
> > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress
> Blog
> > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > https://github.com/
> > > > > > > > > rmannibucau> |
> > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > Tomitriber
> > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > >
> > > > > > > > > 2016-10-17 22:52 GMT+02:00 Steve Goldsmith <
> sgjava@gmail.com
> > >:
> > > > > > > > >
> > > > > > > > > > You mean set a breakpoint in TomEE source?
> > > > > > > > > >
> > > > > > > > > > On Mon, Oct 17, 2016 at 4:43 PM, Romain Manni-Bucau <
> > > > > > > > > rmannibucau@gmail.com
> > > > > > > > > > >
> > > > > > > > > > wrote:
> > > > > > > > > >
> > > > > > > > > > > If you can put a breakpoint at
> > > > > > > > > > > https://github.com/apache/cxf/blob/
> > > > > > eab841d5477c5e1ed21a49918defa7
> > > > > > > > > > > 9a0f1ad533/core/src/main/java/
> org/apache/cxf/staxutils/
> > > > > > > > > > StaxUtils.java#L381
> > > > > > > > > > > then you would know immediately why the throwable is
> > > thrown.
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress
> > > Blog
> > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > https://github.com/
> > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > > > Tomitriber
> > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > > >
> > > > > > > > > > > 2016-10-17 22:41 GMT+02:00 Steve Goldsmith <
> > > sgjava@gmail.com
> > > > >:
> > > > > > > > > > >
> > > > > > > > > > > > OK, I made the following change and I still get the
> > > error:
> > > > > > > > > > > >
> > > > > > > > > > > > <dependency>
> > > > > > > > > > > > <groupId>org.jvnet.jaxb2_
> commons</groupId>
> > > > > > > > > > > > <artifactId>jaxb2-basics-
> > > runtime</artifactId>
> > > > > > > > > > > > <version>0.10.0</version>
> > > > > > > > > > > > <scope>provided</scope>
> > > > > > > > > > > > </dependency>
> > > > > > > > > > > >
> > > > > > > > > > > > I even tried:
> > > > > > > > > > > >
> > > > > > > > > > > > <dependency>
> > > > > > > > > > > > <groupId>org.apache.tomee</groupId>
> > > > > > > > > > > > <artifactId>tomee-jaxrs</artifactId>
> > > > > > > > > > > > <version>${tomee.version}</version>
> > > > > > > > > > > > <scope>test</scope>
> > > > > > > > > > > > <exclusions>
> > > > > > > > > > > > <exclusion>
> > > > > > > > > > > > <groupId>com.sun.xml.bind</
> > groupId>
> > > > > > > > > > > > <artifactId>jaxb-impl</
> artifactId>
> > > > > > > > > > > > </exclusion>
> > > > > > > > > > > > </exclusions>
> > > > > > > > > > > > </dependency>
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > > On Mon, Oct 17, 2016 at 3:37 PM, Romain Manni-Bucau <
> > > > > > > > > > > rmannibucau@gmail.com
> > > > > > > > > > > > >
> > > > > > > > > > > > wrote:
> > > > > > > > > > > >
> > > > > > > > > > > > > well jaxb is provided and shouldnt be delivered so
> > you
> > > > have
> > > > > > to
> > > > > > > > > remove
> > > > > > > > > > > it
> > > > > > > > > > > > > from WEB-INF/lib. scope=provided should be fine
> too.
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> |
> > Blog
> > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old
> > Wordpress
> > > > > Blog
> > > > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > > > https://github.com/
> > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau>
> |
> > > > > > > Tomitriber
> > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > > > > >
> > > > > > > > > > > > > 2016-10-17 20:07 GMT+02:00 Steve Goldsmith <
> > > > > sgjava@gmail.com
> > > > > > >:
> > > > > > > > > > > > >
> > > > > > > > > > > > > > I need JAX-B runtime for code generated by
> > > > > > jaxws-maven-plugin
> > > > > > > > and
> > > > > > > > > > > XJC.
> > > > > > > > > > > > > > Everything else is in test scope and not used in
> > the
> > > > > > deployed
> > > > > > > > > app.
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > <groupId>org.jvnet.jaxb2_
> > > commons</groupId>
> > > > > > > > > > > > > > <artifactId>jaxb2-basics-
> > > > > runtime</artifactId>
> > > > > > > > > > > > > > <version>0.10.0</version>
> > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > On Mon, Oct 17, 2016 at 1:57 PM, Romain
> > Manni-Bucau <
> > > > > > > > > > > > > rmannibucau@gmail.com
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > wrote:
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > > yep so surely some part of the app running in a
> > > > > > conflicting
> > > > > > > > > > > > > classloader.
> > > > > > > > > > > > > > > Personally I'd just remove stax2-api, woodstox
> > and
> > > > jaxb
> > > > > > to
> > > > > > > > > start
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau>
> |
> > > > Blog
> > > > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old
> > > > Wordpress
> > > > > > > Blog
> > > > > > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > > > > > https://github.com/
> > > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/
> > rmannibucau>
> > > |
> > > > > > > > > Tomitriber
> > > > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com
> >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > 2016-10-17 19:47 GMT+02:00 Steve Goldsmith <
> > > > > > > sgjava@gmail.com
> > > > > > > > >:
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > ~/java/apache-maven-3.3.9/bin/mvn
> > > dependency:tree
> > > > |
> > > > > > > egrep
> > > > > > > > > > > > > > 'woo|xml|stax'
> > > > > > > > > > > > > > > > [INFO] | | +-
> > javax.xml.bind:jaxb-api:jar:2.
> > > > > > > 2.6:test
> > > > > > > > > > > > > > > > [INFO] | | \-
> com.sun.xml.bind:jaxb-impl:
> > > > > > > > jar:2.2.6:test
> > > > > > > > > > > > > > > > [INFO] | | | +-
> > > > org.apache.santuario:xmlsec:
> > > > > > > > > > > > jar:2.0.5:test
> > > > > > > > > > > > > > > > [INFO] | | | | | +-
> > > > > > > > > > > > > > > > org.opensaml:opensaml-xmlsec-
> > api:jar:3.1.1:test
> > > > > > > > > > > > > > > > [INFO] | | | | +-
> > > > > > org.opensaml:opensaml-xmlsec-
> > > > > > > > > > > > > > > > impl:jar:3.1.1:test
> > > > > > > > > > > > > > > > [INFO] | | +- org.apache.wss4j:wss4j-ws-
> > > > > > > > > > > > > > > security-stax:jar:2.1.4:test
> > > > > > > > > > > > > > > > [INFO] | | +-
> > > > > > > > > > > > > > > > org.apache.wss4j:wss4j-ws-
> > > > > > security-policy-stax:jar:2.1.
> > > > > > > > > 4:test
> > > > > > > > > > > > > > > > [INFO] | | | +-
> > > > xml-resolver:xml-resolver:jar:
> > > > > > > > 1.2:test
> > > > > > > > > > > > > > > > [INFO] | | | +- org.apache.cxf:cxf-rt-
> > > > > > > > > > > > > > bindings-xml:jar:3.1.6:test
> > > > > > > > > > > > > > > > [INFO] | | \-
> com.sun.xml.messaging.saaj:
> > > > > > > > > > > > > > saaj-impl:jar:1.3.18:test
> > > > > > > > > > > > > > > > [INFO] | | | +- org.codehaus.woodstox:
> > > > > > > > > > > > > > woodstox-core-asl:jar:4.4.1:
> > > > > > > > > > > > > > > > test
> > > > > > > > > > > > > > > > [INFO] | | | | \-
> > > > org.codehaus.woodstox:stax2-
> > > > > > > > > > > > > > api:jar:3.1.4:test
> > > > > > > > > > > > > > > > [INFO] | | | \-
> org.apache.ws.xmlschema:
> > > > > > > > > > > > > > > > xmlschema-core:jar:2.2.1:test
> > > > > > > > > > > > > > > > [INFO] +-
> > > > > > > > > > > > > > > > com.fasterxml.jackson.jaxrs:
> > > > > > jackson-jaxrs-json-provider:
> > > > > > > > > > > > > jar:2.7.4:test
> > > > > > > > > > > > > > > > [INFO] | +- com.fasterxml.jackson.jaxrs:
> > > > > > > > > > > > > jackson-jaxrs-base:jar:2.7.4:
> > > > > > > > > > > > > > > test
> > > > > > > > > > > > > > > > [INFO] | +- com.fasterxml.jackson.core:
> > > > > > > > > > > > jackson-core:jar:2.7.4:test
> > > > > > > > > > > > > > > > [INFO] | +- com.fasterxml.jackson.core:
> > > > > > > > > > > > jackson-databind:jar:2.7.4:
> > > > > > > > > > > > > > test
> > > > > > > > > > > > > > > > [INFO] | | \-
> > > > > > > > > > > > > > > > com.fasterxml.jackson.core:
> > > > > > > jackson-annotations:jar:2.7.0:
> > > > > > > > > test
> > > > > > > > > > > > > > > > [INFO] | \-
> > > > > > > > > > > > > > > > com.fasterxml.jackson.module:
> > > jackson-module-jaxb-
> > > > > > > > > > > > > > > > annotations:jar:2.7.4:test
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > On Mon, Oct 17, 2016 at 11:40 AM, Romain
> > > > Manni-Bucau
> > > > > <
> > > > > > > > > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > > > > > > > > wrote:
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > mvn dependency:tree | egrep 'woo|xml|stax'
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > > > > @rmannibucau <https://twitter.com/
> > rmannibucau>
> > > |
> > > > > > Blog
> > > > > > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> |
> Old
> > > > > > Wordpress
> > > > > > > > > Blog
> > > > > > > > > > > > > > > > > <http://rmannibucau.wordpress.com> |
> Github
> > <
> > > > > > > > > > > https://github.com/
> > > > > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/
> > > > rmannibucau>
> > > > > |
> > > > > > > > > > > Tomitriber
> > > > > > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE
> Factory
> > > > > > > > > > > > > > > > > <https://javaeefactory-
> > rmannibucau.rhcloud.com
> > > >
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > 2016-10-17 17:36 GMT+02:00 Steve Goldsmith
> <
> > > > > > > > > sgjava@gmail.com
> > > > > > > > > > >:
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > My compile dependencies are (do you see
> > > > anything
> > > > > > that
> > > > > > > > > > sticks
> > > > > > > > > > > > > out):
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > <groupId>org.jsr107.ri</
> > groupId>
> > > > > > > > > > > > > > > > > >
> <artifactId>cache-annotations-
> > > > > > > > > > > ri-cdi</artifactId>
> > > > > > > > > > > > > > > > > > <version>1.0.0</version>
> > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > <groupId>org.jvnet.jaxb2_
> > > > > > > commons</groupId>
> > > > > > > > > > > > > > > > > > <artifactId>jaxb2-basics-
> > > > > > > > > runtime</artifactId>
> > > > > > > > > > > > > > > > > > <version>0.10.0</version>
> > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > <groupId>org.slf4j</groupId>
> > > > > > > > > > > > > > > > > > <artifactId>slf4j-api</
> > > artifactId>
> > > > > > > > > > > > > > > > > > <version>${slf4j.version}</
> > > > version>
> > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > <groupId>ch.qos.logback</
> > > groupId>
> > > > > > > > > > > > > > > > > > <artifactId>logback-classic</
> > > > > > artifactId>
> > > > > > > > > > > > > > > > > > <version>${logback.version}</
> > > > > version>
> > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > <groupId>ch.qos.logback</
> > > groupId>
> > > > > > > > > > > > > > > > > > <artifactId>logback-core</
> > > > > artifactId>
> > > > > > > > > > > > > > > > > > <version>${logback.version}</
> > > > > version>
> > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > <groupId>org.apache.commons</
> > > > > groupId>
> > > > > > > > > > > > > > > > > > <artifactId>commons-pool2</
> > > > > artifactId>
> > > > > > > > > > > > > > > > > > <version>2.4.2</version>
> > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > <groupId>commons-
> > > > > > configuration</groupId>
> > > > > > > > > > > > > > > > > > <artifactId>commons-
> > > > > > > > > configuration</artifactId>
> > > > > > > > > > > > > > > > > > <version>1.10</version>
> > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > > <groupId>org.jasypt</groupId>
> > > > > > > > > > > > > > > > > > <artifactId>jasypt</
> > artifactId>
> > > > > > > > > > > > > > > > > > <version>1.9.3-SNAPSHOT</
> > > version>
> > > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > On Mon, Oct 17, 2016 at 11:30 AM, Romain
> > > > > > Manni-Bucau
> > > > > > > <
> > > > > > > > > > > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > > > > > > > > > > wrote:
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > Hello
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > can happen if you provide some xml
> > > libraries
> > > > in
> > > > > > > your
> > > > > > > > > app
> > > > > > > > > > -
> > > > > > > > > > > > like
> > > > > > > > > > > > > > > > > woodstox
> > > > > > > > > > > > > > > > > > or
> > > > > > > > > > > > > > > > > > > stax*api - and it conflicts at some
> > point.
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > > > > > > @rmannibucau <https://twitter.com/
> > > > rmannibucau>
> > > > > |
> > > > > > > > Blog
> > > > > > > > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com>
> |
> > > Old
> > > > > > > > Wordpress
> > > > > > > > > > > Blog
> > > > > > > > > > > > > > > > > > > <http://rmannibucau.wordpress.com> |
> > > Github
> > > > <
> > > > > > > > > > > > > https://github.com/
> > > > > > > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/
> > > > > > rmannibucau>
> > > > > > > |
> > > > > > > > > > > > > Tomitriber
> > > > > > > > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE
> > > Factory
> > > > > > > > > > > > > > > > > > > <https://javaeefactory-
> > > > rmannibucau.rhcloud.com
> > > > > >
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > 2016-10-17 17:18 GMT+02:00 sgjava <
> > > > > > > sgjava@gmail.com
> > > > > > > > >:
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > Periodically I'm seeing "Cannot
> create
> > a
> > > > > secure
> > > > > > > > > > > > > > XMLInputFactory"
> > > > > > > > > > > > > > > in
> > > > > > > > > > > > > > > > > > TomEE
> > > > > > > > > > > > > > > > > > > > 7.0.2-SNAPSHOT. One solution is for
> CXF
> > > > using
> > > > > > > > > > > > > > > > > > > > -Dorg.apache.cxf.stax.
> > > > allowInsecureParser=1.
> > > > > > > This
> > > > > > > > is
> > > > > > > > > > an
> > > > > > > > > > > > > older
> > > > > > > > > > > > > > > > 7.0.2
> > > > > > > > > > > > > > > > > > from
> > > > > > > > > > > > > > > > > > > > 7/4/16.
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > > > > > > View this message in context:
> > > > > > > > > > > http://tomee-openejb.979440.
> > > > > > > > > > > > > > > > > > > > n4.nabble.com/Cannot-create-a-
> > > > > > > > > secure-XMLInputFactory-
> > > > > > > > > > > > > > > > tp4680348.html
> > > > > > > > > > > > > > > > > > > > Sent from the TomEE Users mailing
> list
> > > > > archive
> > > > > > at
> > > > > > > > > > > > Nabble.com.
> > > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > --
> > > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > > --
> > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > > --
> > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > >
> > > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > > --
> > > > > > > > Steven P. Goldsmith
> > > > > > > >
> > > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > > --
> > > > > > Steven P. Goldsmith
> > > > > >
> > > > >
> > > >
> > > >
> > > >
> > > > --
> > > > Steven P. Goldsmith
> > > >
> > >
> >
> >
> >
> > --
> > Steven P. Goldsmith
> >
>
--
Steven P. Goldsmith
Re: Cannot create a secure XMLInputFactory
Posted by Romain Manni-Bucau <rm...@gmail.com>.
I dont see any error there or am i abused by gmail formatting?
Le 18 oct. 2016 19:28, "Steve Goldsmith" <sg...@gmail.com> a écrit :
> OK, I made the change:
>
> private static boolean setProperty(XMLInputFactory f, String p, Object
> o) {
> try {
> System.out.println("setProperty f: " + f + " p: " + p + " o:"
> +
> o);
> f.setProperty(p, o);
> return true;
> } catch (Throwable t) {
> System.out.println("setProperty error" + t.getStackTrace());
> //ignore
> }
> return false;
> }
>
> and it dumps this:
>
> setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> com.ctc.wstx.maxAttributesPerElement o:500
> setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> com.ctc.wstx.maxAttributeSize o:65536
> setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> com.ctc.wstx.maxChildrenPerElement o:50000
> setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> com.ctc.wstx.maxElementCount o:9223372036854775807
> setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> com.ctc.wstx.maxElementDepth o:100
> setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> com.ctc.wstx.maxCharacters o:9223372036854775807
> setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> com.ctc.wstx.maxTextLength o:134217728
> setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> com.ctc.wstx.minTextSegment o:64
> setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> javax.xml.stream.isNamespaceAware o:true
> setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> javax.xml.stream.supportDTD o:false
> setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> javax.xml.stream.isReplacingEntityReferences o:false
> setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> javax.xml.stream.isSupportingExternalEntities o:false
>
>
>
> On Tue, Oct 18, 2016 at 12:14 PM, Romain Manni-Bucau <
> rmannibucau@gmail.com>
> wrote:
>
> > for tomee embedded yes
> >
> >
> > Romain Manni-Bucau
> > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > rmannibucau> |
> > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > <http://www.tomitribe.com> | JavaEE Factory
> > <https://javaeefactory-rmannibucau.rhcloud.com>
> >
> > 2016-10-18 18:11 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> >
> > > In other words, if I build a debug logging version of cxf how would I
> > > incorporate that into my TomEE embedded test? Can I just add the
> > dependency
> > > in Maven or do I have to exclude the version bundled in TomEE?
> > >
> > > On Tue, Oct 18, 2016 at 11:52 AM, Romain Manni-Bucau <
> > > rmannibucau@gmail.com>
> > > wrote:
> > >
> > > > you should switch them I guess.
> > > >
> > > > Generally speaking if you include cxf dependencies in your
> application
> > > > there is a property in tomee to ask it to isolate the webapp from the
> > > > container for cxf - not sure I got your question right.
> > > >
> > > >
> > > > Romain Manni-Bucau
> > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > > rmannibucau> |
> > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > >
> > > > 2016-10-18 17:40 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > >
> > > > > Do I have to exclude current CXF in TomEE dependencies or just
> > include
> > > > the
> > > > > debug version I'm building?
> > > > >
> > > > > On Tue, Oct 18, 2016 at 2:46 AM, Romain Manni-Bucau <
> > > > rmannibucau@gmail.com
> > > > > >
> > > > > wrote:
> > > > >
> > > > > > As mentionned in the previous answer this is not in tomee sources
> > but
> > > > > CXF,
> > > > > > agree it should be logged at debug level but with current code
> > > > debugging
> > > > > is
> > > > > > the fastest.
> > > > > >
> > > > > > Side note: you dont need to build tomee from sources, just need
> to
> > > add
> > > > > > cxf-core.
> > > > > >
> > > > > >
> > > > > > Romain Manni-Bucau
> > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > > > > rmannibucau> |
> > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > >
> > > > > > 2016-10-18 3:31 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > > > >
> > > > > > > OK, I've built TomEE from source before, but I've not run it in
> > > debug
> > > > > > mode.
> > > > > > > Wouldn't it be just as easy to simply log vars f, p and o when
> I
> > > > build
> > > > > > the
> > > > > > > source?
> > > > > > >
> > > > > > > On Mon, Oct 17, 2016 at 5:09 PM, Romain Manni-Bucau <
> > > > > > rmannibucau@gmail.com
> > > > > > > >
> > > > > > > wrote:
> > > > > > >
> > > > > > > > cxf ones yes, that's as easy as adding cxf-core as provded
> > > > > dependency,
> > > > > > > > putting a breakpoint on the mentionned line normally and
> > starting
> > > > > tomee
> > > > > > > in
> > > > > > > > debug mode. Surely the most efficient way to solve it.
> > > > > > > >
> > > > > > > >
> > > > > > > > Romain Manni-Bucau
> > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > https://github.com/
> > > > > > > > rmannibucau> |
> > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > Tomitriber
> > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > >
> > > > > > > > 2016-10-17 22:52 GMT+02:00 Steve Goldsmith <sgjava@gmail.com
> >:
> > > > > > > >
> > > > > > > > > You mean set a breakpoint in TomEE source?
> > > > > > > > >
> > > > > > > > > On Mon, Oct 17, 2016 at 4:43 PM, Romain Manni-Bucau <
> > > > > > > > rmannibucau@gmail.com
> > > > > > > > > >
> > > > > > > > > wrote:
> > > > > > > > >
> > > > > > > > > > If you can put a breakpoint at
> > > > > > > > > > https://github.com/apache/cxf/blob/
> > > > > eab841d5477c5e1ed21a49918defa7
> > > > > > > > > > 9a0f1ad533/core/src/main/java/org/apache/cxf/staxutils/
> > > > > > > > > StaxUtils.java#L381
> > > > > > > > > > then you would know immediately why the throwable is
> > thrown.
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress
> > Blog
> > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > https://github.com/
> > > > > > > > > > rmannibucau> |
> > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > > Tomitriber
> > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > >
> > > > > > > > > > 2016-10-17 22:41 GMT+02:00 Steve Goldsmith <
> > sgjava@gmail.com
> > > >:
> > > > > > > > > >
> > > > > > > > > > > OK, I made the following change and I still get the
> > error:
> > > > > > > > > > >
> > > > > > > > > > > <dependency>
> > > > > > > > > > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > > > > > > > > > <artifactId>jaxb2-basics-
> > runtime</artifactId>
> > > > > > > > > > > <version>0.10.0</version>
> > > > > > > > > > > <scope>provided</scope>
> > > > > > > > > > > </dependency>
> > > > > > > > > > >
> > > > > > > > > > > I even tried:
> > > > > > > > > > >
> > > > > > > > > > > <dependency>
> > > > > > > > > > > <groupId>org.apache.tomee</groupId>
> > > > > > > > > > > <artifactId>tomee-jaxrs</artifactId>
> > > > > > > > > > > <version>${tomee.version}</version>
> > > > > > > > > > > <scope>test</scope>
> > > > > > > > > > > <exclusions>
> > > > > > > > > > > <exclusion>
> > > > > > > > > > > <groupId>com.sun.xml.bind</
> groupId>
> > > > > > > > > > > <artifactId>jaxb-impl</artifactId>
> > > > > > > > > > > </exclusion>
> > > > > > > > > > > </exclusions>
> > > > > > > > > > > </dependency>
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > > On Mon, Oct 17, 2016 at 3:37 PM, Romain Manni-Bucau <
> > > > > > > > > > rmannibucau@gmail.com
> > > > > > > > > > > >
> > > > > > > > > > > wrote:
> > > > > > > > > > >
> > > > > > > > > > > > well jaxb is provided and shouldnt be delivered so
> you
> > > have
> > > > > to
> > > > > > > > remove
> > > > > > > > > > it
> > > > > > > > > > > > from WEB-INF/lib. scope=provided should be fine too.
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> |
> Blog
> > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old
> Wordpress
> > > > Blog
> > > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > > https://github.com/
> > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > > > > Tomitriber
> > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > > > >
> > > > > > > > > > > > 2016-10-17 20:07 GMT+02:00 Steve Goldsmith <
> > > > sgjava@gmail.com
> > > > > >:
> > > > > > > > > > > >
> > > > > > > > > > > > > I need JAX-B runtime for code generated by
> > > > > jaxws-maven-plugin
> > > > > > > and
> > > > > > > > > > XJC.
> > > > > > > > > > > > > Everything else is in test scope and not used in
> the
> > > > > deployed
> > > > > > > > app.
> > > > > > > > > > > > >
> > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > <groupId>org.jvnet.jaxb2_
> > commons</groupId>
> > > > > > > > > > > > > <artifactId>jaxb2-basics-
> > > > runtime</artifactId>
> > > > > > > > > > > > > <version>0.10.0</version>
> > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > > On Mon, Oct 17, 2016 at 1:57 PM, Romain
> Manni-Bucau <
> > > > > > > > > > > > rmannibucau@gmail.com
> > > > > > > > > > > > > >
> > > > > > > > > > > > > wrote:
> > > > > > > > > > > > >
> > > > > > > > > > > > > > yep so surely some part of the app running in a
> > > > > conflicting
> > > > > > > > > > > > classloader.
> > > > > > > > > > > > > > Personally I'd just remove stax2-api, woodstox
> and
> > > jaxb
> > > > > to
> > > > > > > > start
> > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> |
> > > Blog
> > > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old
> > > Wordpress
> > > > > > Blog
> > > > > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > > > > https://github.com/
> > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/
> rmannibucau>
> > |
> > > > > > > > Tomitriber
> > > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > 2016-10-17 19:47 GMT+02:00 Steve Goldsmith <
> > > > > > sgjava@gmail.com
> > > > > > > >:
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > > ~/java/apache-maven-3.3.9/bin/mvn
> > dependency:tree
> > > |
> > > > > > egrep
> > > > > > > > > > > > > 'woo|xml|stax'
> > > > > > > > > > > > > > > [INFO] | | +-
> javax.xml.bind:jaxb-api:jar:2.
> > > > > > 2.6:test
> > > > > > > > > > > > > > > [INFO] | | \- com.sun.xml.bind:jaxb-impl:
> > > > > > > jar:2.2.6:test
> > > > > > > > > > > > > > > [INFO] | | | +-
> > > org.apache.santuario:xmlsec:
> > > > > > > > > > > jar:2.0.5:test
> > > > > > > > > > > > > > > [INFO] | | | | | +-
> > > > > > > > > > > > > > > org.opensaml:opensaml-xmlsec-
> api:jar:3.1.1:test
> > > > > > > > > > > > > > > [INFO] | | | | +-
> > > > > org.opensaml:opensaml-xmlsec-
> > > > > > > > > > > > > > > impl:jar:3.1.1:test
> > > > > > > > > > > > > > > [INFO] | | +- org.apache.wss4j:wss4j-ws-
> > > > > > > > > > > > > > security-stax:jar:2.1.4:test
> > > > > > > > > > > > > > > [INFO] | | +-
> > > > > > > > > > > > > > > org.apache.wss4j:wss4j-ws-
> > > > > security-policy-stax:jar:2.1.
> > > > > > > > 4:test
> > > > > > > > > > > > > > > [INFO] | | | +-
> > > xml-resolver:xml-resolver:jar:
> > > > > > > 1.2:test
> > > > > > > > > > > > > > > [INFO] | | | +- org.apache.cxf:cxf-rt-
> > > > > > > > > > > > > bindings-xml:jar:3.1.6:test
> > > > > > > > > > > > > > > [INFO] | | \- com.sun.xml.messaging.saaj:
> > > > > > > > > > > > > saaj-impl:jar:1.3.18:test
> > > > > > > > > > > > > > > [INFO] | | | +- org.codehaus.woodstox:
> > > > > > > > > > > > > woodstox-core-asl:jar:4.4.1:
> > > > > > > > > > > > > > > test
> > > > > > > > > > > > > > > [INFO] | | | | \-
> > > org.codehaus.woodstox:stax2-
> > > > > > > > > > > > > api:jar:3.1.4:test
> > > > > > > > > > > > > > > [INFO] | | | \- org.apache.ws.xmlschema:
> > > > > > > > > > > > > > > xmlschema-core:jar:2.2.1:test
> > > > > > > > > > > > > > > [INFO] +-
> > > > > > > > > > > > > > > com.fasterxml.jackson.jaxrs:
> > > > > jackson-jaxrs-json-provider:
> > > > > > > > > > > > jar:2.7.4:test
> > > > > > > > > > > > > > > [INFO] | +- com.fasterxml.jackson.jaxrs:
> > > > > > > > > > > > jackson-jaxrs-base:jar:2.7.4:
> > > > > > > > > > > > > > test
> > > > > > > > > > > > > > > [INFO] | +- com.fasterxml.jackson.core:
> > > > > > > > > > > jackson-core:jar:2.7.4:test
> > > > > > > > > > > > > > > [INFO] | +- com.fasterxml.jackson.core:
> > > > > > > > > > > jackson-databind:jar:2.7.4:
> > > > > > > > > > > > > test
> > > > > > > > > > > > > > > [INFO] | | \-
> > > > > > > > > > > > > > > com.fasterxml.jackson.core:
> > > > > > jackson-annotations:jar:2.7.0:
> > > > > > > > test
> > > > > > > > > > > > > > > [INFO] | \-
> > > > > > > > > > > > > > > com.fasterxml.jackson.module:
> > jackson-module-jaxb-
> > > > > > > > > > > > > > > annotations:jar:2.7.4:test
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > On Mon, Oct 17, 2016 at 11:40 AM, Romain
> > > Manni-Bucau
> > > > <
> > > > > > > > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > > > > > > > wrote:
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > mvn dependency:tree | egrep 'woo|xml|stax'
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > > > @rmannibucau <https://twitter.com/
> rmannibucau>
> > |
> > > > > Blog
> > > > > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old
> > > > > Wordpress
> > > > > > > > Blog
> > > > > > > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github
> <
> > > > > > > > > > https://github.com/
> > > > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/
> > > rmannibucau>
> > > > |
> > > > > > > > > > Tomitriber
> > > > > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > > > > > > <https://javaeefactory-
> rmannibucau.rhcloud.com
> > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > 2016-10-17 17:36 GMT+02:00 Steve Goldsmith <
> > > > > > > > sgjava@gmail.com
> > > > > > > > > >:
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > My compile dependencies are (do you see
> > > anything
> > > > > that
> > > > > > > > > sticks
> > > > > > > > > > > > out):
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > <groupId>org.jsr107.ri</
> groupId>
> > > > > > > > > > > > > > > > > <artifactId>cache-annotations-
> > > > > > > > > > ri-cdi</artifactId>
> > > > > > > > > > > > > > > > > <version>1.0.0</version>
> > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > <groupId>org.jvnet.jaxb2_
> > > > > > commons</groupId>
> > > > > > > > > > > > > > > > > <artifactId>jaxb2-basics-
> > > > > > > > runtime</artifactId>
> > > > > > > > > > > > > > > > > <version>0.10.0</version>
> > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > <groupId>org.slf4j</groupId>
> > > > > > > > > > > > > > > > > <artifactId>slf4j-api</
> > artifactId>
> > > > > > > > > > > > > > > > > <version>${slf4j.version}</
> > > version>
> > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > <groupId>ch.qos.logback</
> > groupId>
> > > > > > > > > > > > > > > > > <artifactId>logback-classic</
> > > > > artifactId>
> > > > > > > > > > > > > > > > > <version>${logback.version}</
> > > > version>
> > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > <groupId>ch.qos.logback</
> > groupId>
> > > > > > > > > > > > > > > > > <artifactId>logback-core</
> > > > artifactId>
> > > > > > > > > > > > > > > > > <version>${logback.version}</
> > > > version>
> > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > <groupId>org.apache.commons</
> > > > groupId>
> > > > > > > > > > > > > > > > > <artifactId>commons-pool2</
> > > > artifactId>
> > > > > > > > > > > > > > > > > <version>2.4.2</version>
> > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > <groupId>commons-
> > > > > configuration</groupId>
> > > > > > > > > > > > > > > > > <artifactId>commons-
> > > > > > > > configuration</artifactId>
> > > > > > > > > > > > > > > > > <version>1.10</version>
> > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > > <groupId>org.jasypt</groupId>
> > > > > > > > > > > > > > > > > <artifactId>jasypt</
> artifactId>
> > > > > > > > > > > > > > > > > <version>1.9.3-SNAPSHOT</
> > version>
> > > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > On Mon, Oct 17, 2016 at 11:30 AM, Romain
> > > > > Manni-Bucau
> > > > > > <
> > > > > > > > > > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > > > > > > > > > wrote:
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > Hello
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > can happen if you provide some xml
> > libraries
> > > in
> > > > > > your
> > > > > > > > app
> > > > > > > > > -
> > > > > > > > > > > like
> > > > > > > > > > > > > > > > woodstox
> > > > > > > > > > > > > > > > > or
> > > > > > > > > > > > > > > > > > stax*api - and it conflicts at some
> point.
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > > > > > @rmannibucau <https://twitter.com/
> > > rmannibucau>
> > > > |
> > > > > > > Blog
> > > > > > > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> |
> > Old
> > > > > > > Wordpress
> > > > > > > > > > Blog
> > > > > > > > > > > > > > > > > > <http://rmannibucau.wordpress.com> |
> > Github
> > > <
> > > > > > > > > > > > https://github.com/
> > > > > > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/
> > > > > rmannibucau>
> > > > > > |
> > > > > > > > > > > > Tomitriber
> > > > > > > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE
> > Factory
> > > > > > > > > > > > > > > > > > <https://javaeefactory-
> > > rmannibucau.rhcloud.com
> > > > >
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > 2016-10-17 17:18 GMT+02:00 sgjava <
> > > > > > sgjava@gmail.com
> > > > > > > >:
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > Periodically I'm seeing "Cannot create
> a
> > > > secure
> > > > > > > > > > > > > XMLInputFactory"
> > > > > > > > > > > > > > in
> > > > > > > > > > > > > > > > > TomEE
> > > > > > > > > > > > > > > > > > > 7.0.2-SNAPSHOT. One solution is for CXF
> > > using
> > > > > > > > > > > > > > > > > > > -Dorg.apache.cxf.stax.
> > > allowInsecureParser=1.
> > > > > > This
> > > > > > > is
> > > > > > > > > an
> > > > > > > > > > > > older
> > > > > > > > > > > > > > > 7.0.2
> > > > > > > > > > > > > > > > > from
> > > > > > > > > > > > > > > > > > > 7/4/16.
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > > > > > View this message in context:
> > > > > > > > > > http://tomee-openejb.979440.
> > > > > > > > > > > > > > > > > > > n4.nabble.com/Cannot-create-a-
> > > > > > > > secure-XMLInputFactory-
> > > > > > > > > > > > > > > tp4680348.html
> > > > > > > > > > > > > > > > > > > Sent from the TomEE Users mailing list
> > > > archive
> > > > > at
> > > > > > > > > > > Nabble.com.
> > > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > > --
> > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > > --
> > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > >
> > > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > --
> > > > > > > > > Steven P. Goldsmith
> > > > > > > > >
> > > > > > > >
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > > --
> > > > > > > Steven P. Goldsmith
> > > > > > >
> > > > > >
> > > > >
> > > > >
> > > > >
> > > > > --
> > > > > Steven P. Goldsmith
> > > > >
> > > >
> > >
> > >
> > >
> > > --
> > > Steven P. Goldsmith
> > >
> >
>
>
>
> --
> Steven P. Goldsmith
>
Re: Cannot create a secure XMLInputFactory
Posted by Steve Goldsmith <sg...@gmail.com>.
OK, I made the change:
private static boolean setProperty(XMLInputFactory f, String p, Object
o) {
try {
System.out.println("setProperty f: " + f + " p: " + p + " o:" +
o);
f.setProperty(p, o);
return true;
} catch (Throwable t) {
System.out.println("setProperty error" + t.getStackTrace());
//ignore
}
return false;
}
and it dumps this:
setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
com.ctc.wstx.maxAttributesPerElement o:500
setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
com.ctc.wstx.maxAttributeSize o:65536
setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
com.ctc.wstx.maxChildrenPerElement o:50000
setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
com.ctc.wstx.maxElementCount o:9223372036854775807
setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
com.ctc.wstx.maxElementDepth o:100
setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
com.ctc.wstx.maxCharacters o:9223372036854775807
setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
com.ctc.wstx.maxTextLength o:134217728
setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
com.ctc.wstx.minTextSegment o:64
setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
javax.xml.stream.isNamespaceAware o:true
setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
javax.xml.stream.supportDTD o:false
setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
javax.xml.stream.isReplacingEntityReferences o:false
setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
javax.xml.stream.isSupportingExternalEntities o:false
On Tue, Oct 18, 2016 at 12:14 PM, Romain Manni-Bucau <rm...@gmail.com>
wrote:
> for tomee embedded yes
>
>
> Romain Manni-Bucau
> @rmannibucau <https://twitter.com/rmannibucau> | Blog
> <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> <http://rmannibucau.wordpress.com> | Github <https://github.com/
> rmannibucau> |
> LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> <http://www.tomitribe.com> | JavaEE Factory
> <https://javaeefactory-rmannibucau.rhcloud.com>
>
> 2016-10-18 18:11 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
>
> > In other words, if I build a debug logging version of cxf how would I
> > incorporate that into my TomEE embedded test? Can I just add the
> dependency
> > in Maven or do I have to exclude the version bundled in TomEE?
> >
> > On Tue, Oct 18, 2016 at 11:52 AM, Romain Manni-Bucau <
> > rmannibucau@gmail.com>
> > wrote:
> >
> > > you should switch them I guess.
> > >
> > > Generally speaking if you include cxf dependencies in your application
> > > there is a property in tomee to ask it to isolate the webapp from the
> > > container for cxf - not sure I got your question right.
> > >
> > >
> > > Romain Manni-Bucau
> > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > rmannibucau> |
> > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > <http://www.tomitribe.com> | JavaEE Factory
> > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > >
> > > 2016-10-18 17:40 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > >
> > > > Do I have to exclude current CXF in TomEE dependencies or just
> include
> > > the
> > > > debug version I'm building?
> > > >
> > > > On Tue, Oct 18, 2016 at 2:46 AM, Romain Manni-Bucau <
> > > rmannibucau@gmail.com
> > > > >
> > > > wrote:
> > > >
> > > > > As mentionned in the previous answer this is not in tomee sources
> but
> > > > CXF,
> > > > > agree it should be logged at debug level but with current code
> > > debugging
> > > > is
> > > > > the fastest.
> > > > >
> > > > > Side note: you dont need to build tomee from sources, just need to
> > add
> > > > > cxf-core.
> > > > >
> > > > >
> > > > > Romain Manni-Bucau
> > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > > > rmannibucau> |
> > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > >
> > > > > 2016-10-18 3:31 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > > >
> > > > > > OK, I've built TomEE from source before, but I've not run it in
> > debug
> > > > > mode.
> > > > > > Wouldn't it be just as easy to simply log vars f, p and o when I
> > > build
> > > > > the
> > > > > > source?
> > > > > >
> > > > > > On Mon, Oct 17, 2016 at 5:09 PM, Romain Manni-Bucau <
> > > > > rmannibucau@gmail.com
> > > > > > >
> > > > > > wrote:
> > > > > >
> > > > > > > cxf ones yes, that's as easy as adding cxf-core as provded
> > > > dependency,
> > > > > > > putting a breakpoint on the mentionned line normally and
> starting
> > > > tomee
> > > > > > in
> > > > > > > debug mode. Surely the most efficient way to solve it.
> > > > > > >
> > > > > > >
> > > > > > > Romain Manni-Bucau
> > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > > > <http://rmannibucau.wordpress.com> | Github <
> https://github.com/
> > > > > > > rmannibucau> |
> > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> Tomitriber
> > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > >
> > > > > > > 2016-10-17 22:52 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > > > > >
> > > > > > > > You mean set a breakpoint in TomEE source?
> > > > > > > >
> > > > > > > > On Mon, Oct 17, 2016 at 4:43 PM, Romain Manni-Bucau <
> > > > > > > rmannibucau@gmail.com
> > > > > > > > >
> > > > > > > > wrote:
> > > > > > > >
> > > > > > > > > If you can put a breakpoint at
> > > > > > > > > https://github.com/apache/cxf/blob/
> > > > eab841d5477c5e1ed21a49918defa7
> > > > > > > > > 9a0f1ad533/core/src/main/java/org/apache/cxf/staxutils/
> > > > > > > > StaxUtils.java#L381
> > > > > > > > > then you would know immediately why the throwable is
> thrown.
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > Romain Manni-Bucau
> > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress
> Blog
> > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > https://github.com/
> > > > > > > > > rmannibucau> |
> > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > Tomitriber
> > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > >
> > > > > > > > > 2016-10-17 22:41 GMT+02:00 Steve Goldsmith <
> sgjava@gmail.com
> > >:
> > > > > > > > >
> > > > > > > > > > OK, I made the following change and I still get the
> error:
> > > > > > > > > >
> > > > > > > > > > <dependency>
> > > > > > > > > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > > > > > > > > <artifactId>jaxb2-basics-
> runtime</artifactId>
> > > > > > > > > > <version>0.10.0</version>
> > > > > > > > > > <scope>provided</scope>
> > > > > > > > > > </dependency>
> > > > > > > > > >
> > > > > > > > > > I even tried:
> > > > > > > > > >
> > > > > > > > > > <dependency>
> > > > > > > > > > <groupId>org.apache.tomee</groupId>
> > > > > > > > > > <artifactId>tomee-jaxrs</artifactId>
> > > > > > > > > > <version>${tomee.version}</version>
> > > > > > > > > > <scope>test</scope>
> > > > > > > > > > <exclusions>
> > > > > > > > > > <exclusion>
> > > > > > > > > > <groupId>com.sun.xml.bind</groupId>
> > > > > > > > > > <artifactId>jaxb-impl</artifactId>
> > > > > > > > > > </exclusion>
> > > > > > > > > > </exclusions>
> > > > > > > > > > </dependency>
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > > On Mon, Oct 17, 2016 at 3:37 PM, Romain Manni-Bucau <
> > > > > > > > > rmannibucau@gmail.com
> > > > > > > > > > >
> > > > > > > > > > wrote:
> > > > > > > > > >
> > > > > > > > > > > well jaxb is provided and shouldnt be delivered so you
> > have
> > > > to
> > > > > > > remove
> > > > > > > > > it
> > > > > > > > > > > from WEB-INF/lib. scope=provided should be fine too.
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress
> > > Blog
> > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > https://github.com/
> > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > > > Tomitriber
> > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > > >
> > > > > > > > > > > 2016-10-17 20:07 GMT+02:00 Steve Goldsmith <
> > > sgjava@gmail.com
> > > > >:
> > > > > > > > > > >
> > > > > > > > > > > > I need JAX-B runtime for code generated by
> > > > jaxws-maven-plugin
> > > > > > and
> > > > > > > > > XJC.
> > > > > > > > > > > > Everything else is in test scope and not used in the
> > > > deployed
> > > > > > > app.
> > > > > > > > > > > >
> > > > > > > > > > > > <dependency>
> > > > > > > > > > > > <groupId>org.jvnet.jaxb2_
> commons</groupId>
> > > > > > > > > > > > <artifactId>jaxb2-basics-
> > > runtime</artifactId>
> > > > > > > > > > > > <version>0.10.0</version>
> > > > > > > > > > > > </dependency>
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > > On Mon, Oct 17, 2016 at 1:57 PM, Romain Manni-Bucau <
> > > > > > > > > > > rmannibucau@gmail.com
> > > > > > > > > > > > >
> > > > > > > > > > > > wrote:
> > > > > > > > > > > >
> > > > > > > > > > > > > yep so surely some part of the app running in a
> > > > conflicting
> > > > > > > > > > > classloader.
> > > > > > > > > > > > > Personally I'd just remove stax2-api, woodstox and
> > jaxb
> > > > to
> > > > > > > start
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> |
> > Blog
> > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old
> > Wordpress
> > > > > Blog
> > > > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > > > https://github.com/
> > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau>
> |
> > > > > > > Tomitriber
> > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > > > > >
> > > > > > > > > > > > > 2016-10-17 19:47 GMT+02:00 Steve Goldsmith <
> > > > > sgjava@gmail.com
> > > > > > >:
> > > > > > > > > > > > >
> > > > > > > > > > > > > > ~/java/apache-maven-3.3.9/bin/mvn
> dependency:tree
> > |
> > > > > egrep
> > > > > > > > > > > > 'woo|xml|stax'
> > > > > > > > > > > > > > [INFO] | | +- javax.xml.bind:jaxb-api:jar:2.
> > > > > 2.6:test
> > > > > > > > > > > > > > [INFO] | | \- com.sun.xml.bind:jaxb-impl:
> > > > > > jar:2.2.6:test
> > > > > > > > > > > > > > [INFO] | | | +-
> > org.apache.santuario:xmlsec:
> > > > > > > > > > jar:2.0.5:test
> > > > > > > > > > > > > > [INFO] | | | | | +-
> > > > > > > > > > > > > > org.opensaml:opensaml-xmlsec-api:jar:3.1.1:test
> > > > > > > > > > > > > > [INFO] | | | | +-
> > > > org.opensaml:opensaml-xmlsec-
> > > > > > > > > > > > > > impl:jar:3.1.1:test
> > > > > > > > > > > > > > [INFO] | | +- org.apache.wss4j:wss4j-ws-
> > > > > > > > > > > > > security-stax:jar:2.1.4:test
> > > > > > > > > > > > > > [INFO] | | +-
> > > > > > > > > > > > > > org.apache.wss4j:wss4j-ws-
> > > > security-policy-stax:jar:2.1.
> > > > > > > 4:test
> > > > > > > > > > > > > > [INFO] | | | +-
> > xml-resolver:xml-resolver:jar:
> > > > > > 1.2:test
> > > > > > > > > > > > > > [INFO] | | | +- org.apache.cxf:cxf-rt-
> > > > > > > > > > > > bindings-xml:jar:3.1.6:test
> > > > > > > > > > > > > > [INFO] | | \- com.sun.xml.messaging.saaj:
> > > > > > > > > > > > saaj-impl:jar:1.3.18:test
> > > > > > > > > > > > > > [INFO] | | | +- org.codehaus.woodstox:
> > > > > > > > > > > > woodstox-core-asl:jar:4.4.1:
> > > > > > > > > > > > > > test
> > > > > > > > > > > > > > [INFO] | | | | \-
> > org.codehaus.woodstox:stax2-
> > > > > > > > > > > > api:jar:3.1.4:test
> > > > > > > > > > > > > > [INFO] | | | \- org.apache.ws.xmlschema:
> > > > > > > > > > > > > > xmlschema-core:jar:2.2.1:test
> > > > > > > > > > > > > > [INFO] +-
> > > > > > > > > > > > > > com.fasterxml.jackson.jaxrs:
> > > > jackson-jaxrs-json-provider:
> > > > > > > > > > > jar:2.7.4:test
> > > > > > > > > > > > > > [INFO] | +- com.fasterxml.jackson.jaxrs:
> > > > > > > > > > > jackson-jaxrs-base:jar:2.7.4:
> > > > > > > > > > > > > test
> > > > > > > > > > > > > > [INFO] | +- com.fasterxml.jackson.core:
> > > > > > > > > > jackson-core:jar:2.7.4:test
> > > > > > > > > > > > > > [INFO] | +- com.fasterxml.jackson.core:
> > > > > > > > > > jackson-databind:jar:2.7.4:
> > > > > > > > > > > > test
> > > > > > > > > > > > > > [INFO] | | \-
> > > > > > > > > > > > > > com.fasterxml.jackson.core:
> > > > > jackson-annotations:jar:2.7.0:
> > > > > > > test
> > > > > > > > > > > > > > [INFO] | \-
> > > > > > > > > > > > > > com.fasterxml.jackson.module:
> jackson-module-jaxb-
> > > > > > > > > > > > > > annotations:jar:2.7.4:test
> > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > On Mon, Oct 17, 2016 at 11:40 AM, Romain
> > Manni-Bucau
> > > <
> > > > > > > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > > > > > > wrote:
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > > mvn dependency:tree | egrep 'woo|xml|stax'
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau>
> |
> > > > Blog
> > > > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old
> > > > Wordpress
> > > > > > > Blog
> > > > > > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > > > > > https://github.com/
> > > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/
> > rmannibucau>
> > > |
> > > > > > > > > Tomitriber
> > > > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com
> >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > 2016-10-17 17:36 GMT+02:00 Steve Goldsmith <
> > > > > > > sgjava@gmail.com
> > > > > > > > >:
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > My compile dependencies are (do you see
> > anything
> > > > that
> > > > > > > > sticks
> > > > > > > > > > > out):
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > <groupId>org.jsr107.ri</groupId>
> > > > > > > > > > > > > > > > <artifactId>cache-annotations-
> > > > > > > > > ri-cdi</artifactId>
> > > > > > > > > > > > > > > > <version>1.0.0</version>
> > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > <groupId>org.jvnet.jaxb2_
> > > > > commons</groupId>
> > > > > > > > > > > > > > > > <artifactId>jaxb2-basics-
> > > > > > > runtime</artifactId>
> > > > > > > > > > > > > > > > <version>0.10.0</version>
> > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > <groupId>org.slf4j</groupId>
> > > > > > > > > > > > > > > > <artifactId>slf4j-api</
> artifactId>
> > > > > > > > > > > > > > > > <version>${slf4j.version}</
> > version>
> > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > <groupId>ch.qos.logback</
> groupId>
> > > > > > > > > > > > > > > > <artifactId>logback-classic</
> > > > artifactId>
> > > > > > > > > > > > > > > > <version>${logback.version}</
> > > version>
> > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > <groupId>ch.qos.logback</
> groupId>
> > > > > > > > > > > > > > > > <artifactId>logback-core</
> > > artifactId>
> > > > > > > > > > > > > > > > <version>${logback.version}</
> > > version>
> > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > <groupId>org.apache.commons</
> > > groupId>
> > > > > > > > > > > > > > > > <artifactId>commons-pool2</
> > > artifactId>
> > > > > > > > > > > > > > > > <version>2.4.2</version>
> > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > <groupId>commons-
> > > > configuration</groupId>
> > > > > > > > > > > > > > > > <artifactId>commons-
> > > > > > > configuration</artifactId>
> > > > > > > > > > > > > > > > <version>1.10</version>
> > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > > <groupId>org.jasypt</groupId>
> > > > > > > > > > > > > > > > <artifactId>jasypt</artifactId>
> > > > > > > > > > > > > > > > <version>1.9.3-SNAPSHOT</
> version>
> > > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > On Mon, Oct 17, 2016 at 11:30 AM, Romain
> > > > Manni-Bucau
> > > > > <
> > > > > > > > > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > > > > > > > > wrote:
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > Hello
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > can happen if you provide some xml
> libraries
> > in
> > > > > your
> > > > > > > app
> > > > > > > > -
> > > > > > > > > > like
> > > > > > > > > > > > > > > woodstox
> > > > > > > > > > > > > > > > or
> > > > > > > > > > > > > > > > > stax*api - and it conflicts at some point.
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > > > > @rmannibucau <https://twitter.com/
> > rmannibucau>
> > > |
> > > > > > Blog
> > > > > > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> |
> Old
> > > > > > Wordpress
> > > > > > > > > Blog
> > > > > > > > > > > > > > > > > <http://rmannibucau.wordpress.com> |
> Github
> > <
> > > > > > > > > > > https://github.com/
> > > > > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/
> > > > rmannibucau>
> > > > > |
> > > > > > > > > > > Tomitriber
> > > > > > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE
> Factory
> > > > > > > > > > > > > > > > > <https://javaeefactory-
> > rmannibucau.rhcloud.com
> > > >
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > 2016-10-17 17:18 GMT+02:00 sgjava <
> > > > > sgjava@gmail.com
> > > > > > >:
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > Periodically I'm seeing "Cannot create a
> > > secure
> > > > > > > > > > > > XMLInputFactory"
> > > > > > > > > > > > > in
> > > > > > > > > > > > > > > > TomEE
> > > > > > > > > > > > > > > > > > 7.0.2-SNAPSHOT. One solution is for CXF
> > using
> > > > > > > > > > > > > > > > > > -Dorg.apache.cxf.stax.
> > allowInsecureParser=1.
> > > > > This
> > > > > > is
> > > > > > > > an
> > > > > > > > > > > older
> > > > > > > > > > > > > > 7.0.2
> > > > > > > > > > > > > > > > from
> > > > > > > > > > > > > > > > > > 7/4/16.
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > > > > View this message in context:
> > > > > > > > > http://tomee-openejb.979440.
> > > > > > > > > > > > > > > > > > n4.nabble.com/Cannot-create-a-
> > > > > > > secure-XMLInputFactory-
> > > > > > > > > > > > > > tp4680348.html
> > > > > > > > > > > > > > > > > > Sent from the TomEE Users mailing list
> > > archive
> > > > at
> > > > > > > > > > Nabble.com.
> > > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > --
> > > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > > --
> > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > > --
> > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > >
> > > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > > --
> > > > > > > > Steven P. Goldsmith
> > > > > > > >
> > > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > > --
> > > > > > Steven P. Goldsmith
> > > > > >
> > > > >
> > > >
> > > >
> > > >
> > > > --
> > > > Steven P. Goldsmith
> > > >
> > >
> >
> >
> >
> > --
> > Steven P. Goldsmith
> >
>
--
Steven P. Goldsmith
Re: Cannot create a secure XMLInputFactory
Posted by Romain Manni-Bucau <rm...@gmail.com>.
for tomee embedded yes
Romain Manni-Bucau
@rmannibucau <https://twitter.com/rmannibucau> | Blog
<https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
<http://rmannibucau.wordpress.com> | Github <https://github.com/rmannibucau> |
LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
<http://www.tomitribe.com> | JavaEE Factory
<https://javaeefactory-rmannibucau.rhcloud.com>
2016-10-18 18:11 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> In other words, if I build a debug logging version of cxf how would I
> incorporate that into my TomEE embedded test? Can I just add the dependency
> in Maven or do I have to exclude the version bundled in TomEE?
>
> On Tue, Oct 18, 2016 at 11:52 AM, Romain Manni-Bucau <
> rmannibucau@gmail.com>
> wrote:
>
> > you should switch them I guess.
> >
> > Generally speaking if you include cxf dependencies in your application
> > there is a property in tomee to ask it to isolate the webapp from the
> > container for cxf - not sure I got your question right.
> >
> >
> > Romain Manni-Bucau
> > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > rmannibucau> |
> > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > <http://www.tomitribe.com> | JavaEE Factory
> > <https://javaeefactory-rmannibucau.rhcloud.com>
> >
> > 2016-10-18 17:40 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> >
> > > Do I have to exclude current CXF in TomEE dependencies or just include
> > the
> > > debug version I'm building?
> > >
> > > On Tue, Oct 18, 2016 at 2:46 AM, Romain Manni-Bucau <
> > rmannibucau@gmail.com
> > > >
> > > wrote:
> > >
> > > > As mentionned in the previous answer this is not in tomee sources but
> > > CXF,
> > > > agree it should be logged at debug level but with current code
> > debugging
> > > is
> > > > the fastest.
> > > >
> > > > Side note: you dont need to build tomee from sources, just need to
> add
> > > > cxf-core.
> > > >
> > > >
> > > > Romain Manni-Bucau
> > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > > rmannibucau> |
> > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > >
> > > > 2016-10-18 3:31 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > >
> > > > > OK, I've built TomEE from source before, but I've not run it in
> debug
> > > > mode.
> > > > > Wouldn't it be just as easy to simply log vars f, p and o when I
> > build
> > > > the
> > > > > source?
> > > > >
> > > > > On Mon, Oct 17, 2016 at 5:09 PM, Romain Manni-Bucau <
> > > > rmannibucau@gmail.com
> > > > > >
> > > > > wrote:
> > > > >
> > > > > > cxf ones yes, that's as easy as adding cxf-core as provded
> > > dependency,
> > > > > > putting a breakpoint on the mentionned line normally and starting
> > > tomee
> > > > > in
> > > > > > debug mode. Surely the most efficient way to solve it.
> > > > > >
> > > > > >
> > > > > > Romain Manni-Bucau
> > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > > > > rmannibucau> |
> > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > >
> > > > > > 2016-10-17 22:52 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > > > >
> > > > > > > You mean set a breakpoint in TomEE source?
> > > > > > >
> > > > > > > On Mon, Oct 17, 2016 at 4:43 PM, Romain Manni-Bucau <
> > > > > > rmannibucau@gmail.com
> > > > > > > >
> > > > > > > wrote:
> > > > > > >
> > > > > > > > If you can put a breakpoint at
> > > > > > > > https://github.com/apache/cxf/blob/
> > > eab841d5477c5e1ed21a49918defa7
> > > > > > > > 9a0f1ad533/core/src/main/java/org/apache/cxf/staxutils/
> > > > > > > StaxUtils.java#L381
> > > > > > > > then you would know immediately why the throwable is thrown.
> > > > > > > >
> > > > > > > >
> > > > > > > > Romain Manni-Bucau
> > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > https://github.com/
> > > > > > > > rmannibucau> |
> > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > Tomitriber
> > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > >
> > > > > > > > 2016-10-17 22:41 GMT+02:00 Steve Goldsmith <sgjava@gmail.com
> >:
> > > > > > > >
> > > > > > > > > OK, I made the following change and I still get the error:
> > > > > > > > >
> > > > > > > > > <dependency>
> > > > > > > > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > > > > > > > <artifactId>jaxb2-basics-runtime</artifactId>
> > > > > > > > > <version>0.10.0</version>
> > > > > > > > > <scope>provided</scope>
> > > > > > > > > </dependency>
> > > > > > > > >
> > > > > > > > > I even tried:
> > > > > > > > >
> > > > > > > > > <dependency>
> > > > > > > > > <groupId>org.apache.tomee</groupId>
> > > > > > > > > <artifactId>tomee-jaxrs</artifactId>
> > > > > > > > > <version>${tomee.version}</version>
> > > > > > > > > <scope>test</scope>
> > > > > > > > > <exclusions>
> > > > > > > > > <exclusion>
> > > > > > > > > <groupId>com.sun.xml.bind</groupId>
> > > > > > > > > <artifactId>jaxb-impl</artifactId>
> > > > > > > > > </exclusion>
> > > > > > > > > </exclusions>
> > > > > > > > > </dependency>
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > On Mon, Oct 17, 2016 at 3:37 PM, Romain Manni-Bucau <
> > > > > > > > rmannibucau@gmail.com
> > > > > > > > > >
> > > > > > > > > wrote:
> > > > > > > > >
> > > > > > > > > > well jaxb is provided and shouldnt be delivered so you
> have
> > > to
> > > > > > remove
> > > > > > > > it
> > > > > > > > > > from WEB-INF/lib. scope=provided should be fine too.
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress
> > Blog
> > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > https://github.com/
> > > > > > > > > > rmannibucau> |
> > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > > Tomitriber
> > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > >
> > > > > > > > > > 2016-10-17 20:07 GMT+02:00 Steve Goldsmith <
> > sgjava@gmail.com
> > > >:
> > > > > > > > > >
> > > > > > > > > > > I need JAX-B runtime for code generated by
> > > jaxws-maven-plugin
> > > > > and
> > > > > > > > XJC.
> > > > > > > > > > > Everything else is in test scope and not used in the
> > > deployed
> > > > > > app.
> > > > > > > > > > >
> > > > > > > > > > > <dependency>
> > > > > > > > > > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > > > > > > > > > <artifactId>jaxb2-basics-
> > runtime</artifactId>
> > > > > > > > > > > <version>0.10.0</version>
> > > > > > > > > > > </dependency>
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > > On Mon, Oct 17, 2016 at 1:57 PM, Romain Manni-Bucau <
> > > > > > > > > > rmannibucau@gmail.com
> > > > > > > > > > > >
> > > > > > > > > > > wrote:
> > > > > > > > > > >
> > > > > > > > > > > > yep so surely some part of the app running in a
> > > conflicting
> > > > > > > > > > classloader.
> > > > > > > > > > > > Personally I'd just remove stax2-api, woodstox and
> jaxb
> > > to
> > > > > > start
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> |
> Blog
> > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old
> Wordpress
> > > > Blog
> > > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > > https://github.com/
> > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > > > > Tomitriber
> > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > > > >
> > > > > > > > > > > > 2016-10-17 19:47 GMT+02:00 Steve Goldsmith <
> > > > sgjava@gmail.com
> > > > > >:
> > > > > > > > > > > >
> > > > > > > > > > > > > ~/java/apache-maven-3.3.9/bin/mvn dependency:tree
> |
> > > > egrep
> > > > > > > > > > > 'woo|xml|stax'
> > > > > > > > > > > > > [INFO] | | +- javax.xml.bind:jaxb-api:jar:2.
> > > > 2.6:test
> > > > > > > > > > > > > [INFO] | | \- com.sun.xml.bind:jaxb-impl:
> > > > > jar:2.2.6:test
> > > > > > > > > > > > > [INFO] | | | +-
> org.apache.santuario:xmlsec:
> > > > > > > > > jar:2.0.5:test
> > > > > > > > > > > > > [INFO] | | | | | +-
> > > > > > > > > > > > > org.opensaml:opensaml-xmlsec-api:jar:3.1.1:test
> > > > > > > > > > > > > [INFO] | | | | +-
> > > org.opensaml:opensaml-xmlsec-
> > > > > > > > > > > > > impl:jar:3.1.1:test
> > > > > > > > > > > > > [INFO] | | +- org.apache.wss4j:wss4j-ws-
> > > > > > > > > > > > security-stax:jar:2.1.4:test
> > > > > > > > > > > > > [INFO] | | +-
> > > > > > > > > > > > > org.apache.wss4j:wss4j-ws-
> > > security-policy-stax:jar:2.1.
> > > > > > 4:test
> > > > > > > > > > > > > [INFO] | | | +-
> xml-resolver:xml-resolver:jar:
> > > > > 1.2:test
> > > > > > > > > > > > > [INFO] | | | +- org.apache.cxf:cxf-rt-
> > > > > > > > > > > bindings-xml:jar:3.1.6:test
> > > > > > > > > > > > > [INFO] | | \- com.sun.xml.messaging.saaj:
> > > > > > > > > > > saaj-impl:jar:1.3.18:test
> > > > > > > > > > > > > [INFO] | | | +- org.codehaus.woodstox:
> > > > > > > > > > > woodstox-core-asl:jar:4.4.1:
> > > > > > > > > > > > > test
> > > > > > > > > > > > > [INFO] | | | | \-
> org.codehaus.woodstox:stax2-
> > > > > > > > > > > api:jar:3.1.4:test
> > > > > > > > > > > > > [INFO] | | | \- org.apache.ws.xmlschema:
> > > > > > > > > > > > > xmlschema-core:jar:2.2.1:test
> > > > > > > > > > > > > [INFO] +-
> > > > > > > > > > > > > com.fasterxml.jackson.jaxrs:
> > > jackson-jaxrs-json-provider:
> > > > > > > > > > jar:2.7.4:test
> > > > > > > > > > > > > [INFO] | +- com.fasterxml.jackson.jaxrs:
> > > > > > > > > > jackson-jaxrs-base:jar:2.7.4:
> > > > > > > > > > > > test
> > > > > > > > > > > > > [INFO] | +- com.fasterxml.jackson.core:
> > > > > > > > > jackson-core:jar:2.7.4:test
> > > > > > > > > > > > > [INFO] | +- com.fasterxml.jackson.core:
> > > > > > > > > jackson-databind:jar:2.7.4:
> > > > > > > > > > > test
> > > > > > > > > > > > > [INFO] | | \-
> > > > > > > > > > > > > com.fasterxml.jackson.core:
> > > > jackson-annotations:jar:2.7.0:
> > > > > > test
> > > > > > > > > > > > > [INFO] | \-
> > > > > > > > > > > > > com.fasterxml.jackson.module:jackson-module-jaxb-
> > > > > > > > > > > > > annotations:jar:2.7.4:test
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > > On Mon, Oct 17, 2016 at 11:40 AM, Romain
> Manni-Bucau
> > <
> > > > > > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > > > > > wrote:
> > > > > > > > > > > > >
> > > > > > > > > > > > > > mvn dependency:tree | egrep 'woo|xml|stax'
> > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> |
> > > Blog
> > > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old
> > > Wordpress
> > > > > > Blog
> > > > > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > > > > https://github.com/
> > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/
> rmannibucau>
> > |
> > > > > > > > Tomitriber
> > > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > 2016-10-17 17:36 GMT+02:00 Steve Goldsmith <
> > > > > > sgjava@gmail.com
> > > > > > > >:
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > > My compile dependencies are (do you see
> anything
> > > that
> > > > > > > sticks
> > > > > > > > > > out):
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > <groupId>org.jsr107.ri</groupId>
> > > > > > > > > > > > > > > <artifactId>cache-annotations-
> > > > > > > > ri-cdi</artifactId>
> > > > > > > > > > > > > > > <version>1.0.0</version>
> > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > <groupId>org.jvnet.jaxb2_
> > > > commons</groupId>
> > > > > > > > > > > > > > > <artifactId>jaxb2-basics-
> > > > > > runtime</artifactId>
> > > > > > > > > > > > > > > <version>0.10.0</version>
> > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > <groupId>org.slf4j</groupId>
> > > > > > > > > > > > > > > <artifactId>slf4j-api</artifactId>
> > > > > > > > > > > > > > > <version>${slf4j.version}</
> version>
> > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > <groupId>ch.qos.logback</groupId>
> > > > > > > > > > > > > > > <artifactId>logback-classic</
> > > artifactId>
> > > > > > > > > > > > > > > <version>${logback.version}</
> > version>
> > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > <groupId>ch.qos.logback</groupId>
> > > > > > > > > > > > > > > <artifactId>logback-core</
> > artifactId>
> > > > > > > > > > > > > > > <version>${logback.version}</
> > version>
> > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > <groupId>org.apache.commons</
> > groupId>
> > > > > > > > > > > > > > > <artifactId>commons-pool2</
> > artifactId>
> > > > > > > > > > > > > > > <version>2.4.2</version>
> > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > <groupId>commons-
> > > configuration</groupId>
> > > > > > > > > > > > > > > <artifactId>commons-
> > > > > > configuration</artifactId>
> > > > > > > > > > > > > > > <version>1.10</version>
> > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > > <groupId>org.jasypt</groupId>
> > > > > > > > > > > > > > > <artifactId>jasypt</artifactId>
> > > > > > > > > > > > > > > <version>1.9.3-SNAPSHOT</version>
> > > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > On Mon, Oct 17, 2016 at 11:30 AM, Romain
> > > Manni-Bucau
> > > > <
> > > > > > > > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > > > > > > > wrote:
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > Hello
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > can happen if you provide some xml libraries
> in
> > > > your
> > > > > > app
> > > > > > > -
> > > > > > > > > like
> > > > > > > > > > > > > > woodstox
> > > > > > > > > > > > > > > or
> > > > > > > > > > > > > > > > stax*api - and it conflicts at some point.
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > > > @rmannibucau <https://twitter.com/
> rmannibucau>
> > |
> > > > > Blog
> > > > > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old
> > > > > Wordpress
> > > > > > > > Blog
> > > > > > > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github
> <
> > > > > > > > > > https://github.com/
> > > > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/
> > > rmannibucau>
> > > > |
> > > > > > > > > > Tomitriber
> > > > > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > > > > > > <https://javaeefactory-
> rmannibucau.rhcloud.com
> > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > 2016-10-17 17:18 GMT+02:00 sgjava <
> > > > sgjava@gmail.com
> > > > > >:
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > Periodically I'm seeing "Cannot create a
> > secure
> > > > > > > > > > > XMLInputFactory"
> > > > > > > > > > > > in
> > > > > > > > > > > > > > > TomEE
> > > > > > > > > > > > > > > > > 7.0.2-SNAPSHOT. One solution is for CXF
> using
> > > > > > > > > > > > > > > > > -Dorg.apache.cxf.stax.
> allowInsecureParser=1.
> > > > This
> > > > > is
> > > > > > > an
> > > > > > > > > > older
> > > > > > > > > > > > > 7.0.2
> > > > > > > > > > > > > > > from
> > > > > > > > > > > > > > > > > 7/4/16.
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > > > View this message in context:
> > > > > > > > http://tomee-openejb.979440.
> > > > > > > > > > > > > > > > > n4.nabble.com/Cannot-create-a-
> > > > > > secure-XMLInputFactory-
> > > > > > > > > > > > > tp4680348.html
> > > > > > > > > > > > > > > > > Sent from the TomEE Users mailing list
> > archive
> > > at
> > > > > > > > > Nabble.com.
> > > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > > --
> > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > > --
> > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > >
> > > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > --
> > > > > > > > > Steven P. Goldsmith
> > > > > > > > >
> > > > > > > >
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > > --
> > > > > > > Steven P. Goldsmith
> > > > > > >
> > > > > >
> > > > >
> > > > >
> > > > >
> > > > > --
> > > > > Steven P. Goldsmith
> > > > >
> > > >
> > >
> > >
> > >
> > > --
> > > Steven P. Goldsmith
> > >
> >
>
>
>
> --
> Steven P. Goldsmith
>
Re: Cannot create a secure XMLInputFactory
Posted by Steve Goldsmith <sg...@gmail.com>.
In other words, if I build a debug logging version of cxf how would I
incorporate that into my TomEE embedded test? Can I just add the dependency
in Maven or do I have to exclude the version bundled in TomEE?
On Tue, Oct 18, 2016 at 11:52 AM, Romain Manni-Bucau <rm...@gmail.com>
wrote:
> you should switch them I guess.
>
> Generally speaking if you include cxf dependencies in your application
> there is a property in tomee to ask it to isolate the webapp from the
> container for cxf - not sure I got your question right.
>
>
> Romain Manni-Bucau
> @rmannibucau <https://twitter.com/rmannibucau> | Blog
> <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> <http://rmannibucau.wordpress.com> | Github <https://github.com/
> rmannibucau> |
> LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> <http://www.tomitribe.com> | JavaEE Factory
> <https://javaeefactory-rmannibucau.rhcloud.com>
>
> 2016-10-18 17:40 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
>
> > Do I have to exclude current CXF in TomEE dependencies or just include
> the
> > debug version I'm building?
> >
> > On Tue, Oct 18, 2016 at 2:46 AM, Romain Manni-Bucau <
> rmannibucau@gmail.com
> > >
> > wrote:
> >
> > > As mentionned in the previous answer this is not in tomee sources but
> > CXF,
> > > agree it should be logged at debug level but with current code
> debugging
> > is
> > > the fastest.
> > >
> > > Side note: you dont need to build tomee from sources, just need to add
> > > cxf-core.
> > >
> > >
> > > Romain Manni-Bucau
> > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > rmannibucau> |
> > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > <http://www.tomitribe.com> | JavaEE Factory
> > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > >
> > > 2016-10-18 3:31 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > >
> > > > OK, I've built TomEE from source before, but I've not run it in debug
> > > mode.
> > > > Wouldn't it be just as easy to simply log vars f, p and o when I
> build
> > > the
> > > > source?
> > > >
> > > > On Mon, Oct 17, 2016 at 5:09 PM, Romain Manni-Bucau <
> > > rmannibucau@gmail.com
> > > > >
> > > > wrote:
> > > >
> > > > > cxf ones yes, that's as easy as adding cxf-core as provded
> > dependency,
> > > > > putting a breakpoint on the mentionned line normally and starting
> > tomee
> > > > in
> > > > > debug mode. Surely the most efficient way to solve it.
> > > > >
> > > > >
> > > > > Romain Manni-Bucau
> > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > > > rmannibucau> |
> > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > >
> > > > > 2016-10-17 22:52 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > > >
> > > > > > You mean set a breakpoint in TomEE source?
> > > > > >
> > > > > > On Mon, Oct 17, 2016 at 4:43 PM, Romain Manni-Bucau <
> > > > > rmannibucau@gmail.com
> > > > > > >
> > > > > > wrote:
> > > > > >
> > > > > > > If you can put a breakpoint at
> > > > > > > https://github.com/apache/cxf/blob/
> > eab841d5477c5e1ed21a49918defa7
> > > > > > > 9a0f1ad533/core/src/main/java/org/apache/cxf/staxutils/
> > > > > > StaxUtils.java#L381
> > > > > > > then you would know immediately why the throwable is thrown.
> > > > > > >
> > > > > > >
> > > > > > > Romain Manni-Bucau
> > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > > > <http://rmannibucau.wordpress.com> | Github <
> https://github.com/
> > > > > > > rmannibucau> |
> > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> Tomitriber
> > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > >
> > > > > > > 2016-10-17 22:41 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > > > > >
> > > > > > > > OK, I made the following change and I still get the error:
> > > > > > > >
> > > > > > > > <dependency>
> > > > > > > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > > > > > > <artifactId>jaxb2-basics-runtime</artifactId>
> > > > > > > > <version>0.10.0</version>
> > > > > > > > <scope>provided</scope>
> > > > > > > > </dependency>
> > > > > > > >
> > > > > > > > I even tried:
> > > > > > > >
> > > > > > > > <dependency>
> > > > > > > > <groupId>org.apache.tomee</groupId>
> > > > > > > > <artifactId>tomee-jaxrs</artifactId>
> > > > > > > > <version>${tomee.version}</version>
> > > > > > > > <scope>test</scope>
> > > > > > > > <exclusions>
> > > > > > > > <exclusion>
> > > > > > > > <groupId>com.sun.xml.bind</groupId>
> > > > > > > > <artifactId>jaxb-impl</artifactId>
> > > > > > > > </exclusion>
> > > > > > > > </exclusions>
> > > > > > > > </dependency>
> > > > > > > >
> > > > > > > >
> > > > > > > > On Mon, Oct 17, 2016 at 3:37 PM, Romain Manni-Bucau <
> > > > > > > rmannibucau@gmail.com
> > > > > > > > >
> > > > > > > > wrote:
> > > > > > > >
> > > > > > > > > well jaxb is provided and shouldnt be delivered so you have
> > to
> > > > > remove
> > > > > > > it
> > > > > > > > > from WEB-INF/lib. scope=provided should be fine too.
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > Romain Manni-Bucau
> > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress
> Blog
> > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > https://github.com/
> > > > > > > > > rmannibucau> |
> > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > Tomitriber
> > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > >
> > > > > > > > > 2016-10-17 20:07 GMT+02:00 Steve Goldsmith <
> sgjava@gmail.com
> > >:
> > > > > > > > >
> > > > > > > > > > I need JAX-B runtime for code generated by
> > jaxws-maven-plugin
> > > > and
> > > > > > > XJC.
> > > > > > > > > > Everything else is in test scope and not used in the
> > deployed
> > > > > app.
> > > > > > > > > >
> > > > > > > > > > <dependency>
> > > > > > > > > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > > > > > > > > <artifactId>jaxb2-basics-
> runtime</artifactId>
> > > > > > > > > > <version>0.10.0</version>
> > > > > > > > > > </dependency>
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > > On Mon, Oct 17, 2016 at 1:57 PM, Romain Manni-Bucau <
> > > > > > > > > rmannibucau@gmail.com
> > > > > > > > > > >
> > > > > > > > > > wrote:
> > > > > > > > > >
> > > > > > > > > > > yep so surely some part of the app running in a
> > conflicting
> > > > > > > > > classloader.
> > > > > > > > > > > Personally I'd just remove stax2-api, woodstox and jaxb
> > to
> > > > > start
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress
> > > Blog
> > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > https://github.com/
> > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > > > Tomitriber
> > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > > >
> > > > > > > > > > > 2016-10-17 19:47 GMT+02:00 Steve Goldsmith <
> > > sgjava@gmail.com
> > > > >:
> > > > > > > > > > >
> > > > > > > > > > > > ~/java/apache-maven-3.3.9/bin/mvn dependency:tree |
> > > egrep
> > > > > > > > > > 'woo|xml|stax'
> > > > > > > > > > > > [INFO] | | +- javax.xml.bind:jaxb-api:jar:2.
> > > 2.6:test
> > > > > > > > > > > > [INFO] | | \- com.sun.xml.bind:jaxb-impl:
> > > > jar:2.2.6:test
> > > > > > > > > > > > [INFO] | | | +- org.apache.santuario:xmlsec:
> > > > > > > > jar:2.0.5:test
> > > > > > > > > > > > [INFO] | | | | | +-
> > > > > > > > > > > > org.opensaml:opensaml-xmlsec-api:jar:3.1.1:test
> > > > > > > > > > > > [INFO] | | | | +-
> > org.opensaml:opensaml-xmlsec-
> > > > > > > > > > > > impl:jar:3.1.1:test
> > > > > > > > > > > > [INFO] | | +- org.apache.wss4j:wss4j-ws-
> > > > > > > > > > > security-stax:jar:2.1.4:test
> > > > > > > > > > > > [INFO] | | +-
> > > > > > > > > > > > org.apache.wss4j:wss4j-ws-
> > security-policy-stax:jar:2.1.
> > > > > 4:test
> > > > > > > > > > > > [INFO] | | | +- xml-resolver:xml-resolver:jar:
> > > > 1.2:test
> > > > > > > > > > > > [INFO] | | | +- org.apache.cxf:cxf-rt-
> > > > > > > > > > bindings-xml:jar:3.1.6:test
> > > > > > > > > > > > [INFO] | | \- com.sun.xml.messaging.saaj:
> > > > > > > > > > saaj-impl:jar:1.3.18:test
> > > > > > > > > > > > [INFO] | | | +- org.codehaus.woodstox:
> > > > > > > > > > woodstox-core-asl:jar:4.4.1:
> > > > > > > > > > > > test
> > > > > > > > > > > > [INFO] | | | | \- org.codehaus.woodstox:stax2-
> > > > > > > > > > api:jar:3.1.4:test
> > > > > > > > > > > > [INFO] | | | \- org.apache.ws.xmlschema:
> > > > > > > > > > > > xmlschema-core:jar:2.2.1:test
> > > > > > > > > > > > [INFO] +-
> > > > > > > > > > > > com.fasterxml.jackson.jaxrs:
> > jackson-jaxrs-json-provider:
> > > > > > > > > jar:2.7.4:test
> > > > > > > > > > > > [INFO] | +- com.fasterxml.jackson.jaxrs:
> > > > > > > > > jackson-jaxrs-base:jar:2.7.4:
> > > > > > > > > > > test
> > > > > > > > > > > > [INFO] | +- com.fasterxml.jackson.core:
> > > > > > > > jackson-core:jar:2.7.4:test
> > > > > > > > > > > > [INFO] | +- com.fasterxml.jackson.core:
> > > > > > > > jackson-databind:jar:2.7.4:
> > > > > > > > > > test
> > > > > > > > > > > > [INFO] | | \-
> > > > > > > > > > > > com.fasterxml.jackson.core:
> > > jackson-annotations:jar:2.7.0:
> > > > > test
> > > > > > > > > > > > [INFO] | \-
> > > > > > > > > > > > com.fasterxml.jackson.module:jackson-module-jaxb-
> > > > > > > > > > > > annotations:jar:2.7.4:test
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > > On Mon, Oct 17, 2016 at 11:40 AM, Romain Manni-Bucau
> <
> > > > > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > > > > wrote:
> > > > > > > > > > > >
> > > > > > > > > > > > > mvn dependency:tree | egrep 'woo|xml|stax'
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> |
> > Blog
> > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old
> > Wordpress
> > > > > Blog
> > > > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > > > https://github.com/
> > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau>
> |
> > > > > > > Tomitriber
> > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > > > > >
> > > > > > > > > > > > > 2016-10-17 17:36 GMT+02:00 Steve Goldsmith <
> > > > > sgjava@gmail.com
> > > > > > >:
> > > > > > > > > > > > >
> > > > > > > > > > > > > > My compile dependencies are (do you see anything
> > that
> > > > > > sticks
> > > > > > > > > out):
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > <groupId>org.jsr107.ri</groupId>
> > > > > > > > > > > > > > <artifactId>cache-annotations-
> > > > > > > ri-cdi</artifactId>
> > > > > > > > > > > > > > <version>1.0.0</version>
> > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > <groupId>org.jvnet.jaxb2_
> > > commons</groupId>
> > > > > > > > > > > > > > <artifactId>jaxb2-basics-
> > > > > runtime</artifactId>
> > > > > > > > > > > > > > <version>0.10.0</version>
> > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > <groupId>org.slf4j</groupId>
> > > > > > > > > > > > > > <artifactId>slf4j-api</artifactId>
> > > > > > > > > > > > > > <version>${slf4j.version}</version>
> > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > <groupId>ch.qos.logback</groupId>
> > > > > > > > > > > > > > <artifactId>logback-classic</
> > artifactId>
> > > > > > > > > > > > > > <version>${logback.version}</
> version>
> > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > <groupId>ch.qos.logback</groupId>
> > > > > > > > > > > > > > <artifactId>logback-core</
> artifactId>
> > > > > > > > > > > > > > <version>${logback.version}</
> version>
> > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > <groupId>org.apache.commons</
> groupId>
> > > > > > > > > > > > > > <artifactId>commons-pool2</
> artifactId>
> > > > > > > > > > > > > > <version>2.4.2</version>
> > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > <groupId>commons-
> > configuration</groupId>
> > > > > > > > > > > > > > <artifactId>commons-
> > > > > configuration</artifactId>
> > > > > > > > > > > > > > <version>1.10</version>
> > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > > <groupId>org.jasypt</groupId>
> > > > > > > > > > > > > > <artifactId>jasypt</artifactId>
> > > > > > > > > > > > > > <version>1.9.3-SNAPSHOT</version>
> > > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > On Mon, Oct 17, 2016 at 11:30 AM, Romain
> > Manni-Bucau
> > > <
> > > > > > > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > > > > > > wrote:
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > > Hello
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > can happen if you provide some xml libraries in
> > > your
> > > > > app
> > > > > > -
> > > > > > > > like
> > > > > > > > > > > > > woodstox
> > > > > > > > > > > > > > or
> > > > > > > > > > > > > > > stax*api - and it conflicts at some point.
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau>
> |
> > > > Blog
> > > > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old
> > > > Wordpress
> > > > > > > Blog
> > > > > > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > > > > > https://github.com/
> > > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/
> > rmannibucau>
> > > |
> > > > > > > > > Tomitriber
> > > > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com
> >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > 2016-10-17 17:18 GMT+02:00 sgjava <
> > > sgjava@gmail.com
> > > > >:
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > Periodically I'm seeing "Cannot create a
> secure
> > > > > > > > > > XMLInputFactory"
> > > > > > > > > > > in
> > > > > > > > > > > > > > TomEE
> > > > > > > > > > > > > > > > 7.0.2-SNAPSHOT. One solution is for CXF using
> > > > > > > > > > > > > > > > -Dorg.apache.cxf.stax.allowInsecureParser=1.
> > > This
> > > > is
> > > > > > an
> > > > > > > > > older
> > > > > > > > > > > > 7.0.2
> > > > > > > > > > > > > > from
> > > > > > > > > > > > > > > > 7/4/16.
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > > View this message in context:
> > > > > > > http://tomee-openejb.979440.
> > > > > > > > > > > > > > > > n4.nabble.com/Cannot-create-a-
> > > > > secure-XMLInputFactory-
> > > > > > > > > > > > tp4680348.html
> > > > > > > > > > > > > > > > Sent from the TomEE Users mailing list
> archive
> > at
> > > > > > > > Nabble.com.
> > > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > --
> > > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > > --
> > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > > --
> > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > >
> > > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > > --
> > > > > > > > Steven P. Goldsmith
> > > > > > > >
> > > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > > --
> > > > > > Steven P. Goldsmith
> > > > > >
> > > > >
> > > >
> > > >
> > > >
> > > > --
> > > > Steven P. Goldsmith
> > > >
> > >
> >
> >
> >
> > --
> > Steven P. Goldsmith
> >
>
--
Steven P. Goldsmith
Re: Cannot create a secure XMLInputFactory
Posted by Romain Manni-Bucau <rm...@gmail.com>.
you should switch them I guess.
Generally speaking if you include cxf dependencies in your application
there is a property in tomee to ask it to isolate the webapp from the
container for cxf - not sure I got your question right.
Romain Manni-Bucau
@rmannibucau <https://twitter.com/rmannibucau> | Blog
<https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
<http://rmannibucau.wordpress.com> | Github <https://github.com/rmannibucau> |
LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
<http://www.tomitribe.com> | JavaEE Factory
<https://javaeefactory-rmannibucau.rhcloud.com>
2016-10-18 17:40 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> Do I have to exclude current CXF in TomEE dependencies or just include the
> debug version I'm building?
>
> On Tue, Oct 18, 2016 at 2:46 AM, Romain Manni-Bucau <rmannibucau@gmail.com
> >
> wrote:
>
> > As mentionned in the previous answer this is not in tomee sources but
> CXF,
> > agree it should be logged at debug level but with current code debugging
> is
> > the fastest.
> >
> > Side note: you dont need to build tomee from sources, just need to add
> > cxf-core.
> >
> >
> > Romain Manni-Bucau
> > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > rmannibucau> |
> > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > <http://www.tomitribe.com> | JavaEE Factory
> > <https://javaeefactory-rmannibucau.rhcloud.com>
> >
> > 2016-10-18 3:31 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> >
> > > OK, I've built TomEE from source before, but I've not run it in debug
> > mode.
> > > Wouldn't it be just as easy to simply log vars f, p and o when I build
> > the
> > > source?
> > >
> > > On Mon, Oct 17, 2016 at 5:09 PM, Romain Manni-Bucau <
> > rmannibucau@gmail.com
> > > >
> > > wrote:
> > >
> > > > cxf ones yes, that's as easy as adding cxf-core as provded
> dependency,
> > > > putting a breakpoint on the mentionned line normally and starting
> tomee
> > > in
> > > > debug mode. Surely the most efficient way to solve it.
> > > >
> > > >
> > > > Romain Manni-Bucau
> > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > > rmannibucau> |
> > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > >
> > > > 2016-10-17 22:52 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > >
> > > > > You mean set a breakpoint in TomEE source?
> > > > >
> > > > > On Mon, Oct 17, 2016 at 4:43 PM, Romain Manni-Bucau <
> > > > rmannibucau@gmail.com
> > > > > >
> > > > > wrote:
> > > > >
> > > > > > If you can put a breakpoint at
> > > > > > https://github.com/apache/cxf/blob/
> eab841d5477c5e1ed21a49918defa7
> > > > > > 9a0f1ad533/core/src/main/java/org/apache/cxf/staxutils/
> > > > > StaxUtils.java#L381
> > > > > > then you would know immediately why the throwable is thrown.
> > > > > >
> > > > > >
> > > > > > Romain Manni-Bucau
> > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > > > > rmannibucau> |
> > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > >
> > > > > > 2016-10-17 22:41 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > > > >
> > > > > > > OK, I made the following change and I still get the error:
> > > > > > >
> > > > > > > <dependency>
> > > > > > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > > > > > <artifactId>jaxb2-basics-runtime</artifactId>
> > > > > > > <version>0.10.0</version>
> > > > > > > <scope>provided</scope>
> > > > > > > </dependency>
> > > > > > >
> > > > > > > I even tried:
> > > > > > >
> > > > > > > <dependency>
> > > > > > > <groupId>org.apache.tomee</groupId>
> > > > > > > <artifactId>tomee-jaxrs</artifactId>
> > > > > > > <version>${tomee.version}</version>
> > > > > > > <scope>test</scope>
> > > > > > > <exclusions>
> > > > > > > <exclusion>
> > > > > > > <groupId>com.sun.xml.bind</groupId>
> > > > > > > <artifactId>jaxb-impl</artifactId>
> > > > > > > </exclusion>
> > > > > > > </exclusions>
> > > > > > > </dependency>
> > > > > > >
> > > > > > >
> > > > > > > On Mon, Oct 17, 2016 at 3:37 PM, Romain Manni-Bucau <
> > > > > > rmannibucau@gmail.com
> > > > > > > >
> > > > > > > wrote:
> > > > > > >
> > > > > > > > well jaxb is provided and shouldnt be delivered so you have
> to
> > > > remove
> > > > > > it
> > > > > > > > from WEB-INF/lib. scope=provided should be fine too.
> > > > > > > >
> > > > > > > >
> > > > > > > > Romain Manni-Bucau
> > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > https://github.com/
> > > > > > > > rmannibucau> |
> > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > Tomitriber
> > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > >
> > > > > > > > 2016-10-17 20:07 GMT+02:00 Steve Goldsmith <sgjava@gmail.com
> >:
> > > > > > > >
> > > > > > > > > I need JAX-B runtime for code generated by
> jaxws-maven-plugin
> > > and
> > > > > > XJC.
> > > > > > > > > Everything else is in test scope and not used in the
> deployed
> > > > app.
> > > > > > > > >
> > > > > > > > > <dependency>
> > > > > > > > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > > > > > > > <artifactId>jaxb2-basics-runtime</artifactId>
> > > > > > > > > <version>0.10.0</version>
> > > > > > > > > </dependency>
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > On Mon, Oct 17, 2016 at 1:57 PM, Romain Manni-Bucau <
> > > > > > > > rmannibucau@gmail.com
> > > > > > > > > >
> > > > > > > > > wrote:
> > > > > > > > >
> > > > > > > > > > yep so surely some part of the app running in a
> conflicting
> > > > > > > > classloader.
> > > > > > > > > > Personally I'd just remove stax2-api, woodstox and jaxb
> to
> > > > start
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress
> > Blog
> > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > https://github.com/
> > > > > > > > > > rmannibucau> |
> > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > > Tomitriber
> > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > >
> > > > > > > > > > 2016-10-17 19:47 GMT+02:00 Steve Goldsmith <
> > sgjava@gmail.com
> > > >:
> > > > > > > > > >
> > > > > > > > > > > ~/java/apache-maven-3.3.9/bin/mvn dependency:tree |
> > egrep
> > > > > > > > > 'woo|xml|stax'
> > > > > > > > > > > [INFO] | | +- javax.xml.bind:jaxb-api:jar:2.
> > 2.6:test
> > > > > > > > > > > [INFO] | | \- com.sun.xml.bind:jaxb-impl:
> > > jar:2.2.6:test
> > > > > > > > > > > [INFO] | | | +- org.apache.santuario:xmlsec:
> > > > > > > jar:2.0.5:test
> > > > > > > > > > > [INFO] | | | | | +-
> > > > > > > > > > > org.opensaml:opensaml-xmlsec-api:jar:3.1.1:test
> > > > > > > > > > > [INFO] | | | | +-
> org.opensaml:opensaml-xmlsec-
> > > > > > > > > > > impl:jar:3.1.1:test
> > > > > > > > > > > [INFO] | | +- org.apache.wss4j:wss4j-ws-
> > > > > > > > > > security-stax:jar:2.1.4:test
> > > > > > > > > > > [INFO] | | +-
> > > > > > > > > > > org.apache.wss4j:wss4j-ws-
> security-policy-stax:jar:2.1.
> > > > 4:test
> > > > > > > > > > > [INFO] | | | +- xml-resolver:xml-resolver:jar:
> > > 1.2:test
> > > > > > > > > > > [INFO] | | | +- org.apache.cxf:cxf-rt-
> > > > > > > > > bindings-xml:jar:3.1.6:test
> > > > > > > > > > > [INFO] | | \- com.sun.xml.messaging.saaj:
> > > > > > > > > saaj-impl:jar:1.3.18:test
> > > > > > > > > > > [INFO] | | | +- org.codehaus.woodstox:
> > > > > > > > > woodstox-core-asl:jar:4.4.1:
> > > > > > > > > > > test
> > > > > > > > > > > [INFO] | | | | \- org.codehaus.woodstox:stax2-
> > > > > > > > > api:jar:3.1.4:test
> > > > > > > > > > > [INFO] | | | \- org.apache.ws.xmlschema:
> > > > > > > > > > > xmlschema-core:jar:2.2.1:test
> > > > > > > > > > > [INFO] +-
> > > > > > > > > > > com.fasterxml.jackson.jaxrs:
> jackson-jaxrs-json-provider:
> > > > > > > > jar:2.7.4:test
> > > > > > > > > > > [INFO] | +- com.fasterxml.jackson.jaxrs:
> > > > > > > > jackson-jaxrs-base:jar:2.7.4:
> > > > > > > > > > test
> > > > > > > > > > > [INFO] | +- com.fasterxml.jackson.core:
> > > > > > > jackson-core:jar:2.7.4:test
> > > > > > > > > > > [INFO] | +- com.fasterxml.jackson.core:
> > > > > > > jackson-databind:jar:2.7.4:
> > > > > > > > > test
> > > > > > > > > > > [INFO] | | \-
> > > > > > > > > > > com.fasterxml.jackson.core:
> > jackson-annotations:jar:2.7.0:
> > > > test
> > > > > > > > > > > [INFO] | \-
> > > > > > > > > > > com.fasterxml.jackson.module:jackson-module-jaxb-
> > > > > > > > > > > annotations:jar:2.7.4:test
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > > On Mon, Oct 17, 2016 at 11:40 AM, Romain Manni-Bucau <
> > > > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > > > wrote:
> > > > > > > > > > >
> > > > > > > > > > > > mvn dependency:tree | egrep 'woo|xml|stax'
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> |
> Blog
> > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old
> Wordpress
> > > > Blog
> > > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > > https://github.com/
> > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > > > > Tomitriber
> > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > > > >
> > > > > > > > > > > > 2016-10-17 17:36 GMT+02:00 Steve Goldsmith <
> > > > sgjava@gmail.com
> > > > > >:
> > > > > > > > > > > >
> > > > > > > > > > > > > My compile dependencies are (do you see anything
> that
> > > > > sticks
> > > > > > > > out):
> > > > > > > > > > > > >
> > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > <groupId>org.jsr107.ri</groupId>
> > > > > > > > > > > > > <artifactId>cache-annotations-
> > > > > > ri-cdi</artifactId>
> > > > > > > > > > > > > <version>1.0.0</version>
> > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > <groupId>org.jvnet.jaxb2_
> > commons</groupId>
> > > > > > > > > > > > > <artifactId>jaxb2-basics-
> > > > runtime</artifactId>
> > > > > > > > > > > > > <version>0.10.0</version>
> > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > <groupId>org.slf4j</groupId>
> > > > > > > > > > > > > <artifactId>slf4j-api</artifactId>
> > > > > > > > > > > > > <version>${slf4j.version}</version>
> > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > <groupId>ch.qos.logback</groupId>
> > > > > > > > > > > > > <artifactId>logback-classic</
> artifactId>
> > > > > > > > > > > > > <version>${logback.version}</version>
> > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > <groupId>ch.qos.logback</groupId>
> > > > > > > > > > > > > <artifactId>logback-core</artifactId>
> > > > > > > > > > > > > <version>${logback.version}</version>
> > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > <groupId>org.apache.commons</groupId>
> > > > > > > > > > > > > <artifactId>commons-pool2</artifactId>
> > > > > > > > > > > > > <version>2.4.2</version>
> > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > <groupId>commons-
> configuration</groupId>
> > > > > > > > > > > > > <artifactId>commons-
> > > > configuration</artifactId>
> > > > > > > > > > > > > <version>1.10</version>
> > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > > <dependency>
> > > > > > > > > > > > > <groupId>org.jasypt</groupId>
> > > > > > > > > > > > > <artifactId>jasypt</artifactId>
> > > > > > > > > > > > > <version>1.9.3-SNAPSHOT</version>
> > > > > > > > > > > > > </dependency>
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > > On Mon, Oct 17, 2016 at 11:30 AM, Romain
> Manni-Bucau
> > <
> > > > > > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > > > > > wrote:
> > > > > > > > > > > > >
> > > > > > > > > > > > > > Hello
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > can happen if you provide some xml libraries in
> > your
> > > > app
> > > > > -
> > > > > > > like
> > > > > > > > > > > > woodstox
> > > > > > > > > > > > > or
> > > > > > > > > > > > > > stax*api - and it conflicts at some point.
> > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> |
> > > Blog
> > > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old
> > > Wordpress
> > > > > > Blog
> > > > > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > > > > https://github.com/
> > > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/
> rmannibucau>
> > |
> > > > > > > > Tomitriber
> > > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > 2016-10-17 17:18 GMT+02:00 sgjava <
> > sgjava@gmail.com
> > > >:
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > > Periodically I'm seeing "Cannot create a secure
> > > > > > > > > XMLInputFactory"
> > > > > > > > > > in
> > > > > > > > > > > > > TomEE
> > > > > > > > > > > > > > > 7.0.2-SNAPSHOT. One solution is for CXF using
> > > > > > > > > > > > > > > -Dorg.apache.cxf.stax.allowInsecureParser=1.
> > This
> > > is
> > > > > an
> > > > > > > > older
> > > > > > > > > > > 7.0.2
> > > > > > > > > > > > > from
> > > > > > > > > > > > > > > 7/4/16.
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > --
> > > > > > > > > > > > > > > View this message in context:
> > > > > > http://tomee-openejb.979440.
> > > > > > > > > > > > > > > n4.nabble.com/Cannot-create-a-
> > > > secure-XMLInputFactory-
> > > > > > > > > > > tp4680348.html
> > > > > > > > > > > > > > > Sent from the TomEE Users mailing list archive
> at
> > > > > > > Nabble.com.
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > > --
> > > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > > --
> > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > >
> > > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > --
> > > > > > > > > Steven P. Goldsmith
> > > > > > > > >
> > > > > > > >
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > > --
> > > > > > > Steven P. Goldsmith
> > > > > > >
> > > > > >
> > > > >
> > > > >
> > > > >
> > > > > --
> > > > > Steven P. Goldsmith
> > > > >
> > > >
> > >
> > >
> > >
> > > --
> > > Steven P. Goldsmith
> > >
> >
>
>
>
> --
> Steven P. Goldsmith
>
Re: Cannot create a secure XMLInputFactory
Posted by Steve Goldsmith <sg...@gmail.com>.
Do I have to exclude current CXF in TomEE dependencies or just include the
debug version I'm building?
On Tue, Oct 18, 2016 at 2:46 AM, Romain Manni-Bucau <rm...@gmail.com>
wrote:
> As mentionned in the previous answer this is not in tomee sources but CXF,
> agree it should be logged at debug level but with current code debugging is
> the fastest.
>
> Side note: you dont need to build tomee from sources, just need to add
> cxf-core.
>
>
> Romain Manni-Bucau
> @rmannibucau <https://twitter.com/rmannibucau> | Blog
> <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> <http://rmannibucau.wordpress.com> | Github <https://github.com/
> rmannibucau> |
> LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> <http://www.tomitribe.com> | JavaEE Factory
> <https://javaeefactory-rmannibucau.rhcloud.com>
>
> 2016-10-18 3:31 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
>
> > OK, I've built TomEE from source before, but I've not run it in debug
> mode.
> > Wouldn't it be just as easy to simply log vars f, p and o when I build
> the
> > source?
> >
> > On Mon, Oct 17, 2016 at 5:09 PM, Romain Manni-Bucau <
> rmannibucau@gmail.com
> > >
> > wrote:
> >
> > > cxf ones yes, that's as easy as adding cxf-core as provded dependency,
> > > putting a breakpoint on the mentionned line normally and starting tomee
> > in
> > > debug mode. Surely the most efficient way to solve it.
> > >
> > >
> > > Romain Manni-Bucau
> > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > rmannibucau> |
> > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > <http://www.tomitribe.com> | JavaEE Factory
> > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > >
> > > 2016-10-17 22:52 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > >
> > > > You mean set a breakpoint in TomEE source?
> > > >
> > > > On Mon, Oct 17, 2016 at 4:43 PM, Romain Manni-Bucau <
> > > rmannibucau@gmail.com
> > > > >
> > > > wrote:
> > > >
> > > > > If you can put a breakpoint at
> > > > > https://github.com/apache/cxf/blob/eab841d5477c5e1ed21a49918defa7
> > > > > 9a0f1ad533/core/src/main/java/org/apache/cxf/staxutils/
> > > > StaxUtils.java#L381
> > > > > then you would know immediately why the throwable is thrown.
> > > > >
> > > > >
> > > > > Romain Manni-Bucau
> > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > > > rmannibucau> |
> > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > >
> > > > > 2016-10-17 22:41 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > > >
> > > > > > OK, I made the following change and I still get the error:
> > > > > >
> > > > > > <dependency>
> > > > > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > > > > <artifactId>jaxb2-basics-runtime</artifactId>
> > > > > > <version>0.10.0</version>
> > > > > > <scope>provided</scope>
> > > > > > </dependency>
> > > > > >
> > > > > > I even tried:
> > > > > >
> > > > > > <dependency>
> > > > > > <groupId>org.apache.tomee</groupId>
> > > > > > <artifactId>tomee-jaxrs</artifactId>
> > > > > > <version>${tomee.version}</version>
> > > > > > <scope>test</scope>
> > > > > > <exclusions>
> > > > > > <exclusion>
> > > > > > <groupId>com.sun.xml.bind</groupId>
> > > > > > <artifactId>jaxb-impl</artifactId>
> > > > > > </exclusion>
> > > > > > </exclusions>
> > > > > > </dependency>
> > > > > >
> > > > > >
> > > > > > On Mon, Oct 17, 2016 at 3:37 PM, Romain Manni-Bucau <
> > > > > rmannibucau@gmail.com
> > > > > > >
> > > > > > wrote:
> > > > > >
> > > > > > > well jaxb is provided and shouldnt be delivered so you have to
> > > remove
> > > > > it
> > > > > > > from WEB-INF/lib. scope=provided should be fine too.
> > > > > > >
> > > > > > >
> > > > > > > Romain Manni-Bucau
> > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > > > <http://rmannibucau.wordpress.com> | Github <
> https://github.com/
> > > > > > > rmannibucau> |
> > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> Tomitriber
> > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > >
> > > > > > > 2016-10-17 20:07 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > > > > >
> > > > > > > > I need JAX-B runtime for code generated by jaxws-maven-plugin
> > and
> > > > > XJC.
> > > > > > > > Everything else is in test scope and not used in the deployed
> > > app.
> > > > > > > >
> > > > > > > > <dependency>
> > > > > > > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > > > > > > <artifactId>jaxb2-basics-runtime</artifactId>
> > > > > > > > <version>0.10.0</version>
> > > > > > > > </dependency>
> > > > > > > >
> > > > > > > >
> > > > > > > > On Mon, Oct 17, 2016 at 1:57 PM, Romain Manni-Bucau <
> > > > > > > rmannibucau@gmail.com
> > > > > > > > >
> > > > > > > > wrote:
> > > > > > > >
> > > > > > > > > yep so surely some part of the app running in a conflicting
> > > > > > > classloader.
> > > > > > > > > Personally I'd just remove stax2-api, woodstox and jaxb to
> > > start
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > Romain Manni-Bucau
> > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress
> Blog
> > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > https://github.com/
> > > > > > > > > rmannibucau> |
> > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > Tomitriber
> > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > >
> > > > > > > > > 2016-10-17 19:47 GMT+02:00 Steve Goldsmith <
> sgjava@gmail.com
> > >:
> > > > > > > > >
> > > > > > > > > > ~/java/apache-maven-3.3.9/bin/mvn dependency:tree |
> egrep
> > > > > > > > 'woo|xml|stax'
> > > > > > > > > > [INFO] | | +- javax.xml.bind:jaxb-api:jar:2.
> 2.6:test
> > > > > > > > > > [INFO] | | \- com.sun.xml.bind:jaxb-impl:
> > jar:2.2.6:test
> > > > > > > > > > [INFO] | | | +- org.apache.santuario:xmlsec:
> > > > > > jar:2.0.5:test
> > > > > > > > > > [INFO] | | | | | +-
> > > > > > > > > > org.opensaml:opensaml-xmlsec-api:jar:3.1.1:test
> > > > > > > > > > [INFO] | | | | +- org.opensaml:opensaml-xmlsec-
> > > > > > > > > > impl:jar:3.1.1:test
> > > > > > > > > > [INFO] | | +- org.apache.wss4j:wss4j-ws-
> > > > > > > > > security-stax:jar:2.1.4:test
> > > > > > > > > > [INFO] | | +-
> > > > > > > > > > org.apache.wss4j:wss4j-ws-security-policy-stax:jar:2.1.
> > > 4:test
> > > > > > > > > > [INFO] | | | +- xml-resolver:xml-resolver:jar:
> > 1.2:test
> > > > > > > > > > [INFO] | | | +- org.apache.cxf:cxf-rt-
> > > > > > > > bindings-xml:jar:3.1.6:test
> > > > > > > > > > [INFO] | | \- com.sun.xml.messaging.saaj:
> > > > > > > > saaj-impl:jar:1.3.18:test
> > > > > > > > > > [INFO] | | | +- org.codehaus.woodstox:
> > > > > > > > woodstox-core-asl:jar:4.4.1:
> > > > > > > > > > test
> > > > > > > > > > [INFO] | | | | \- org.codehaus.woodstox:stax2-
> > > > > > > > api:jar:3.1.4:test
> > > > > > > > > > [INFO] | | | \- org.apache.ws.xmlschema:
> > > > > > > > > > xmlschema-core:jar:2.2.1:test
> > > > > > > > > > [INFO] +-
> > > > > > > > > > com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider:
> > > > > > > jar:2.7.4:test
> > > > > > > > > > [INFO] | +- com.fasterxml.jackson.jaxrs:
> > > > > > > jackson-jaxrs-base:jar:2.7.4:
> > > > > > > > > test
> > > > > > > > > > [INFO] | +- com.fasterxml.jackson.core:
> > > > > > jackson-core:jar:2.7.4:test
> > > > > > > > > > [INFO] | +- com.fasterxml.jackson.core:
> > > > > > jackson-databind:jar:2.7.4:
> > > > > > > > test
> > > > > > > > > > [INFO] | | \-
> > > > > > > > > > com.fasterxml.jackson.core:
> jackson-annotations:jar:2.7.0:
> > > test
> > > > > > > > > > [INFO] | \-
> > > > > > > > > > com.fasterxml.jackson.module:jackson-module-jaxb-
> > > > > > > > > > annotations:jar:2.7.4:test
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > > On Mon, Oct 17, 2016 at 11:40 AM, Romain Manni-Bucau <
> > > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > > wrote:
> > > > > > > > > >
> > > > > > > > > > > mvn dependency:tree | egrep 'woo|xml|stax'
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress
> > > Blog
> > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > https://github.com/
> > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > > > Tomitriber
> > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > > >
> > > > > > > > > > > 2016-10-17 17:36 GMT+02:00 Steve Goldsmith <
> > > sgjava@gmail.com
> > > > >:
> > > > > > > > > > >
> > > > > > > > > > > > My compile dependencies are (do you see anything that
> > > > sticks
> > > > > > > out):
> > > > > > > > > > > >
> > > > > > > > > > > > <dependency>
> > > > > > > > > > > > <groupId>org.jsr107.ri</groupId>
> > > > > > > > > > > > <artifactId>cache-annotations-
> > > > > ri-cdi</artifactId>
> > > > > > > > > > > > <version>1.0.0</version>
> > > > > > > > > > > > </dependency>
> > > > > > > > > > > > <dependency>
> > > > > > > > > > > > <groupId>org.jvnet.jaxb2_
> commons</groupId>
> > > > > > > > > > > > <artifactId>jaxb2-basics-
> > > runtime</artifactId>
> > > > > > > > > > > > <version>0.10.0</version>
> > > > > > > > > > > > </dependency>
> > > > > > > > > > > > <dependency>
> > > > > > > > > > > > <groupId>org.slf4j</groupId>
> > > > > > > > > > > > <artifactId>slf4j-api</artifactId>
> > > > > > > > > > > > <version>${slf4j.version}</version>
> > > > > > > > > > > > </dependency>
> > > > > > > > > > > > <dependency>
> > > > > > > > > > > > <groupId>ch.qos.logback</groupId>
> > > > > > > > > > > > <artifactId>logback-classic</artifactId>
> > > > > > > > > > > > <version>${logback.version}</version>
> > > > > > > > > > > > </dependency>
> > > > > > > > > > > > <dependency>
> > > > > > > > > > > > <groupId>ch.qos.logback</groupId>
> > > > > > > > > > > > <artifactId>logback-core</artifactId>
> > > > > > > > > > > > <version>${logback.version}</version>
> > > > > > > > > > > > </dependency>
> > > > > > > > > > > > <dependency>
> > > > > > > > > > > > <groupId>org.apache.commons</groupId>
> > > > > > > > > > > > <artifactId>commons-pool2</artifactId>
> > > > > > > > > > > > <version>2.4.2</version>
> > > > > > > > > > > > </dependency>
> > > > > > > > > > > > <dependency>
> > > > > > > > > > > > <groupId>commons-configuration</groupId>
> > > > > > > > > > > > <artifactId>commons-
> > > configuration</artifactId>
> > > > > > > > > > > > <version>1.10</version>
> > > > > > > > > > > > </dependency>
> > > > > > > > > > > > <dependency>
> > > > > > > > > > > > <groupId>org.jasypt</groupId>
> > > > > > > > > > > > <artifactId>jasypt</artifactId>
> > > > > > > > > > > > <version>1.9.3-SNAPSHOT</version>
> > > > > > > > > > > > </dependency>
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > > On Mon, Oct 17, 2016 at 11:30 AM, Romain Manni-Bucau
> <
> > > > > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > > > > wrote:
> > > > > > > > > > > >
> > > > > > > > > > > > > Hello
> > > > > > > > > > > > >
> > > > > > > > > > > > > can happen if you provide some xml libraries in
> your
> > > app
> > > > -
> > > > > > like
> > > > > > > > > > > woodstox
> > > > > > > > > > > > or
> > > > > > > > > > > > > stax*api - and it conflicts at some point.
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> |
> > Blog
> > > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old
> > Wordpress
> > > > > Blog
> > > > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > > > https://github.com/
> > > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau>
> |
> > > > > > > Tomitriber
> > > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > > > > >
> > > > > > > > > > > > > 2016-10-17 17:18 GMT+02:00 sgjava <
> sgjava@gmail.com
> > >:
> > > > > > > > > > > > >
> > > > > > > > > > > > > > Periodically I'm seeing "Cannot create a secure
> > > > > > > > XMLInputFactory"
> > > > > > > > > in
> > > > > > > > > > > > TomEE
> > > > > > > > > > > > > > 7.0.2-SNAPSHOT. One solution is for CXF using
> > > > > > > > > > > > > > -Dorg.apache.cxf.stax.allowInsecureParser=1.
> This
> > is
> > > > an
> > > > > > > older
> > > > > > > > > > 7.0.2
> > > > > > > > > > > > from
> > > > > > > > > > > > > > 7/4/16.
> > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > --
> > > > > > > > > > > > > > View this message in context:
> > > > > http://tomee-openejb.979440.
> > > > > > > > > > > > > > n4.nabble.com/Cannot-create-a-
> > > secure-XMLInputFactory-
> > > > > > > > > > tp4680348.html
> > > > > > > > > > > > > > Sent from the TomEE Users mailing list archive at
> > > > > > Nabble.com.
> > > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > > --
> > > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > > --
> > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > >
> > > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > > --
> > > > > > > > Steven P. Goldsmith
> > > > > > > >
> > > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > > --
> > > > > > Steven P. Goldsmith
> > > > > >
> > > > >
> > > >
> > > >
> > > >
> > > > --
> > > > Steven P. Goldsmith
> > > >
> > >
> >
> >
> >
> > --
> > Steven P. Goldsmith
> >
>
--
Steven P. Goldsmith
Re: Cannot create a secure XMLInputFactory
Posted by Romain Manni-Bucau <rm...@gmail.com>.
As mentionned in the previous answer this is not in tomee sources but CXF,
agree it should be logged at debug level but with current code debugging is
the fastest.
Side note: you dont need to build tomee from sources, just need to add
cxf-core.
Romain Manni-Bucau
@rmannibucau <https://twitter.com/rmannibucau> | Blog
<https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
<http://rmannibucau.wordpress.com> | Github <https://github.com/rmannibucau> |
LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
<http://www.tomitribe.com> | JavaEE Factory
<https://javaeefactory-rmannibucau.rhcloud.com>
2016-10-18 3:31 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> OK, I've built TomEE from source before, but I've not run it in debug mode.
> Wouldn't it be just as easy to simply log vars f, p and o when I build the
> source?
>
> On Mon, Oct 17, 2016 at 5:09 PM, Romain Manni-Bucau <rmannibucau@gmail.com
> >
> wrote:
>
> > cxf ones yes, that's as easy as adding cxf-core as provded dependency,
> > putting a breakpoint on the mentionned line normally and starting tomee
> in
> > debug mode. Surely the most efficient way to solve it.
> >
> >
> > Romain Manni-Bucau
> > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > rmannibucau> |
> > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > <http://www.tomitribe.com> | JavaEE Factory
> > <https://javaeefactory-rmannibucau.rhcloud.com>
> >
> > 2016-10-17 22:52 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> >
> > > You mean set a breakpoint in TomEE source?
> > >
> > > On Mon, Oct 17, 2016 at 4:43 PM, Romain Manni-Bucau <
> > rmannibucau@gmail.com
> > > >
> > > wrote:
> > >
> > > > If you can put a breakpoint at
> > > > https://github.com/apache/cxf/blob/eab841d5477c5e1ed21a49918defa7
> > > > 9a0f1ad533/core/src/main/java/org/apache/cxf/staxutils/
> > > StaxUtils.java#L381
> > > > then you would know immediately why the throwable is thrown.
> > > >
> > > >
> > > > Romain Manni-Bucau
> > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > > rmannibucau> |
> > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > >
> > > > 2016-10-17 22:41 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > >
> > > > > OK, I made the following change and I still get the error:
> > > > >
> > > > > <dependency>
> > > > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > > > <artifactId>jaxb2-basics-runtime</artifactId>
> > > > > <version>0.10.0</version>
> > > > > <scope>provided</scope>
> > > > > </dependency>
> > > > >
> > > > > I even tried:
> > > > >
> > > > > <dependency>
> > > > > <groupId>org.apache.tomee</groupId>
> > > > > <artifactId>tomee-jaxrs</artifactId>
> > > > > <version>${tomee.version}</version>
> > > > > <scope>test</scope>
> > > > > <exclusions>
> > > > > <exclusion>
> > > > > <groupId>com.sun.xml.bind</groupId>
> > > > > <artifactId>jaxb-impl</artifactId>
> > > > > </exclusion>
> > > > > </exclusions>
> > > > > </dependency>
> > > > >
> > > > >
> > > > > On Mon, Oct 17, 2016 at 3:37 PM, Romain Manni-Bucau <
> > > > rmannibucau@gmail.com
> > > > > >
> > > > > wrote:
> > > > >
> > > > > > well jaxb is provided and shouldnt be delivered so you have to
> > remove
> > > > it
> > > > > > from WEB-INF/lib. scope=provided should be fine too.
> > > > > >
> > > > > >
> > > > > > Romain Manni-Bucau
> > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > > > > rmannibucau> |
> > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > >
> > > > > > 2016-10-17 20:07 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > > > >
> > > > > > > I need JAX-B runtime for code generated by jaxws-maven-plugin
> and
> > > > XJC.
> > > > > > > Everything else is in test scope and not used in the deployed
> > app.
> > > > > > >
> > > > > > > <dependency>
> > > > > > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > > > > > <artifactId>jaxb2-basics-runtime</artifactId>
> > > > > > > <version>0.10.0</version>
> > > > > > > </dependency>
> > > > > > >
> > > > > > >
> > > > > > > On Mon, Oct 17, 2016 at 1:57 PM, Romain Manni-Bucau <
> > > > > > rmannibucau@gmail.com
> > > > > > > >
> > > > > > > wrote:
> > > > > > >
> > > > > > > > yep so surely some part of the app running in a conflicting
> > > > > > classloader.
> > > > > > > > Personally I'd just remove stax2-api, woodstox and jaxb to
> > start
> > > > > > > >
> > > > > > > >
> > > > > > > > Romain Manni-Bucau
> > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > https://github.com/
> > > > > > > > rmannibucau> |
> > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > Tomitriber
> > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > >
> > > > > > > > 2016-10-17 19:47 GMT+02:00 Steve Goldsmith <sgjava@gmail.com
> >:
> > > > > > > >
> > > > > > > > > ~/java/apache-maven-3.3.9/bin/mvn dependency:tree | egrep
> > > > > > > 'woo|xml|stax'
> > > > > > > > > [INFO] | | +- javax.xml.bind:jaxb-api:jar:2.2.6:test
> > > > > > > > > [INFO] | | \- com.sun.xml.bind:jaxb-impl:
> jar:2.2.6:test
> > > > > > > > > [INFO] | | | +- org.apache.santuario:xmlsec:
> > > > > jar:2.0.5:test
> > > > > > > > > [INFO] | | | | | +-
> > > > > > > > > org.opensaml:opensaml-xmlsec-api:jar:3.1.1:test
> > > > > > > > > [INFO] | | | | +- org.opensaml:opensaml-xmlsec-
> > > > > > > > > impl:jar:3.1.1:test
> > > > > > > > > [INFO] | | +- org.apache.wss4j:wss4j-ws-
> > > > > > > > security-stax:jar:2.1.4:test
> > > > > > > > > [INFO] | | +-
> > > > > > > > > org.apache.wss4j:wss4j-ws-security-policy-stax:jar:2.1.
> > 4:test
> > > > > > > > > [INFO] | | | +- xml-resolver:xml-resolver:jar:
> 1.2:test
> > > > > > > > > [INFO] | | | +- org.apache.cxf:cxf-rt-
> > > > > > > bindings-xml:jar:3.1.6:test
> > > > > > > > > [INFO] | | \- com.sun.xml.messaging.saaj:
> > > > > > > saaj-impl:jar:1.3.18:test
> > > > > > > > > [INFO] | | | +- org.codehaus.woodstox:
> > > > > > > woodstox-core-asl:jar:4.4.1:
> > > > > > > > > test
> > > > > > > > > [INFO] | | | | \- org.codehaus.woodstox:stax2-
> > > > > > > api:jar:3.1.4:test
> > > > > > > > > [INFO] | | | \- org.apache.ws.xmlschema:
> > > > > > > > > xmlschema-core:jar:2.2.1:test
> > > > > > > > > [INFO] +-
> > > > > > > > > com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider:
> > > > > > jar:2.7.4:test
> > > > > > > > > [INFO] | +- com.fasterxml.jackson.jaxrs:
> > > > > > jackson-jaxrs-base:jar:2.7.4:
> > > > > > > > test
> > > > > > > > > [INFO] | +- com.fasterxml.jackson.core:
> > > > > jackson-core:jar:2.7.4:test
> > > > > > > > > [INFO] | +- com.fasterxml.jackson.core:
> > > > > jackson-databind:jar:2.7.4:
> > > > > > > test
> > > > > > > > > [INFO] | | \-
> > > > > > > > > com.fasterxml.jackson.core:jackson-annotations:jar:2.7.0:
> > test
> > > > > > > > > [INFO] | \-
> > > > > > > > > com.fasterxml.jackson.module:jackson-module-jaxb-
> > > > > > > > > annotations:jar:2.7.4:test
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > On Mon, Oct 17, 2016 at 11:40 AM, Romain Manni-Bucau <
> > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > wrote:
> > > > > > > > >
> > > > > > > > > > mvn dependency:tree | egrep 'woo|xml|stax'
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress
> > Blog
> > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > https://github.com/
> > > > > > > > > > rmannibucau> |
> > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > > Tomitriber
> > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > >
> > > > > > > > > > 2016-10-17 17:36 GMT+02:00 Steve Goldsmith <
> > sgjava@gmail.com
> > > >:
> > > > > > > > > >
> > > > > > > > > > > My compile dependencies are (do you see anything that
> > > sticks
> > > > > > out):
> > > > > > > > > > >
> > > > > > > > > > > <dependency>
> > > > > > > > > > > <groupId>org.jsr107.ri</groupId>
> > > > > > > > > > > <artifactId>cache-annotations-
> > > > ri-cdi</artifactId>
> > > > > > > > > > > <version>1.0.0</version>
> > > > > > > > > > > </dependency>
> > > > > > > > > > > <dependency>
> > > > > > > > > > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > > > > > > > > > <artifactId>jaxb2-basics-
> > runtime</artifactId>
> > > > > > > > > > > <version>0.10.0</version>
> > > > > > > > > > > </dependency>
> > > > > > > > > > > <dependency>
> > > > > > > > > > > <groupId>org.slf4j</groupId>
> > > > > > > > > > > <artifactId>slf4j-api</artifactId>
> > > > > > > > > > > <version>${slf4j.version}</version>
> > > > > > > > > > > </dependency>
> > > > > > > > > > > <dependency>
> > > > > > > > > > > <groupId>ch.qos.logback</groupId>
> > > > > > > > > > > <artifactId>logback-classic</artifactId>
> > > > > > > > > > > <version>${logback.version}</version>
> > > > > > > > > > > </dependency>
> > > > > > > > > > > <dependency>
> > > > > > > > > > > <groupId>ch.qos.logback</groupId>
> > > > > > > > > > > <artifactId>logback-core</artifactId>
> > > > > > > > > > > <version>${logback.version}</version>
> > > > > > > > > > > </dependency>
> > > > > > > > > > > <dependency>
> > > > > > > > > > > <groupId>org.apache.commons</groupId>
> > > > > > > > > > > <artifactId>commons-pool2</artifactId>
> > > > > > > > > > > <version>2.4.2</version>
> > > > > > > > > > > </dependency>
> > > > > > > > > > > <dependency>
> > > > > > > > > > > <groupId>commons-configuration</groupId>
> > > > > > > > > > > <artifactId>commons-
> > configuration</artifactId>
> > > > > > > > > > > <version>1.10</version>
> > > > > > > > > > > </dependency>
> > > > > > > > > > > <dependency>
> > > > > > > > > > > <groupId>org.jasypt</groupId>
> > > > > > > > > > > <artifactId>jasypt</artifactId>
> > > > > > > > > > > <version>1.9.3-SNAPSHOT</version>
> > > > > > > > > > > </dependency>
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > > On Mon, Oct 17, 2016 at 11:30 AM, Romain Manni-Bucau <
> > > > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > > > wrote:
> > > > > > > > > > >
> > > > > > > > > > > > Hello
> > > > > > > > > > > >
> > > > > > > > > > > > can happen if you provide some xml libraries in your
> > app
> > > -
> > > > > like
> > > > > > > > > > woodstox
> > > > > > > > > > > or
> > > > > > > > > > > > stax*api - and it conflicts at some point.
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> |
> Blog
> > > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old
> Wordpress
> > > > Blog
> > > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > > https://github.com/
> > > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > > > > Tomitriber
> > > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > > > >
> > > > > > > > > > > > 2016-10-17 17:18 GMT+02:00 sgjava <sgjava@gmail.com
> >:
> > > > > > > > > > > >
> > > > > > > > > > > > > Periodically I'm seeing "Cannot create a secure
> > > > > > > XMLInputFactory"
> > > > > > > > in
> > > > > > > > > > > TomEE
> > > > > > > > > > > > > 7.0.2-SNAPSHOT. One solution is for CXF using
> > > > > > > > > > > > > -Dorg.apache.cxf.stax.allowInsecureParser=1. This
> is
> > > an
> > > > > > older
> > > > > > > > > 7.0.2
> > > > > > > > > > > from
> > > > > > > > > > > > > 7/4/16.
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > > --
> > > > > > > > > > > > > View this message in context:
> > > > http://tomee-openejb.979440.
> > > > > > > > > > > > > n4.nabble.com/Cannot-create-a-
> > secure-XMLInputFactory-
> > > > > > > > > tp4680348.html
> > > > > > > > > > > > > Sent from the TomEE Users mailing list archive at
> > > > > Nabble.com.
> > > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > > --
> > > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > > >
> > > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > --
> > > > > > > > > Steven P. Goldsmith
> > > > > > > > >
> > > > > > > >
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > > --
> > > > > > > Steven P. Goldsmith
> > > > > > >
> > > > > >
> > > > >
> > > > >
> > > > >
> > > > > --
> > > > > Steven P. Goldsmith
> > > > >
> > > >
> > >
> > >
> > >
> > > --
> > > Steven P. Goldsmith
> > >
> >
>
>
>
> --
> Steven P. Goldsmith
>
Re: Cannot create a secure XMLInputFactory
Posted by Steve Goldsmith <sg...@gmail.com>.
OK, I've built TomEE from source before, but I've not run it in debug mode.
Wouldn't it be just as easy to simply log vars f, p and o when I build the
source?
On Mon, Oct 17, 2016 at 5:09 PM, Romain Manni-Bucau <rm...@gmail.com>
wrote:
> cxf ones yes, that's as easy as adding cxf-core as provded dependency,
> putting a breakpoint on the mentionned line normally and starting tomee in
> debug mode. Surely the most efficient way to solve it.
>
>
> Romain Manni-Bucau
> @rmannibucau <https://twitter.com/rmannibucau> | Blog
> <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> <http://rmannibucau.wordpress.com> | Github <https://github.com/
> rmannibucau> |
> LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> <http://www.tomitribe.com> | JavaEE Factory
> <https://javaeefactory-rmannibucau.rhcloud.com>
>
> 2016-10-17 22:52 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
>
> > You mean set a breakpoint in TomEE source?
> >
> > On Mon, Oct 17, 2016 at 4:43 PM, Romain Manni-Bucau <
> rmannibucau@gmail.com
> > >
> > wrote:
> >
> > > If you can put a breakpoint at
> > > https://github.com/apache/cxf/blob/eab841d5477c5e1ed21a49918defa7
> > > 9a0f1ad533/core/src/main/java/org/apache/cxf/staxutils/
> > StaxUtils.java#L381
> > > then you would know immediately why the throwable is thrown.
> > >
> > >
> > > Romain Manni-Bucau
> > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > rmannibucau> |
> > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > <http://www.tomitribe.com> | JavaEE Factory
> > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > >
> > > 2016-10-17 22:41 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > >
> > > > OK, I made the following change and I still get the error:
> > > >
> > > > <dependency>
> > > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > > <artifactId>jaxb2-basics-runtime</artifactId>
> > > > <version>0.10.0</version>
> > > > <scope>provided</scope>
> > > > </dependency>
> > > >
> > > > I even tried:
> > > >
> > > > <dependency>
> > > > <groupId>org.apache.tomee</groupId>
> > > > <artifactId>tomee-jaxrs</artifactId>
> > > > <version>${tomee.version}</version>
> > > > <scope>test</scope>
> > > > <exclusions>
> > > > <exclusion>
> > > > <groupId>com.sun.xml.bind</groupId>
> > > > <artifactId>jaxb-impl</artifactId>
> > > > </exclusion>
> > > > </exclusions>
> > > > </dependency>
> > > >
> > > >
> > > > On Mon, Oct 17, 2016 at 3:37 PM, Romain Manni-Bucau <
> > > rmannibucau@gmail.com
> > > > >
> > > > wrote:
> > > >
> > > > > well jaxb is provided and shouldnt be delivered so you have to
> remove
> > > it
> > > > > from WEB-INF/lib. scope=provided should be fine too.
> > > > >
> > > > >
> > > > > Romain Manni-Bucau
> > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > > > rmannibucau> |
> > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > >
> > > > > 2016-10-17 20:07 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > > >
> > > > > > I need JAX-B runtime for code generated by jaxws-maven-plugin and
> > > XJC.
> > > > > > Everything else is in test scope and not used in the deployed
> app.
> > > > > >
> > > > > > <dependency>
> > > > > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > > > > <artifactId>jaxb2-basics-runtime</artifactId>
> > > > > > <version>0.10.0</version>
> > > > > > </dependency>
> > > > > >
> > > > > >
> > > > > > On Mon, Oct 17, 2016 at 1:57 PM, Romain Manni-Bucau <
> > > > > rmannibucau@gmail.com
> > > > > > >
> > > > > > wrote:
> > > > > >
> > > > > > > yep so surely some part of the app running in a conflicting
> > > > > classloader.
> > > > > > > Personally I'd just remove stax2-api, woodstox and jaxb to
> start
> > > > > > >
> > > > > > >
> > > > > > > Romain Manni-Bucau
> > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > > > <http://rmannibucau.wordpress.com> | Github <
> https://github.com/
> > > > > > > rmannibucau> |
> > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> Tomitriber
> > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > >
> > > > > > > 2016-10-17 19:47 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > > > > >
> > > > > > > > ~/java/apache-maven-3.3.9/bin/mvn dependency:tree | egrep
> > > > > > 'woo|xml|stax'
> > > > > > > > [INFO] | | +- javax.xml.bind:jaxb-api:jar:2.2.6:test
> > > > > > > > [INFO] | | \- com.sun.xml.bind:jaxb-impl:jar:2.2.6:test
> > > > > > > > [INFO] | | | +- org.apache.santuario:xmlsec:
> > > > jar:2.0.5:test
> > > > > > > > [INFO] | | | | | +-
> > > > > > > > org.opensaml:opensaml-xmlsec-api:jar:3.1.1:test
> > > > > > > > [INFO] | | | | +- org.opensaml:opensaml-xmlsec-
> > > > > > > > impl:jar:3.1.1:test
> > > > > > > > [INFO] | | +- org.apache.wss4j:wss4j-ws-
> > > > > > > security-stax:jar:2.1.4:test
> > > > > > > > [INFO] | | +-
> > > > > > > > org.apache.wss4j:wss4j-ws-security-policy-stax:jar:2.1.
> 4:test
> > > > > > > > [INFO] | | | +- xml-resolver:xml-resolver:jar:1.2:test
> > > > > > > > [INFO] | | | +- org.apache.cxf:cxf-rt-
> > > > > > bindings-xml:jar:3.1.6:test
> > > > > > > > [INFO] | | \- com.sun.xml.messaging.saaj:
> > > > > > saaj-impl:jar:1.3.18:test
> > > > > > > > [INFO] | | | +- org.codehaus.woodstox:
> > > > > > woodstox-core-asl:jar:4.4.1:
> > > > > > > > test
> > > > > > > > [INFO] | | | | \- org.codehaus.woodstox:stax2-
> > > > > > api:jar:3.1.4:test
> > > > > > > > [INFO] | | | \- org.apache.ws.xmlschema:
> > > > > > > > xmlschema-core:jar:2.2.1:test
> > > > > > > > [INFO] +-
> > > > > > > > com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider:
> > > > > jar:2.7.4:test
> > > > > > > > [INFO] | +- com.fasterxml.jackson.jaxrs:
> > > > > jackson-jaxrs-base:jar:2.7.4:
> > > > > > > test
> > > > > > > > [INFO] | +- com.fasterxml.jackson.core:
> > > > jackson-core:jar:2.7.4:test
> > > > > > > > [INFO] | +- com.fasterxml.jackson.core:
> > > > jackson-databind:jar:2.7.4:
> > > > > > test
> > > > > > > > [INFO] | | \-
> > > > > > > > com.fasterxml.jackson.core:jackson-annotations:jar:2.7.0:
> test
> > > > > > > > [INFO] | \-
> > > > > > > > com.fasterxml.jackson.module:jackson-module-jaxb-
> > > > > > > > annotations:jar:2.7.4:test
> > > > > > > >
> > > > > > > >
> > > > > > > > On Mon, Oct 17, 2016 at 11:40 AM, Romain Manni-Bucau <
> > > > > > > > rmannibucau@gmail.com>
> > > > > > > > wrote:
> > > > > > > >
> > > > > > > > > mvn dependency:tree | egrep 'woo|xml|stax'
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > Romain Manni-Bucau
> > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress
> Blog
> > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > https://github.com/
> > > > > > > > > rmannibucau> |
> > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > Tomitriber
> > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > >
> > > > > > > > > 2016-10-17 17:36 GMT+02:00 Steve Goldsmith <
> sgjava@gmail.com
> > >:
> > > > > > > > >
> > > > > > > > > > My compile dependencies are (do you see anything that
> > sticks
> > > > > out):
> > > > > > > > > >
> > > > > > > > > > <dependency>
> > > > > > > > > > <groupId>org.jsr107.ri</groupId>
> > > > > > > > > > <artifactId>cache-annotations-
> > > ri-cdi</artifactId>
> > > > > > > > > > <version>1.0.0</version>
> > > > > > > > > > </dependency>
> > > > > > > > > > <dependency>
> > > > > > > > > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > > > > > > > > <artifactId>jaxb2-basics-
> runtime</artifactId>
> > > > > > > > > > <version>0.10.0</version>
> > > > > > > > > > </dependency>
> > > > > > > > > > <dependency>
> > > > > > > > > > <groupId>org.slf4j</groupId>
> > > > > > > > > > <artifactId>slf4j-api</artifactId>
> > > > > > > > > > <version>${slf4j.version}</version>
> > > > > > > > > > </dependency>
> > > > > > > > > > <dependency>
> > > > > > > > > > <groupId>ch.qos.logback</groupId>
> > > > > > > > > > <artifactId>logback-classic</artifactId>
> > > > > > > > > > <version>${logback.version}</version>
> > > > > > > > > > </dependency>
> > > > > > > > > > <dependency>
> > > > > > > > > > <groupId>ch.qos.logback</groupId>
> > > > > > > > > > <artifactId>logback-core</artifactId>
> > > > > > > > > > <version>${logback.version}</version>
> > > > > > > > > > </dependency>
> > > > > > > > > > <dependency>
> > > > > > > > > > <groupId>org.apache.commons</groupId>
> > > > > > > > > > <artifactId>commons-pool2</artifactId>
> > > > > > > > > > <version>2.4.2</version>
> > > > > > > > > > </dependency>
> > > > > > > > > > <dependency>
> > > > > > > > > > <groupId>commons-configuration</groupId>
> > > > > > > > > > <artifactId>commons-
> configuration</artifactId>
> > > > > > > > > > <version>1.10</version>
> > > > > > > > > > </dependency>
> > > > > > > > > > <dependency>
> > > > > > > > > > <groupId>org.jasypt</groupId>
> > > > > > > > > > <artifactId>jasypt</artifactId>
> > > > > > > > > > <version>1.9.3-SNAPSHOT</version>
> > > > > > > > > > </dependency>
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > > On Mon, Oct 17, 2016 at 11:30 AM, Romain Manni-Bucau <
> > > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > > wrote:
> > > > > > > > > >
> > > > > > > > > > > Hello
> > > > > > > > > > >
> > > > > > > > > > > can happen if you provide some xml libraries in your
> app
> > -
> > > > like
> > > > > > > > > woodstox
> > > > > > > > > > or
> > > > > > > > > > > stax*api - and it conflicts at some point.
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress
> > > Blog
> > > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > > https://github.com/
> > > > > > > > > > > rmannibucau> |
> > > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > > > Tomitriber
> > > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > > >
> > > > > > > > > > > 2016-10-17 17:18 GMT+02:00 sgjava <sg...@gmail.com>:
> > > > > > > > > > >
> > > > > > > > > > > > Periodically I'm seeing "Cannot create a secure
> > > > > > XMLInputFactory"
> > > > > > > in
> > > > > > > > > > TomEE
> > > > > > > > > > > > 7.0.2-SNAPSHOT. One solution is for CXF using
> > > > > > > > > > > > -Dorg.apache.cxf.stax.allowInsecureParser=1. This is
> > an
> > > > > older
> > > > > > > > 7.0.2
> > > > > > > > > > from
> > > > > > > > > > > > 7/4/16.
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > > --
> > > > > > > > > > > > View this message in context:
> > > http://tomee-openejb.979440.
> > > > > > > > > > > > n4.nabble.com/Cannot-create-a-
> secure-XMLInputFactory-
> > > > > > > > tp4680348.html
> > > > > > > > > > > > Sent from the TomEE Users mailing list archive at
> > > > Nabble.com.
> > > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > > --
> > > > > > > > > > Steven P. Goldsmith
> > > > > > > > > >
> > > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > > --
> > > > > > > > Steven P. Goldsmith
> > > > > > > >
> > > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > > --
> > > > > > Steven P. Goldsmith
> > > > > >
> > > > >
> > > >
> > > >
> > > >
> > > > --
> > > > Steven P. Goldsmith
> > > >
> > >
> >
> >
> >
> > --
> > Steven P. Goldsmith
> >
>
--
Steven P. Goldsmith
Re: Cannot create a secure XMLInputFactory
Posted by Romain Manni-Bucau <rm...@gmail.com>.
cxf ones yes, that's as easy as adding cxf-core as provded dependency,
putting a breakpoint on the mentionned line normally and starting tomee in
debug mode. Surely the most efficient way to solve it.
Romain Manni-Bucau
@rmannibucau <https://twitter.com/rmannibucau> | Blog
<https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
<http://rmannibucau.wordpress.com> | Github <https://github.com/rmannibucau> |
LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
<http://www.tomitribe.com> | JavaEE Factory
<https://javaeefactory-rmannibucau.rhcloud.com>
2016-10-17 22:52 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> You mean set a breakpoint in TomEE source?
>
> On Mon, Oct 17, 2016 at 4:43 PM, Romain Manni-Bucau <rmannibucau@gmail.com
> >
> wrote:
>
> > If you can put a breakpoint at
> > https://github.com/apache/cxf/blob/eab841d5477c5e1ed21a49918defa7
> > 9a0f1ad533/core/src/main/java/org/apache/cxf/staxutils/
> StaxUtils.java#L381
> > then you would know immediately why the throwable is thrown.
> >
> >
> > Romain Manni-Bucau
> > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > rmannibucau> |
> > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > <http://www.tomitribe.com> | JavaEE Factory
> > <https://javaeefactory-rmannibucau.rhcloud.com>
> >
> > 2016-10-17 22:41 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> >
> > > OK, I made the following change and I still get the error:
> > >
> > > <dependency>
> > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > <artifactId>jaxb2-basics-runtime</artifactId>
> > > <version>0.10.0</version>
> > > <scope>provided</scope>
> > > </dependency>
> > >
> > > I even tried:
> > >
> > > <dependency>
> > > <groupId>org.apache.tomee</groupId>
> > > <artifactId>tomee-jaxrs</artifactId>
> > > <version>${tomee.version}</version>
> > > <scope>test</scope>
> > > <exclusions>
> > > <exclusion>
> > > <groupId>com.sun.xml.bind</groupId>
> > > <artifactId>jaxb-impl</artifactId>
> > > </exclusion>
> > > </exclusions>
> > > </dependency>
> > >
> > >
> > > On Mon, Oct 17, 2016 at 3:37 PM, Romain Manni-Bucau <
> > rmannibucau@gmail.com
> > > >
> > > wrote:
> > >
> > > > well jaxb is provided and shouldnt be delivered so you have to remove
> > it
> > > > from WEB-INF/lib. scope=provided should be fine too.
> > > >
> > > >
> > > > Romain Manni-Bucau
> > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > > rmannibucau> |
> > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > >
> > > > 2016-10-17 20:07 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > >
> > > > > I need JAX-B runtime for code generated by jaxws-maven-plugin and
> > XJC.
> > > > > Everything else is in test scope and not used in the deployed app.
> > > > >
> > > > > <dependency>
> > > > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > > > <artifactId>jaxb2-basics-runtime</artifactId>
> > > > > <version>0.10.0</version>
> > > > > </dependency>
> > > > >
> > > > >
> > > > > On Mon, Oct 17, 2016 at 1:57 PM, Romain Manni-Bucau <
> > > > rmannibucau@gmail.com
> > > > > >
> > > > > wrote:
> > > > >
> > > > > > yep so surely some part of the app running in a conflicting
> > > > classloader.
> > > > > > Personally I'd just remove stax2-api, woodstox and jaxb to start
> > > > > >
> > > > > >
> > > > > > Romain Manni-Bucau
> > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > > > > rmannibucau> |
> > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > >
> > > > > > 2016-10-17 19:47 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > > > >
> > > > > > > ~/java/apache-maven-3.3.9/bin/mvn dependency:tree | egrep
> > > > > 'woo|xml|stax'
> > > > > > > [INFO] | | +- javax.xml.bind:jaxb-api:jar:2.2.6:test
> > > > > > > [INFO] | | \- com.sun.xml.bind:jaxb-impl:jar:2.2.6:test
> > > > > > > [INFO] | | | +- org.apache.santuario:xmlsec:
> > > jar:2.0.5:test
> > > > > > > [INFO] | | | | | +-
> > > > > > > org.opensaml:opensaml-xmlsec-api:jar:3.1.1:test
> > > > > > > [INFO] | | | | +- org.opensaml:opensaml-xmlsec-
> > > > > > > impl:jar:3.1.1:test
> > > > > > > [INFO] | | +- org.apache.wss4j:wss4j-ws-
> > > > > > security-stax:jar:2.1.4:test
> > > > > > > [INFO] | | +-
> > > > > > > org.apache.wss4j:wss4j-ws-security-policy-stax:jar:2.1.4:test
> > > > > > > [INFO] | | | +- xml-resolver:xml-resolver:jar:1.2:test
> > > > > > > [INFO] | | | +- org.apache.cxf:cxf-rt-
> > > > > bindings-xml:jar:3.1.6:test
> > > > > > > [INFO] | | \- com.sun.xml.messaging.saaj:
> > > > > saaj-impl:jar:1.3.18:test
> > > > > > > [INFO] | | | +- org.codehaus.woodstox:
> > > > > woodstox-core-asl:jar:4.4.1:
> > > > > > > test
> > > > > > > [INFO] | | | | \- org.codehaus.woodstox:stax2-
> > > > > api:jar:3.1.4:test
> > > > > > > [INFO] | | | \- org.apache.ws.xmlschema:
> > > > > > > xmlschema-core:jar:2.2.1:test
> > > > > > > [INFO] +-
> > > > > > > com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider:
> > > > jar:2.7.4:test
> > > > > > > [INFO] | +- com.fasterxml.jackson.jaxrs:
> > > > jackson-jaxrs-base:jar:2.7.4:
> > > > > > test
> > > > > > > [INFO] | +- com.fasterxml.jackson.core:
> > > jackson-core:jar:2.7.4:test
> > > > > > > [INFO] | +- com.fasterxml.jackson.core:
> > > jackson-databind:jar:2.7.4:
> > > > > test
> > > > > > > [INFO] | | \-
> > > > > > > com.fasterxml.jackson.core:jackson-annotations:jar:2.7.0:test
> > > > > > > [INFO] | \-
> > > > > > > com.fasterxml.jackson.module:jackson-module-jaxb-
> > > > > > > annotations:jar:2.7.4:test
> > > > > > >
> > > > > > >
> > > > > > > On Mon, Oct 17, 2016 at 11:40 AM, Romain Manni-Bucau <
> > > > > > > rmannibucau@gmail.com>
> > > > > > > wrote:
> > > > > > >
> > > > > > > > mvn dependency:tree | egrep 'woo|xml|stax'
> > > > > > > >
> > > > > > > >
> > > > > > > > Romain Manni-Bucau
> > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > https://github.com/
> > > > > > > > rmannibucau> |
> > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > Tomitriber
> > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > >
> > > > > > > > 2016-10-17 17:36 GMT+02:00 Steve Goldsmith <sgjava@gmail.com
> >:
> > > > > > > >
> > > > > > > > > My compile dependencies are (do you see anything that
> sticks
> > > > out):
> > > > > > > > >
> > > > > > > > > <dependency>
> > > > > > > > > <groupId>org.jsr107.ri</groupId>
> > > > > > > > > <artifactId>cache-annotations-
> > ri-cdi</artifactId>
> > > > > > > > > <version>1.0.0</version>
> > > > > > > > > </dependency>
> > > > > > > > > <dependency>
> > > > > > > > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > > > > > > > <artifactId>jaxb2-basics-runtime</artifactId>
> > > > > > > > > <version>0.10.0</version>
> > > > > > > > > </dependency>
> > > > > > > > > <dependency>
> > > > > > > > > <groupId>org.slf4j</groupId>
> > > > > > > > > <artifactId>slf4j-api</artifactId>
> > > > > > > > > <version>${slf4j.version}</version>
> > > > > > > > > </dependency>
> > > > > > > > > <dependency>
> > > > > > > > > <groupId>ch.qos.logback</groupId>
> > > > > > > > > <artifactId>logback-classic</artifactId>
> > > > > > > > > <version>${logback.version}</version>
> > > > > > > > > </dependency>
> > > > > > > > > <dependency>
> > > > > > > > > <groupId>ch.qos.logback</groupId>
> > > > > > > > > <artifactId>logback-core</artifactId>
> > > > > > > > > <version>${logback.version}</version>
> > > > > > > > > </dependency>
> > > > > > > > > <dependency>
> > > > > > > > > <groupId>org.apache.commons</groupId>
> > > > > > > > > <artifactId>commons-pool2</artifactId>
> > > > > > > > > <version>2.4.2</version>
> > > > > > > > > </dependency>
> > > > > > > > > <dependency>
> > > > > > > > > <groupId>commons-configuration</groupId>
> > > > > > > > > <artifactId>commons-configuration</artifactId>
> > > > > > > > > <version>1.10</version>
> > > > > > > > > </dependency>
> > > > > > > > > <dependency>
> > > > > > > > > <groupId>org.jasypt</groupId>
> > > > > > > > > <artifactId>jasypt</artifactId>
> > > > > > > > > <version>1.9.3-SNAPSHOT</version>
> > > > > > > > > </dependency>
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > On Mon, Oct 17, 2016 at 11:30 AM, Romain Manni-Bucau <
> > > > > > > > > rmannibucau@gmail.com>
> > > > > > > > > wrote:
> > > > > > > > >
> > > > > > > > > > Hello
> > > > > > > > > >
> > > > > > > > > > can happen if you provide some xml libraries in your app
> -
> > > like
> > > > > > > > woodstox
> > > > > > > > > or
> > > > > > > > > > stax*api - and it conflicts at some point.
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > > Romain Manni-Bucau
> > > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress
> > Blog
> > > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > > https://github.com/
> > > > > > > > > > rmannibucau> |
> > > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > > Tomitriber
> > > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > > >
> > > > > > > > > > 2016-10-17 17:18 GMT+02:00 sgjava <sg...@gmail.com>:
> > > > > > > > > >
> > > > > > > > > > > Periodically I'm seeing "Cannot create a secure
> > > > > XMLInputFactory"
> > > > > > in
> > > > > > > > > TomEE
> > > > > > > > > > > 7.0.2-SNAPSHOT. One solution is for CXF using
> > > > > > > > > > > -Dorg.apache.cxf.stax.allowInsecureParser=1. This is
> an
> > > > older
> > > > > > > 7.0.2
> > > > > > > > > from
> > > > > > > > > > > 7/4/16.
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > > --
> > > > > > > > > > > View this message in context:
> > http://tomee-openejb.979440.
> > > > > > > > > > > n4.nabble.com/Cannot-create-a-secure-XMLInputFactory-
> > > > > > > tp4680348.html
> > > > > > > > > > > Sent from the TomEE Users mailing list archive at
> > > Nabble.com.
> > > > > > > > > > >
> > > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > --
> > > > > > > > > Steven P. Goldsmith
> > > > > > > > >
> > > > > > > >
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > > --
> > > > > > > Steven P. Goldsmith
> > > > > > >
> > > > > >
> > > > >
> > > > >
> > > > >
> > > > > --
> > > > > Steven P. Goldsmith
> > > > >
> > > >
> > >
> > >
> > >
> > > --
> > > Steven P. Goldsmith
> > >
> >
>
>
>
> --
> Steven P. Goldsmith
>
Re: Cannot create a secure XMLInputFactory
Posted by Steve Goldsmith <sg...@gmail.com>.
You mean set a breakpoint in TomEE source?
On Mon, Oct 17, 2016 at 4:43 PM, Romain Manni-Bucau <rm...@gmail.com>
wrote:
> If you can put a breakpoint at
> https://github.com/apache/cxf/blob/eab841d5477c5e1ed21a49918defa7
> 9a0f1ad533/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java#L381
> then you would know immediately why the throwable is thrown.
>
>
> Romain Manni-Bucau
> @rmannibucau <https://twitter.com/rmannibucau> | Blog
> <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> <http://rmannibucau.wordpress.com> | Github <https://github.com/
> rmannibucau> |
> LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> <http://www.tomitribe.com> | JavaEE Factory
> <https://javaeefactory-rmannibucau.rhcloud.com>
>
> 2016-10-17 22:41 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
>
> > OK, I made the following change and I still get the error:
> >
> > <dependency>
> > <groupId>org.jvnet.jaxb2_commons</groupId>
> > <artifactId>jaxb2-basics-runtime</artifactId>
> > <version>0.10.0</version>
> > <scope>provided</scope>
> > </dependency>
> >
> > I even tried:
> >
> > <dependency>
> > <groupId>org.apache.tomee</groupId>
> > <artifactId>tomee-jaxrs</artifactId>
> > <version>${tomee.version}</version>
> > <scope>test</scope>
> > <exclusions>
> > <exclusion>
> > <groupId>com.sun.xml.bind</groupId>
> > <artifactId>jaxb-impl</artifactId>
> > </exclusion>
> > </exclusions>
> > </dependency>
> >
> >
> > On Mon, Oct 17, 2016 at 3:37 PM, Romain Manni-Bucau <
> rmannibucau@gmail.com
> > >
> > wrote:
> >
> > > well jaxb is provided and shouldnt be delivered so you have to remove
> it
> > > from WEB-INF/lib. scope=provided should be fine too.
> > >
> > >
> > > Romain Manni-Bucau
> > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > rmannibucau> |
> > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > <http://www.tomitribe.com> | JavaEE Factory
> > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > >
> > > 2016-10-17 20:07 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > >
> > > > I need JAX-B runtime for code generated by jaxws-maven-plugin and
> XJC.
> > > > Everything else is in test scope and not used in the deployed app.
> > > >
> > > > <dependency>
> > > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > > <artifactId>jaxb2-basics-runtime</artifactId>
> > > > <version>0.10.0</version>
> > > > </dependency>
> > > >
> > > >
> > > > On Mon, Oct 17, 2016 at 1:57 PM, Romain Manni-Bucau <
> > > rmannibucau@gmail.com
> > > > >
> > > > wrote:
> > > >
> > > > > yep so surely some part of the app running in a conflicting
> > > classloader.
> > > > > Personally I'd just remove stax2-api, woodstox and jaxb to start
> > > > >
> > > > >
> > > > > Romain Manni-Bucau
> > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > > > rmannibucau> |
> > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > >
> > > > > 2016-10-17 19:47 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > > >
> > > > > > ~/java/apache-maven-3.3.9/bin/mvn dependency:tree | egrep
> > > > 'woo|xml|stax'
> > > > > > [INFO] | | +- javax.xml.bind:jaxb-api:jar:2.2.6:test
> > > > > > [INFO] | | \- com.sun.xml.bind:jaxb-impl:jar:2.2.6:test
> > > > > > [INFO] | | | +- org.apache.santuario:xmlsec:
> > jar:2.0.5:test
> > > > > > [INFO] | | | | | +-
> > > > > > org.opensaml:opensaml-xmlsec-api:jar:3.1.1:test
> > > > > > [INFO] | | | | +- org.opensaml:opensaml-xmlsec-
> > > > > > impl:jar:3.1.1:test
> > > > > > [INFO] | | +- org.apache.wss4j:wss4j-ws-
> > > > > security-stax:jar:2.1.4:test
> > > > > > [INFO] | | +-
> > > > > > org.apache.wss4j:wss4j-ws-security-policy-stax:jar:2.1.4:test
> > > > > > [INFO] | | | +- xml-resolver:xml-resolver:jar:1.2:test
> > > > > > [INFO] | | | +- org.apache.cxf:cxf-rt-
> > > > bindings-xml:jar:3.1.6:test
> > > > > > [INFO] | | \- com.sun.xml.messaging.saaj:
> > > > saaj-impl:jar:1.3.18:test
> > > > > > [INFO] | | | +- org.codehaus.woodstox:
> > > > woodstox-core-asl:jar:4.4.1:
> > > > > > test
> > > > > > [INFO] | | | | \- org.codehaus.woodstox:stax2-
> > > > api:jar:3.1.4:test
> > > > > > [INFO] | | | \- org.apache.ws.xmlschema:
> > > > > > xmlschema-core:jar:2.2.1:test
> > > > > > [INFO] +-
> > > > > > com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider:
> > > jar:2.7.4:test
> > > > > > [INFO] | +- com.fasterxml.jackson.jaxrs:
> > > jackson-jaxrs-base:jar:2.7.4:
> > > > > test
> > > > > > [INFO] | +- com.fasterxml.jackson.core:
> > jackson-core:jar:2.7.4:test
> > > > > > [INFO] | +- com.fasterxml.jackson.core:
> > jackson-databind:jar:2.7.4:
> > > > test
> > > > > > [INFO] | | \-
> > > > > > com.fasterxml.jackson.core:jackson-annotations:jar:2.7.0:test
> > > > > > [INFO] | \-
> > > > > > com.fasterxml.jackson.module:jackson-module-jaxb-
> > > > > > annotations:jar:2.7.4:test
> > > > > >
> > > > > >
> > > > > > On Mon, Oct 17, 2016 at 11:40 AM, Romain Manni-Bucau <
> > > > > > rmannibucau@gmail.com>
> > > > > > wrote:
> > > > > >
> > > > > > > mvn dependency:tree | egrep 'woo|xml|stax'
> > > > > > >
> > > > > > >
> > > > > > > Romain Manni-Bucau
> > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > > > <http://rmannibucau.wordpress.com> | Github <
> https://github.com/
> > > > > > > rmannibucau> |
> > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> Tomitriber
> > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > >
> > > > > > > 2016-10-17 17:36 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > > > > >
> > > > > > > > My compile dependencies are (do you see anything that sticks
> > > out):
> > > > > > > >
> > > > > > > > <dependency>
> > > > > > > > <groupId>org.jsr107.ri</groupId>
> > > > > > > > <artifactId>cache-annotations-
> ri-cdi</artifactId>
> > > > > > > > <version>1.0.0</version>
> > > > > > > > </dependency>
> > > > > > > > <dependency>
> > > > > > > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > > > > > > <artifactId>jaxb2-basics-runtime</artifactId>
> > > > > > > > <version>0.10.0</version>
> > > > > > > > </dependency>
> > > > > > > > <dependency>
> > > > > > > > <groupId>org.slf4j</groupId>
> > > > > > > > <artifactId>slf4j-api</artifactId>
> > > > > > > > <version>${slf4j.version}</version>
> > > > > > > > </dependency>
> > > > > > > > <dependency>
> > > > > > > > <groupId>ch.qos.logback</groupId>
> > > > > > > > <artifactId>logback-classic</artifactId>
> > > > > > > > <version>${logback.version}</version>
> > > > > > > > </dependency>
> > > > > > > > <dependency>
> > > > > > > > <groupId>ch.qos.logback</groupId>
> > > > > > > > <artifactId>logback-core</artifactId>
> > > > > > > > <version>${logback.version}</version>
> > > > > > > > </dependency>
> > > > > > > > <dependency>
> > > > > > > > <groupId>org.apache.commons</groupId>
> > > > > > > > <artifactId>commons-pool2</artifactId>
> > > > > > > > <version>2.4.2</version>
> > > > > > > > </dependency>
> > > > > > > > <dependency>
> > > > > > > > <groupId>commons-configuration</groupId>
> > > > > > > > <artifactId>commons-configuration</artifactId>
> > > > > > > > <version>1.10</version>
> > > > > > > > </dependency>
> > > > > > > > <dependency>
> > > > > > > > <groupId>org.jasypt</groupId>
> > > > > > > > <artifactId>jasypt</artifactId>
> > > > > > > > <version>1.9.3-SNAPSHOT</version>
> > > > > > > > </dependency>
> > > > > > > >
> > > > > > > >
> > > > > > > > On Mon, Oct 17, 2016 at 11:30 AM, Romain Manni-Bucau <
> > > > > > > > rmannibucau@gmail.com>
> > > > > > > > wrote:
> > > > > > > >
> > > > > > > > > Hello
> > > > > > > > >
> > > > > > > > > can happen if you provide some xml libraries in your app -
> > like
> > > > > > > woodstox
> > > > > > > > or
> > > > > > > > > stax*api - and it conflicts at some point.
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > Romain Manni-Bucau
> > > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress
> Blog
> > > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > > https://github.com/
> > > > > > > > > rmannibucau> |
> > > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > > Tomitriber
> > > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > > >
> > > > > > > > > 2016-10-17 17:18 GMT+02:00 sgjava <sg...@gmail.com>:
> > > > > > > > >
> > > > > > > > > > Periodically I'm seeing "Cannot create a secure
> > > > XMLInputFactory"
> > > > > in
> > > > > > > > TomEE
> > > > > > > > > > 7.0.2-SNAPSHOT. One solution is for CXF using
> > > > > > > > > > -Dorg.apache.cxf.stax.allowInsecureParser=1. This is an
> > > older
> > > > > > 7.0.2
> > > > > > > > from
> > > > > > > > > > 7/4/16.
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > > --
> > > > > > > > > > View this message in context:
> http://tomee-openejb.979440.
> > > > > > > > > > n4.nabble.com/Cannot-create-a-secure-XMLInputFactory-
> > > > > > tp4680348.html
> > > > > > > > > > Sent from the TomEE Users mailing list archive at
> > Nabble.com.
> > > > > > > > > >
> > > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > > --
> > > > > > > > Steven P. Goldsmith
> > > > > > > >
> > > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > > --
> > > > > > Steven P. Goldsmith
> > > > > >
> > > > >
> > > >
> > > >
> > > >
> > > > --
> > > > Steven P. Goldsmith
> > > >
> > >
> >
> >
> >
> > --
> > Steven P. Goldsmith
> >
>
--
Steven P. Goldsmith
Re: Cannot create a secure XMLInputFactory
Posted by Romain Manni-Bucau <rm...@gmail.com>.
If you can put a breakpoint at
https://github.com/apache/cxf/blob/eab841d5477c5e1ed21a49918defa79a0f1ad533/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java#L381
then you would know immediately why the throwable is thrown.
Romain Manni-Bucau
@rmannibucau <https://twitter.com/rmannibucau> | Blog
<https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
<http://rmannibucau.wordpress.com> | Github <https://github.com/rmannibucau> |
LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
<http://www.tomitribe.com> | JavaEE Factory
<https://javaeefactory-rmannibucau.rhcloud.com>
2016-10-17 22:41 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> OK, I made the following change and I still get the error:
>
> <dependency>
> <groupId>org.jvnet.jaxb2_commons</groupId>
> <artifactId>jaxb2-basics-runtime</artifactId>
> <version>0.10.0</version>
> <scope>provided</scope>
> </dependency>
>
> I even tried:
>
> <dependency>
> <groupId>org.apache.tomee</groupId>
> <artifactId>tomee-jaxrs</artifactId>
> <version>${tomee.version}</version>
> <scope>test</scope>
> <exclusions>
> <exclusion>
> <groupId>com.sun.xml.bind</groupId>
> <artifactId>jaxb-impl</artifactId>
> </exclusion>
> </exclusions>
> </dependency>
>
>
> On Mon, Oct 17, 2016 at 3:37 PM, Romain Manni-Bucau <rmannibucau@gmail.com
> >
> wrote:
>
> > well jaxb is provided and shouldnt be delivered so you have to remove it
> > from WEB-INF/lib. scope=provided should be fine too.
> >
> >
> > Romain Manni-Bucau
> > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > rmannibucau> |
> > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > <http://www.tomitribe.com> | JavaEE Factory
> > <https://javaeefactory-rmannibucau.rhcloud.com>
> >
> > 2016-10-17 20:07 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> >
> > > I need JAX-B runtime for code generated by jaxws-maven-plugin and XJC.
> > > Everything else is in test scope and not used in the deployed app.
> > >
> > > <dependency>
> > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > <artifactId>jaxb2-basics-runtime</artifactId>
> > > <version>0.10.0</version>
> > > </dependency>
> > >
> > >
> > > On Mon, Oct 17, 2016 at 1:57 PM, Romain Manni-Bucau <
> > rmannibucau@gmail.com
> > > >
> > > wrote:
> > >
> > > > yep so surely some part of the app running in a conflicting
> > classloader.
> > > > Personally I'd just remove stax2-api, woodstox and jaxb to start
> > > >
> > > >
> > > > Romain Manni-Bucau
> > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > > rmannibucau> |
> > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > >
> > > > 2016-10-17 19:47 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > >
> > > > > ~/java/apache-maven-3.3.9/bin/mvn dependency:tree | egrep
> > > 'woo|xml|stax'
> > > > > [INFO] | | +- javax.xml.bind:jaxb-api:jar:2.2.6:test
> > > > > [INFO] | | \- com.sun.xml.bind:jaxb-impl:jar:2.2.6:test
> > > > > [INFO] | | | +- org.apache.santuario:xmlsec:
> jar:2.0.5:test
> > > > > [INFO] | | | | | +-
> > > > > org.opensaml:opensaml-xmlsec-api:jar:3.1.1:test
> > > > > [INFO] | | | | +- org.opensaml:opensaml-xmlsec-
> > > > > impl:jar:3.1.1:test
> > > > > [INFO] | | +- org.apache.wss4j:wss4j-ws-
> > > > security-stax:jar:2.1.4:test
> > > > > [INFO] | | +-
> > > > > org.apache.wss4j:wss4j-ws-security-policy-stax:jar:2.1.4:test
> > > > > [INFO] | | | +- xml-resolver:xml-resolver:jar:1.2:test
> > > > > [INFO] | | | +- org.apache.cxf:cxf-rt-
> > > bindings-xml:jar:3.1.6:test
> > > > > [INFO] | | \- com.sun.xml.messaging.saaj:
> > > saaj-impl:jar:1.3.18:test
> > > > > [INFO] | | | +- org.codehaus.woodstox:
> > > woodstox-core-asl:jar:4.4.1:
> > > > > test
> > > > > [INFO] | | | | \- org.codehaus.woodstox:stax2-
> > > api:jar:3.1.4:test
> > > > > [INFO] | | | \- org.apache.ws.xmlschema:
> > > > > xmlschema-core:jar:2.2.1:test
> > > > > [INFO] +-
> > > > > com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider:
> > jar:2.7.4:test
> > > > > [INFO] | +- com.fasterxml.jackson.jaxrs:
> > jackson-jaxrs-base:jar:2.7.4:
> > > > test
> > > > > [INFO] | +- com.fasterxml.jackson.core:
> jackson-core:jar:2.7.4:test
> > > > > [INFO] | +- com.fasterxml.jackson.core:
> jackson-databind:jar:2.7.4:
> > > test
> > > > > [INFO] | | \-
> > > > > com.fasterxml.jackson.core:jackson-annotations:jar:2.7.0:test
> > > > > [INFO] | \-
> > > > > com.fasterxml.jackson.module:jackson-module-jaxb-
> > > > > annotations:jar:2.7.4:test
> > > > >
> > > > >
> > > > > On Mon, Oct 17, 2016 at 11:40 AM, Romain Manni-Bucau <
> > > > > rmannibucau@gmail.com>
> > > > > wrote:
> > > > >
> > > > > > mvn dependency:tree | egrep 'woo|xml|stax'
> > > > > >
> > > > > >
> > > > > > Romain Manni-Bucau
> > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > > > > rmannibucau> |
> > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > >
> > > > > > 2016-10-17 17:36 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > > > >
> > > > > > > My compile dependencies are (do you see anything that sticks
> > out):
> > > > > > >
> > > > > > > <dependency>
> > > > > > > <groupId>org.jsr107.ri</groupId>
> > > > > > > <artifactId>cache-annotations-ri-cdi</artifactId>
> > > > > > > <version>1.0.0</version>
> > > > > > > </dependency>
> > > > > > > <dependency>
> > > > > > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > > > > > <artifactId>jaxb2-basics-runtime</artifactId>
> > > > > > > <version>0.10.0</version>
> > > > > > > </dependency>
> > > > > > > <dependency>
> > > > > > > <groupId>org.slf4j</groupId>
> > > > > > > <artifactId>slf4j-api</artifactId>
> > > > > > > <version>${slf4j.version}</version>
> > > > > > > </dependency>
> > > > > > > <dependency>
> > > > > > > <groupId>ch.qos.logback</groupId>
> > > > > > > <artifactId>logback-classic</artifactId>
> > > > > > > <version>${logback.version}</version>
> > > > > > > </dependency>
> > > > > > > <dependency>
> > > > > > > <groupId>ch.qos.logback</groupId>
> > > > > > > <artifactId>logback-core</artifactId>
> > > > > > > <version>${logback.version}</version>
> > > > > > > </dependency>
> > > > > > > <dependency>
> > > > > > > <groupId>org.apache.commons</groupId>
> > > > > > > <artifactId>commons-pool2</artifactId>
> > > > > > > <version>2.4.2</version>
> > > > > > > </dependency>
> > > > > > > <dependency>
> > > > > > > <groupId>commons-configuration</groupId>
> > > > > > > <artifactId>commons-configuration</artifactId>
> > > > > > > <version>1.10</version>
> > > > > > > </dependency>
> > > > > > > <dependency>
> > > > > > > <groupId>org.jasypt</groupId>
> > > > > > > <artifactId>jasypt</artifactId>
> > > > > > > <version>1.9.3-SNAPSHOT</version>
> > > > > > > </dependency>
> > > > > > >
> > > > > > >
> > > > > > > On Mon, Oct 17, 2016 at 11:30 AM, Romain Manni-Bucau <
> > > > > > > rmannibucau@gmail.com>
> > > > > > > wrote:
> > > > > > >
> > > > > > > > Hello
> > > > > > > >
> > > > > > > > can happen if you provide some xml libraries in your app -
> like
> > > > > > woodstox
> > > > > > > or
> > > > > > > > stax*api - and it conflicts at some point.
> > > > > > > >
> > > > > > > >
> > > > > > > > Romain Manni-Bucau
> > > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > > > > <http://rmannibucau.wordpress.com> | Github <
> > https://github.com/
> > > > > > > > rmannibucau> |
> > > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> > Tomitriber
> > > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > > >
> > > > > > > > 2016-10-17 17:18 GMT+02:00 sgjava <sg...@gmail.com>:
> > > > > > > >
> > > > > > > > > Periodically I'm seeing "Cannot create a secure
> > > XMLInputFactory"
> > > > in
> > > > > > > TomEE
> > > > > > > > > 7.0.2-SNAPSHOT. One solution is for CXF using
> > > > > > > > > -Dorg.apache.cxf.stax.allowInsecureParser=1. This is an
> > older
> > > > > 7.0.2
> > > > > > > from
> > > > > > > > > 7/4/16.
> > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > --
> > > > > > > > > View this message in context: http://tomee-openejb.979440.
> > > > > > > > > n4.nabble.com/Cannot-create-a-secure-XMLInputFactory-
> > > > > tp4680348.html
> > > > > > > > > Sent from the TomEE Users mailing list archive at
> Nabble.com.
> > > > > > > > >
> > > > > > > >
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > > --
> > > > > > > Steven P. Goldsmith
> > > > > > >
> > > > > >
> > > > >
> > > > >
> > > > >
> > > > > --
> > > > > Steven P. Goldsmith
> > > > >
> > > >
> > >
> > >
> > >
> > > --
> > > Steven P. Goldsmith
> > >
> >
>
>
>
> --
> Steven P. Goldsmith
>
Re: Cannot create a secure XMLInputFactory
Posted by Steve Goldsmith <sg...@gmail.com>.
OK, I made the following change and I still get the error:
<dependency>
<groupId>org.jvnet.jaxb2_commons</groupId>
<artifactId>jaxb2-basics-runtime</artifactId>
<version>0.10.0</version>
<scope>provided</scope>
</dependency>
I even tried:
<dependency>
<groupId>org.apache.tomee</groupId>
<artifactId>tomee-jaxrs</artifactId>
<version>${tomee.version}</version>
<scope>test</scope>
<exclusions>
<exclusion>
<groupId>com.sun.xml.bind</groupId>
<artifactId>jaxb-impl</artifactId>
</exclusion>
</exclusions>
</dependency>
On Mon, Oct 17, 2016 at 3:37 PM, Romain Manni-Bucau <rm...@gmail.com>
wrote:
> well jaxb is provided and shouldnt be delivered so you have to remove it
> from WEB-INF/lib. scope=provided should be fine too.
>
>
> Romain Manni-Bucau
> @rmannibucau <https://twitter.com/rmannibucau> | Blog
> <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> <http://rmannibucau.wordpress.com> | Github <https://github.com/
> rmannibucau> |
> LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> <http://www.tomitribe.com> | JavaEE Factory
> <https://javaeefactory-rmannibucau.rhcloud.com>
>
> 2016-10-17 20:07 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
>
> > I need JAX-B runtime for code generated by jaxws-maven-plugin and XJC.
> > Everything else is in test scope and not used in the deployed app.
> >
> > <dependency>
> > <groupId>org.jvnet.jaxb2_commons</groupId>
> > <artifactId>jaxb2-basics-runtime</artifactId>
> > <version>0.10.0</version>
> > </dependency>
> >
> >
> > On Mon, Oct 17, 2016 at 1:57 PM, Romain Manni-Bucau <
> rmannibucau@gmail.com
> > >
> > wrote:
> >
> > > yep so surely some part of the app running in a conflicting
> classloader.
> > > Personally I'd just remove stax2-api, woodstox and jaxb to start
> > >
> > >
> > > Romain Manni-Bucau
> > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > rmannibucau> |
> > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > <http://www.tomitribe.com> | JavaEE Factory
> > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > >
> > > 2016-10-17 19:47 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > >
> > > > ~/java/apache-maven-3.3.9/bin/mvn dependency:tree | egrep
> > 'woo|xml|stax'
> > > > [INFO] | | +- javax.xml.bind:jaxb-api:jar:2.2.6:test
> > > > [INFO] | | \- com.sun.xml.bind:jaxb-impl:jar:2.2.6:test
> > > > [INFO] | | | +- org.apache.santuario:xmlsec:jar:2.0.5:test
> > > > [INFO] | | | | | +-
> > > > org.opensaml:opensaml-xmlsec-api:jar:3.1.1:test
> > > > [INFO] | | | | +- org.opensaml:opensaml-xmlsec-
> > > > impl:jar:3.1.1:test
> > > > [INFO] | | +- org.apache.wss4j:wss4j-ws-
> > > security-stax:jar:2.1.4:test
> > > > [INFO] | | +-
> > > > org.apache.wss4j:wss4j-ws-security-policy-stax:jar:2.1.4:test
> > > > [INFO] | | | +- xml-resolver:xml-resolver:jar:1.2:test
> > > > [INFO] | | | +- org.apache.cxf:cxf-rt-
> > bindings-xml:jar:3.1.6:test
> > > > [INFO] | | \- com.sun.xml.messaging.saaj:
> > saaj-impl:jar:1.3.18:test
> > > > [INFO] | | | +- org.codehaus.woodstox:
> > woodstox-core-asl:jar:4.4.1:
> > > > test
> > > > [INFO] | | | | \- org.codehaus.woodstox:stax2-
> > api:jar:3.1.4:test
> > > > [INFO] | | | \- org.apache.ws.xmlschema:
> > > > xmlschema-core:jar:2.2.1:test
> > > > [INFO] +-
> > > > com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider:
> jar:2.7.4:test
> > > > [INFO] | +- com.fasterxml.jackson.jaxrs:
> jackson-jaxrs-base:jar:2.7.4:
> > > test
> > > > [INFO] | +- com.fasterxml.jackson.core:jackson-core:jar:2.7.4:test
> > > > [INFO] | +- com.fasterxml.jackson.core:jackson-databind:jar:2.7.4:
> > test
> > > > [INFO] | | \-
> > > > com.fasterxml.jackson.core:jackson-annotations:jar:2.7.0:test
> > > > [INFO] | \-
> > > > com.fasterxml.jackson.module:jackson-module-jaxb-
> > > > annotations:jar:2.7.4:test
> > > >
> > > >
> > > > On Mon, Oct 17, 2016 at 11:40 AM, Romain Manni-Bucau <
> > > > rmannibucau@gmail.com>
> > > > wrote:
> > > >
> > > > > mvn dependency:tree | egrep 'woo|xml|stax'
> > > > >
> > > > >
> > > > > Romain Manni-Bucau
> > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > > > rmannibucau> |
> > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > >
> > > > > 2016-10-17 17:36 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > > >
> > > > > > My compile dependencies are (do you see anything that sticks
> out):
> > > > > >
> > > > > > <dependency>
> > > > > > <groupId>org.jsr107.ri</groupId>
> > > > > > <artifactId>cache-annotations-ri-cdi</artifactId>
> > > > > > <version>1.0.0</version>
> > > > > > </dependency>
> > > > > > <dependency>
> > > > > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > > > > <artifactId>jaxb2-basics-runtime</artifactId>
> > > > > > <version>0.10.0</version>
> > > > > > </dependency>
> > > > > > <dependency>
> > > > > > <groupId>org.slf4j</groupId>
> > > > > > <artifactId>slf4j-api</artifactId>
> > > > > > <version>${slf4j.version}</version>
> > > > > > </dependency>
> > > > > > <dependency>
> > > > > > <groupId>ch.qos.logback</groupId>
> > > > > > <artifactId>logback-classic</artifactId>
> > > > > > <version>${logback.version}</version>
> > > > > > </dependency>
> > > > > > <dependency>
> > > > > > <groupId>ch.qos.logback</groupId>
> > > > > > <artifactId>logback-core</artifactId>
> > > > > > <version>${logback.version}</version>
> > > > > > </dependency>
> > > > > > <dependency>
> > > > > > <groupId>org.apache.commons</groupId>
> > > > > > <artifactId>commons-pool2</artifactId>
> > > > > > <version>2.4.2</version>
> > > > > > </dependency>
> > > > > > <dependency>
> > > > > > <groupId>commons-configuration</groupId>
> > > > > > <artifactId>commons-configuration</artifactId>
> > > > > > <version>1.10</version>
> > > > > > </dependency>
> > > > > > <dependency>
> > > > > > <groupId>org.jasypt</groupId>
> > > > > > <artifactId>jasypt</artifactId>
> > > > > > <version>1.9.3-SNAPSHOT</version>
> > > > > > </dependency>
> > > > > >
> > > > > >
> > > > > > On Mon, Oct 17, 2016 at 11:30 AM, Romain Manni-Bucau <
> > > > > > rmannibucau@gmail.com>
> > > > > > wrote:
> > > > > >
> > > > > > > Hello
> > > > > > >
> > > > > > > can happen if you provide some xml libraries in your app - like
> > > > > woodstox
> > > > > > or
> > > > > > > stax*api - and it conflicts at some point.
> > > > > > >
> > > > > > >
> > > > > > > Romain Manni-Bucau
> > > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > > > <http://rmannibucau.wordpress.com> | Github <
> https://github.com/
> > > > > > > rmannibucau> |
> > > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> |
> Tomitriber
> > > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > > >
> > > > > > > 2016-10-17 17:18 GMT+02:00 sgjava <sg...@gmail.com>:
> > > > > > >
> > > > > > > > Periodically I'm seeing "Cannot create a secure
> > XMLInputFactory"
> > > in
> > > > > > TomEE
> > > > > > > > 7.0.2-SNAPSHOT. One solution is for CXF using
> > > > > > > > -Dorg.apache.cxf.stax.allowInsecureParser=1. This is an
> older
> > > > 7.0.2
> > > > > > from
> > > > > > > > 7/4/16.
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > > --
> > > > > > > > View this message in context: http://tomee-openejb.979440.
> > > > > > > > n4.nabble.com/Cannot-create-a-secure-XMLInputFactory-
> > > > tp4680348.html
> > > > > > > > Sent from the TomEE Users mailing list archive at Nabble.com.
> > > > > > > >
> > > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > > --
> > > > > > Steven P. Goldsmith
> > > > > >
> > > > >
> > > >
> > > >
> > > >
> > > > --
> > > > Steven P. Goldsmith
> > > >
> > >
> >
> >
> >
> > --
> > Steven P. Goldsmith
> >
>
--
Steven P. Goldsmith
Re: Cannot create a secure XMLInputFactory
Posted by Romain Manni-Bucau <rm...@gmail.com>.
well jaxb is provided and shouldnt be delivered so you have to remove it
from WEB-INF/lib. scope=provided should be fine too.
Romain Manni-Bucau
@rmannibucau <https://twitter.com/rmannibucau> | Blog
<https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
<http://rmannibucau.wordpress.com> | Github <https://github.com/rmannibucau> |
LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
<http://www.tomitribe.com> | JavaEE Factory
<https://javaeefactory-rmannibucau.rhcloud.com>
2016-10-17 20:07 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> I need JAX-B runtime for code generated by jaxws-maven-plugin and XJC.
> Everything else is in test scope and not used in the deployed app.
>
> <dependency>
> <groupId>org.jvnet.jaxb2_commons</groupId>
> <artifactId>jaxb2-basics-runtime</artifactId>
> <version>0.10.0</version>
> </dependency>
>
>
> On Mon, Oct 17, 2016 at 1:57 PM, Romain Manni-Bucau <rmannibucau@gmail.com
> >
> wrote:
>
> > yep so surely some part of the app running in a conflicting classloader.
> > Personally I'd just remove stax2-api, woodstox and jaxb to start
> >
> >
> > Romain Manni-Bucau
> > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > rmannibucau> |
> > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > <http://www.tomitribe.com> | JavaEE Factory
> > <https://javaeefactory-rmannibucau.rhcloud.com>
> >
> > 2016-10-17 19:47 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> >
> > > ~/java/apache-maven-3.3.9/bin/mvn dependency:tree | egrep
> 'woo|xml|stax'
> > > [INFO] | | +- javax.xml.bind:jaxb-api:jar:2.2.6:test
> > > [INFO] | | \- com.sun.xml.bind:jaxb-impl:jar:2.2.6:test
> > > [INFO] | | | +- org.apache.santuario:xmlsec:jar:2.0.5:test
> > > [INFO] | | | | | +-
> > > org.opensaml:opensaml-xmlsec-api:jar:3.1.1:test
> > > [INFO] | | | | +- org.opensaml:opensaml-xmlsec-
> > > impl:jar:3.1.1:test
> > > [INFO] | | +- org.apache.wss4j:wss4j-ws-
> > security-stax:jar:2.1.4:test
> > > [INFO] | | +-
> > > org.apache.wss4j:wss4j-ws-security-policy-stax:jar:2.1.4:test
> > > [INFO] | | | +- xml-resolver:xml-resolver:jar:1.2:test
> > > [INFO] | | | +- org.apache.cxf:cxf-rt-
> bindings-xml:jar:3.1.6:test
> > > [INFO] | | \- com.sun.xml.messaging.saaj:
> saaj-impl:jar:1.3.18:test
> > > [INFO] | | | +- org.codehaus.woodstox:
> woodstox-core-asl:jar:4.4.1:
> > > test
> > > [INFO] | | | | \- org.codehaus.woodstox:stax2-
> api:jar:3.1.4:test
> > > [INFO] | | | \- org.apache.ws.xmlschema:
> > > xmlschema-core:jar:2.2.1:test
> > > [INFO] +-
> > > com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider:jar:2.7.4:test
> > > [INFO] | +- com.fasterxml.jackson.jaxrs:jackson-jaxrs-base:jar:2.7.4:
> > test
> > > [INFO] | +- com.fasterxml.jackson.core:jackson-core:jar:2.7.4:test
> > > [INFO] | +- com.fasterxml.jackson.core:jackson-databind:jar:2.7.4:
> test
> > > [INFO] | | \-
> > > com.fasterxml.jackson.core:jackson-annotations:jar:2.7.0:test
> > > [INFO] | \-
> > > com.fasterxml.jackson.module:jackson-module-jaxb-
> > > annotations:jar:2.7.4:test
> > >
> > >
> > > On Mon, Oct 17, 2016 at 11:40 AM, Romain Manni-Bucau <
> > > rmannibucau@gmail.com>
> > > wrote:
> > >
> > > > mvn dependency:tree | egrep 'woo|xml|stax'
> > > >
> > > >
> > > > Romain Manni-Bucau
> > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > > rmannibucau> |
> > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > >
> > > > 2016-10-17 17:36 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > > >
> > > > > My compile dependencies are (do you see anything that sticks out):
> > > > >
> > > > > <dependency>
> > > > > <groupId>org.jsr107.ri</groupId>
> > > > > <artifactId>cache-annotations-ri-cdi</artifactId>
> > > > > <version>1.0.0</version>
> > > > > </dependency>
> > > > > <dependency>
> > > > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > > > <artifactId>jaxb2-basics-runtime</artifactId>
> > > > > <version>0.10.0</version>
> > > > > </dependency>
> > > > > <dependency>
> > > > > <groupId>org.slf4j</groupId>
> > > > > <artifactId>slf4j-api</artifactId>
> > > > > <version>${slf4j.version}</version>
> > > > > </dependency>
> > > > > <dependency>
> > > > > <groupId>ch.qos.logback</groupId>
> > > > > <artifactId>logback-classic</artifactId>
> > > > > <version>${logback.version}</version>
> > > > > </dependency>
> > > > > <dependency>
> > > > > <groupId>ch.qos.logback</groupId>
> > > > > <artifactId>logback-core</artifactId>
> > > > > <version>${logback.version}</version>
> > > > > </dependency>
> > > > > <dependency>
> > > > > <groupId>org.apache.commons</groupId>
> > > > > <artifactId>commons-pool2</artifactId>
> > > > > <version>2.4.2</version>
> > > > > </dependency>
> > > > > <dependency>
> > > > > <groupId>commons-configuration</groupId>
> > > > > <artifactId>commons-configuration</artifactId>
> > > > > <version>1.10</version>
> > > > > </dependency>
> > > > > <dependency>
> > > > > <groupId>org.jasypt</groupId>
> > > > > <artifactId>jasypt</artifactId>
> > > > > <version>1.9.3-SNAPSHOT</version>
> > > > > </dependency>
> > > > >
> > > > >
> > > > > On Mon, Oct 17, 2016 at 11:30 AM, Romain Manni-Bucau <
> > > > > rmannibucau@gmail.com>
> > > > > wrote:
> > > > >
> > > > > > Hello
> > > > > >
> > > > > > can happen if you provide some xml libraries in your app - like
> > > > woodstox
> > > > > or
> > > > > > stax*api - and it conflicts at some point.
> > > > > >
> > > > > >
> > > > > > Romain Manni-Bucau
> > > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > > > > rmannibucau> |
> > > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > > >
> > > > > > 2016-10-17 17:18 GMT+02:00 sgjava <sg...@gmail.com>:
> > > > > >
> > > > > > > Periodically I'm seeing "Cannot create a secure
> XMLInputFactory"
> > in
> > > > > TomEE
> > > > > > > 7.0.2-SNAPSHOT. One solution is for CXF using
> > > > > > > -Dorg.apache.cxf.stax.allowInsecureParser=1. This is an older
> > > 7.0.2
> > > > > from
> > > > > > > 7/4/16.
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > > --
> > > > > > > View this message in context: http://tomee-openejb.979440.
> > > > > > > n4.nabble.com/Cannot-create-a-secure-XMLInputFactory-
> > > tp4680348.html
> > > > > > > Sent from the TomEE Users mailing list archive at Nabble.com.
> > > > > > >
> > > > > >
> > > > >
> > > > >
> > > > >
> > > > > --
> > > > > Steven P. Goldsmith
> > > > >
> > > >
> > >
> > >
> > >
> > > --
> > > Steven P. Goldsmith
> > >
> >
>
>
>
> --
> Steven P. Goldsmith
>
Re: Cannot create a secure XMLInputFactory
Posted by Steve Goldsmith <sg...@gmail.com>.
I need JAX-B runtime for code generated by jaxws-maven-plugin and XJC.
Everything else is in test scope and not used in the deployed app.
<dependency>
<groupId>org.jvnet.jaxb2_commons</groupId>
<artifactId>jaxb2-basics-runtime</artifactId>
<version>0.10.0</version>
</dependency>
On Mon, Oct 17, 2016 at 1:57 PM, Romain Manni-Bucau <rm...@gmail.com>
wrote:
> yep so surely some part of the app running in a conflicting classloader.
> Personally I'd just remove stax2-api, woodstox and jaxb to start
>
>
> Romain Manni-Bucau
> @rmannibucau <https://twitter.com/rmannibucau> | Blog
> <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> <http://rmannibucau.wordpress.com> | Github <https://github.com/
> rmannibucau> |
> LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> <http://www.tomitribe.com> | JavaEE Factory
> <https://javaeefactory-rmannibucau.rhcloud.com>
>
> 2016-10-17 19:47 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
>
> > ~/java/apache-maven-3.3.9/bin/mvn dependency:tree | egrep 'woo|xml|stax'
> > [INFO] | | +- javax.xml.bind:jaxb-api:jar:2.2.6:test
> > [INFO] | | \- com.sun.xml.bind:jaxb-impl:jar:2.2.6:test
> > [INFO] | | | +- org.apache.santuario:xmlsec:jar:2.0.5:test
> > [INFO] | | | | | +-
> > org.opensaml:opensaml-xmlsec-api:jar:3.1.1:test
> > [INFO] | | | | +- org.opensaml:opensaml-xmlsec-
> > impl:jar:3.1.1:test
> > [INFO] | | +- org.apache.wss4j:wss4j-ws-
> security-stax:jar:2.1.4:test
> > [INFO] | | +-
> > org.apache.wss4j:wss4j-ws-security-policy-stax:jar:2.1.4:test
> > [INFO] | | | +- xml-resolver:xml-resolver:jar:1.2:test
> > [INFO] | | | +- org.apache.cxf:cxf-rt-bindings-xml:jar:3.1.6:test
> > [INFO] | | \- com.sun.xml.messaging.saaj:saaj-impl:jar:1.3.18:test
> > [INFO] | | | +- org.codehaus.woodstox:woodstox-core-asl:jar:4.4.1:
> > test
> > [INFO] | | | | \- org.codehaus.woodstox:stax2-api:jar:3.1.4:test
> > [INFO] | | | \- org.apache.ws.xmlschema:
> > xmlschema-core:jar:2.2.1:test
> > [INFO] +-
> > com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider:jar:2.7.4:test
> > [INFO] | +- com.fasterxml.jackson.jaxrs:jackson-jaxrs-base:jar:2.7.4:
> test
> > [INFO] | +- com.fasterxml.jackson.core:jackson-core:jar:2.7.4:test
> > [INFO] | +- com.fasterxml.jackson.core:jackson-databind:jar:2.7.4:test
> > [INFO] | | \-
> > com.fasterxml.jackson.core:jackson-annotations:jar:2.7.0:test
> > [INFO] | \-
> > com.fasterxml.jackson.module:jackson-module-jaxb-
> > annotations:jar:2.7.4:test
> >
> >
> > On Mon, Oct 17, 2016 at 11:40 AM, Romain Manni-Bucau <
> > rmannibucau@gmail.com>
> > wrote:
> >
> > > mvn dependency:tree | egrep 'woo|xml|stax'
> > >
> > >
> > > Romain Manni-Bucau
> > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > rmannibucau> |
> > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > <http://www.tomitribe.com> | JavaEE Factory
> > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > >
> > > 2016-10-17 17:36 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> > >
> > > > My compile dependencies are (do you see anything that sticks out):
> > > >
> > > > <dependency>
> > > > <groupId>org.jsr107.ri</groupId>
> > > > <artifactId>cache-annotations-ri-cdi</artifactId>
> > > > <version>1.0.0</version>
> > > > </dependency>
> > > > <dependency>
> > > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > > <artifactId>jaxb2-basics-runtime</artifactId>
> > > > <version>0.10.0</version>
> > > > </dependency>
> > > > <dependency>
> > > > <groupId>org.slf4j</groupId>
> > > > <artifactId>slf4j-api</artifactId>
> > > > <version>${slf4j.version}</version>
> > > > </dependency>
> > > > <dependency>
> > > > <groupId>ch.qos.logback</groupId>
> > > > <artifactId>logback-classic</artifactId>
> > > > <version>${logback.version}</version>
> > > > </dependency>
> > > > <dependency>
> > > > <groupId>ch.qos.logback</groupId>
> > > > <artifactId>logback-core</artifactId>
> > > > <version>${logback.version}</version>
> > > > </dependency>
> > > > <dependency>
> > > > <groupId>org.apache.commons</groupId>
> > > > <artifactId>commons-pool2</artifactId>
> > > > <version>2.4.2</version>
> > > > </dependency>
> > > > <dependency>
> > > > <groupId>commons-configuration</groupId>
> > > > <artifactId>commons-configuration</artifactId>
> > > > <version>1.10</version>
> > > > </dependency>
> > > > <dependency>
> > > > <groupId>org.jasypt</groupId>
> > > > <artifactId>jasypt</artifactId>
> > > > <version>1.9.3-SNAPSHOT</version>
> > > > </dependency>
> > > >
> > > >
> > > > On Mon, Oct 17, 2016 at 11:30 AM, Romain Manni-Bucau <
> > > > rmannibucau@gmail.com>
> > > > wrote:
> > > >
> > > > > Hello
> > > > >
> > > > > can happen if you provide some xml libraries in your app - like
> > > woodstox
> > > > or
> > > > > stax*api - and it conflicts at some point.
> > > > >
> > > > >
> > > > > Romain Manni-Bucau
> > > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > > > rmannibucau> |
> > > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > > >
> > > > > 2016-10-17 17:18 GMT+02:00 sgjava <sg...@gmail.com>:
> > > > >
> > > > > > Periodically I'm seeing "Cannot create a secure XMLInputFactory"
> in
> > > > TomEE
> > > > > > 7.0.2-SNAPSHOT. One solution is for CXF using
> > > > > > -Dorg.apache.cxf.stax.allowInsecureParser=1. This is an older
> > 7.0.2
> > > > from
> > > > > > 7/4/16.
> > > > > >
> > > > > >
> > > > > >
> > > > > > --
> > > > > > View this message in context: http://tomee-openejb.979440.
> > > > > > n4.nabble.com/Cannot-create-a-secure-XMLInputFactory-
> > tp4680348.html
> > > > > > Sent from the TomEE Users mailing list archive at Nabble.com.
> > > > > >
> > > > >
> > > >
> > > >
> > > >
> > > > --
> > > > Steven P. Goldsmith
> > > >
> > >
> >
> >
> >
> > --
> > Steven P. Goldsmith
> >
>
--
Steven P. Goldsmith
Re: Cannot create a secure XMLInputFactory
Posted by Romain Manni-Bucau <rm...@gmail.com>.
yep so surely some part of the app running in a conflicting classloader.
Personally I'd just remove stax2-api, woodstox and jaxb to start
Romain Manni-Bucau
@rmannibucau <https://twitter.com/rmannibucau> | Blog
<https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
<http://rmannibucau.wordpress.com> | Github <https://github.com/rmannibucau> |
LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
<http://www.tomitribe.com> | JavaEE Factory
<https://javaeefactory-rmannibucau.rhcloud.com>
2016-10-17 19:47 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> ~/java/apache-maven-3.3.9/bin/mvn dependency:tree | egrep 'woo|xml|stax'
> [INFO] | | +- javax.xml.bind:jaxb-api:jar:2.2.6:test
> [INFO] | | \- com.sun.xml.bind:jaxb-impl:jar:2.2.6:test
> [INFO] | | | +- org.apache.santuario:xmlsec:jar:2.0.5:test
> [INFO] | | | | | +-
> org.opensaml:opensaml-xmlsec-api:jar:3.1.1:test
> [INFO] | | | | +- org.opensaml:opensaml-xmlsec-
> impl:jar:3.1.1:test
> [INFO] | | +- org.apache.wss4j:wss4j-ws-security-stax:jar:2.1.4:test
> [INFO] | | +-
> org.apache.wss4j:wss4j-ws-security-policy-stax:jar:2.1.4:test
> [INFO] | | | +- xml-resolver:xml-resolver:jar:1.2:test
> [INFO] | | | +- org.apache.cxf:cxf-rt-bindings-xml:jar:3.1.6:test
> [INFO] | | \- com.sun.xml.messaging.saaj:saaj-impl:jar:1.3.18:test
> [INFO] | | | +- org.codehaus.woodstox:woodstox-core-asl:jar:4.4.1:
> test
> [INFO] | | | | \- org.codehaus.woodstox:stax2-api:jar:3.1.4:test
> [INFO] | | | \- org.apache.ws.xmlschema:
> xmlschema-core:jar:2.2.1:test
> [INFO] +-
> com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider:jar:2.7.4:test
> [INFO] | +- com.fasterxml.jackson.jaxrs:jackson-jaxrs-base:jar:2.7.4:test
> [INFO] | +- com.fasterxml.jackson.core:jackson-core:jar:2.7.4:test
> [INFO] | +- com.fasterxml.jackson.core:jackson-databind:jar:2.7.4:test
> [INFO] | | \-
> com.fasterxml.jackson.core:jackson-annotations:jar:2.7.0:test
> [INFO] | \-
> com.fasterxml.jackson.module:jackson-module-jaxb-
> annotations:jar:2.7.4:test
>
>
> On Mon, Oct 17, 2016 at 11:40 AM, Romain Manni-Bucau <
> rmannibucau@gmail.com>
> wrote:
>
> > mvn dependency:tree | egrep 'woo|xml|stax'
> >
> >
> > Romain Manni-Bucau
> > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > rmannibucau> |
> > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > <http://www.tomitribe.com> | JavaEE Factory
> > <https://javaeefactory-rmannibucau.rhcloud.com>
> >
> > 2016-10-17 17:36 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> >
> > > My compile dependencies are (do you see anything that sticks out):
> > >
> > > <dependency>
> > > <groupId>org.jsr107.ri</groupId>
> > > <artifactId>cache-annotations-ri-cdi</artifactId>
> > > <version>1.0.0</version>
> > > </dependency>
> > > <dependency>
> > > <groupId>org.jvnet.jaxb2_commons</groupId>
> > > <artifactId>jaxb2-basics-runtime</artifactId>
> > > <version>0.10.0</version>
> > > </dependency>
> > > <dependency>
> > > <groupId>org.slf4j</groupId>
> > > <artifactId>slf4j-api</artifactId>
> > > <version>${slf4j.version}</version>
> > > </dependency>
> > > <dependency>
> > > <groupId>ch.qos.logback</groupId>
> > > <artifactId>logback-classic</artifactId>
> > > <version>${logback.version}</version>
> > > </dependency>
> > > <dependency>
> > > <groupId>ch.qos.logback</groupId>
> > > <artifactId>logback-core</artifactId>
> > > <version>${logback.version}</version>
> > > </dependency>
> > > <dependency>
> > > <groupId>org.apache.commons</groupId>
> > > <artifactId>commons-pool2</artifactId>
> > > <version>2.4.2</version>
> > > </dependency>
> > > <dependency>
> > > <groupId>commons-configuration</groupId>
> > > <artifactId>commons-configuration</artifactId>
> > > <version>1.10</version>
> > > </dependency>
> > > <dependency>
> > > <groupId>org.jasypt</groupId>
> > > <artifactId>jasypt</artifactId>
> > > <version>1.9.3-SNAPSHOT</version>
> > > </dependency>
> > >
> > >
> > > On Mon, Oct 17, 2016 at 11:30 AM, Romain Manni-Bucau <
> > > rmannibucau@gmail.com>
> > > wrote:
> > >
> > > > Hello
> > > >
> > > > can happen if you provide some xml libraries in your app - like
> > woodstox
> > > or
> > > > stax*api - and it conflicts at some point.
> > > >
> > > >
> > > > Romain Manni-Bucau
> > > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > > rmannibucau> |
> > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > >
> > > > 2016-10-17 17:18 GMT+02:00 sgjava <sg...@gmail.com>:
> > > >
> > > > > Periodically I'm seeing "Cannot create a secure XMLInputFactory" in
> > > TomEE
> > > > > 7.0.2-SNAPSHOT. One solution is for CXF using
> > > > > -Dorg.apache.cxf.stax.allowInsecureParser=1. This is an older
> 7.0.2
> > > from
> > > > > 7/4/16.
> > > > >
> > > > >
> > > > >
> > > > > --
> > > > > View this message in context: http://tomee-openejb.979440.
> > > > > n4.nabble.com/Cannot-create-a-secure-XMLInputFactory-
> tp4680348.html
> > > > > Sent from the TomEE Users mailing list archive at Nabble.com.
> > > > >
> > > >
> > >
> > >
> > >
> > > --
> > > Steven P. Goldsmith
> > >
> >
>
>
>
> --
> Steven P. Goldsmith
>
Re: Cannot create a secure XMLInputFactory
Posted by Steve Goldsmith <sg...@gmail.com>.
~/java/apache-maven-3.3.9/bin/mvn dependency:tree | egrep 'woo|xml|stax'
[INFO] | | +- javax.xml.bind:jaxb-api:jar:2.2.6:test
[INFO] | | \- com.sun.xml.bind:jaxb-impl:jar:2.2.6:test
[INFO] | | | +- org.apache.santuario:xmlsec:jar:2.0.5:test
[INFO] | | | | | +-
org.opensaml:opensaml-xmlsec-api:jar:3.1.1:test
[INFO] | | | | +- org.opensaml:opensaml-xmlsec-impl:jar:3.1.1:test
[INFO] | | +- org.apache.wss4j:wss4j-ws-security-stax:jar:2.1.4:test
[INFO] | | +-
org.apache.wss4j:wss4j-ws-security-policy-stax:jar:2.1.4:test
[INFO] | | | +- xml-resolver:xml-resolver:jar:1.2:test
[INFO] | | | +- org.apache.cxf:cxf-rt-bindings-xml:jar:3.1.6:test
[INFO] | | \- com.sun.xml.messaging.saaj:saaj-impl:jar:1.3.18:test
[INFO] | | | +- org.codehaus.woodstox:woodstox-core-asl:jar:4.4.1:test
[INFO] | | | | \- org.codehaus.woodstox:stax2-api:jar:3.1.4:test
[INFO] | | | \- org.apache.ws.xmlschema:xmlschema-core:jar:2.2.1:test
[INFO] +-
com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider:jar:2.7.4:test
[INFO] | +- com.fasterxml.jackson.jaxrs:jackson-jaxrs-base:jar:2.7.4:test
[INFO] | +- com.fasterxml.jackson.core:jackson-core:jar:2.7.4:test
[INFO] | +- com.fasterxml.jackson.core:jackson-databind:jar:2.7.4:test
[INFO] | | \-
com.fasterxml.jackson.core:jackson-annotations:jar:2.7.0:test
[INFO] | \-
com.fasterxml.jackson.module:jackson-module-jaxb-annotations:jar:2.7.4:test
On Mon, Oct 17, 2016 at 11:40 AM, Romain Manni-Bucau <rm...@gmail.com>
wrote:
> mvn dependency:tree | egrep 'woo|xml|stax'
>
>
> Romain Manni-Bucau
> @rmannibucau <https://twitter.com/rmannibucau> | Blog
> <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> <http://rmannibucau.wordpress.com> | Github <https://github.com/
> rmannibucau> |
> LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> <http://www.tomitribe.com> | JavaEE Factory
> <https://javaeefactory-rmannibucau.rhcloud.com>
>
> 2016-10-17 17:36 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
>
> > My compile dependencies are (do you see anything that sticks out):
> >
> > <dependency>
> > <groupId>org.jsr107.ri</groupId>
> > <artifactId>cache-annotations-ri-cdi</artifactId>
> > <version>1.0.0</version>
> > </dependency>
> > <dependency>
> > <groupId>org.jvnet.jaxb2_commons</groupId>
> > <artifactId>jaxb2-basics-runtime</artifactId>
> > <version>0.10.0</version>
> > </dependency>
> > <dependency>
> > <groupId>org.slf4j</groupId>
> > <artifactId>slf4j-api</artifactId>
> > <version>${slf4j.version}</version>
> > </dependency>
> > <dependency>
> > <groupId>ch.qos.logback</groupId>
> > <artifactId>logback-classic</artifactId>
> > <version>${logback.version}</version>
> > </dependency>
> > <dependency>
> > <groupId>ch.qos.logback</groupId>
> > <artifactId>logback-core</artifactId>
> > <version>${logback.version}</version>
> > </dependency>
> > <dependency>
> > <groupId>org.apache.commons</groupId>
> > <artifactId>commons-pool2</artifactId>
> > <version>2.4.2</version>
> > </dependency>
> > <dependency>
> > <groupId>commons-configuration</groupId>
> > <artifactId>commons-configuration</artifactId>
> > <version>1.10</version>
> > </dependency>
> > <dependency>
> > <groupId>org.jasypt</groupId>
> > <artifactId>jasypt</artifactId>
> > <version>1.9.3-SNAPSHOT</version>
> > </dependency>
> >
> >
> > On Mon, Oct 17, 2016 at 11:30 AM, Romain Manni-Bucau <
> > rmannibucau@gmail.com>
> > wrote:
> >
> > > Hello
> > >
> > > can happen if you provide some xml libraries in your app - like
> woodstox
> > or
> > > stax*api - and it conflicts at some point.
> > >
> > >
> > > Romain Manni-Bucau
> > > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > rmannibucau> |
> > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > <http://www.tomitribe.com> | JavaEE Factory
> > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > >
> > > 2016-10-17 17:18 GMT+02:00 sgjava <sg...@gmail.com>:
> > >
> > > > Periodically I'm seeing "Cannot create a secure XMLInputFactory" in
> > TomEE
> > > > 7.0.2-SNAPSHOT. One solution is for CXF using
> > > > -Dorg.apache.cxf.stax.allowInsecureParser=1. This is an older 7.0.2
> > from
> > > > 7/4/16.
> > > >
> > > >
> > > >
> > > > --
> > > > View this message in context: http://tomee-openejb.979440.
> > > > n4.nabble.com/Cannot-create-a-secure-XMLInputFactory-tp4680348.html
> > > > Sent from the TomEE Users mailing list archive at Nabble.com.
> > > >
> > >
> >
> >
> >
> > --
> > Steven P. Goldsmith
> >
>
--
Steven P. Goldsmith
Re: Cannot create a secure XMLInputFactory
Posted by Romain Manni-Bucau <rm...@gmail.com>.
mvn dependency:tree | egrep 'woo|xml|stax'
Romain Manni-Bucau
@rmannibucau <https://twitter.com/rmannibucau> | Blog
<https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
<http://rmannibucau.wordpress.com> | Github <https://github.com/rmannibucau> |
LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
<http://www.tomitribe.com> | JavaEE Factory
<https://javaeefactory-rmannibucau.rhcloud.com>
2016-10-17 17:36 GMT+02:00 Steve Goldsmith <sg...@gmail.com>:
> My compile dependencies are (do you see anything that sticks out):
>
> <dependency>
> <groupId>org.jsr107.ri</groupId>
> <artifactId>cache-annotations-ri-cdi</artifactId>
> <version>1.0.0</version>
> </dependency>
> <dependency>
> <groupId>org.jvnet.jaxb2_commons</groupId>
> <artifactId>jaxb2-basics-runtime</artifactId>
> <version>0.10.0</version>
> </dependency>
> <dependency>
> <groupId>org.slf4j</groupId>
> <artifactId>slf4j-api</artifactId>
> <version>${slf4j.version}</version>
> </dependency>
> <dependency>
> <groupId>ch.qos.logback</groupId>
> <artifactId>logback-classic</artifactId>
> <version>${logback.version}</version>
> </dependency>
> <dependency>
> <groupId>ch.qos.logback</groupId>
> <artifactId>logback-core</artifactId>
> <version>${logback.version}</version>
> </dependency>
> <dependency>
> <groupId>org.apache.commons</groupId>
> <artifactId>commons-pool2</artifactId>
> <version>2.4.2</version>
> </dependency>
> <dependency>
> <groupId>commons-configuration</groupId>
> <artifactId>commons-configuration</artifactId>
> <version>1.10</version>
> </dependency>
> <dependency>
> <groupId>org.jasypt</groupId>
> <artifactId>jasypt</artifactId>
> <version>1.9.3-SNAPSHOT</version>
> </dependency>
>
>
> On Mon, Oct 17, 2016 at 11:30 AM, Romain Manni-Bucau <
> rmannibucau@gmail.com>
> wrote:
>
> > Hello
> >
> > can happen if you provide some xml libraries in your app - like woodstox
> or
> > stax*api - and it conflicts at some point.
> >
> >
> > Romain Manni-Bucau
> > @rmannibucau <https://twitter.com/rmannibucau> | Blog
> > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > rmannibucau> |
> > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > <http://www.tomitribe.com> | JavaEE Factory
> > <https://javaeefactory-rmannibucau.rhcloud.com>
> >
> > 2016-10-17 17:18 GMT+02:00 sgjava <sg...@gmail.com>:
> >
> > > Periodically I'm seeing "Cannot create a secure XMLInputFactory" in
> TomEE
> > > 7.0.2-SNAPSHOT. One solution is for CXF using
> > > -Dorg.apache.cxf.stax.allowInsecureParser=1. This is an older 7.0.2
> from
> > > 7/4/16.
> > >
> > >
> > >
> > > --
> > > View this message in context: http://tomee-openejb.979440.
> > > n4.nabble.com/Cannot-create-a-secure-XMLInputFactory-tp4680348.html
> > > Sent from the TomEE Users mailing list archive at Nabble.com.
> > >
> >
>
>
>
> --
> Steven P. Goldsmith
>
Re: Cannot create a secure XMLInputFactory
Posted by Steve Goldsmith <sg...@gmail.com>.
My compile dependencies are (do you see anything that sticks out):
<dependency>
<groupId>org.jsr107.ri</groupId>
<artifactId>cache-annotations-ri-cdi</artifactId>
<version>1.0.0</version>
</dependency>
<dependency>
<groupId>org.jvnet.jaxb2_commons</groupId>
<artifactId>jaxb2-basics-runtime</artifactId>
<version>0.10.0</version>
</dependency>
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-api</artifactId>
<version>${slf4j.version}</version>
</dependency>
<dependency>
<groupId>ch.qos.logback</groupId>
<artifactId>logback-classic</artifactId>
<version>${logback.version}</version>
</dependency>
<dependency>
<groupId>ch.qos.logback</groupId>
<artifactId>logback-core</artifactId>
<version>${logback.version}</version>
</dependency>
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-pool2</artifactId>
<version>2.4.2</version>
</dependency>
<dependency>
<groupId>commons-configuration</groupId>
<artifactId>commons-configuration</artifactId>
<version>1.10</version>
</dependency>
<dependency>
<groupId>org.jasypt</groupId>
<artifactId>jasypt</artifactId>
<version>1.9.3-SNAPSHOT</version>
</dependency>
On Mon, Oct 17, 2016 at 11:30 AM, Romain Manni-Bucau <rm...@gmail.com>
wrote:
> Hello
>
> can happen if you provide some xml libraries in your app - like woodstox or
> stax*api - and it conflicts at some point.
>
>
> Romain Manni-Bucau
> @rmannibucau <https://twitter.com/rmannibucau> | Blog
> <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> <http://rmannibucau.wordpress.com> | Github <https://github.com/
> rmannibucau> |
> LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> <http://www.tomitribe.com> | JavaEE Factory
> <https://javaeefactory-rmannibucau.rhcloud.com>
>
> 2016-10-17 17:18 GMT+02:00 sgjava <sg...@gmail.com>:
>
> > Periodically I'm seeing "Cannot create a secure XMLInputFactory" in TomEE
> > 7.0.2-SNAPSHOT. One solution is for CXF using
> > -Dorg.apache.cxf.stax.allowInsecureParser=1. This is an older 7.0.2 from
> > 7/4/16.
> >
> >
> >
> > --
> > View this message in context: http://tomee-openejb.979440.
> > n4.nabble.com/Cannot-create-a-secure-XMLInputFactory-tp4680348.html
> > Sent from the TomEE Users mailing list archive at Nabble.com.
> >
>
--
Steven P. Goldsmith
Re: Cannot create a secure XMLInputFactory
Posted by Romain Manni-Bucau <rm...@gmail.com>.
Hello
can happen if you provide some xml libraries in your app - like woodstox or
stax*api - and it conflicts at some point.
Romain Manni-Bucau
@rmannibucau <https://twitter.com/rmannibucau> | Blog
<https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
<http://rmannibucau.wordpress.com> | Github <https://github.com/rmannibucau> |
LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
<http://www.tomitribe.com> | JavaEE Factory
<https://javaeefactory-rmannibucau.rhcloud.com>
2016-10-17 17:18 GMT+02:00 sgjava <sg...@gmail.com>:
> Periodically I'm seeing "Cannot create a secure XMLInputFactory" in TomEE
> 7.0.2-SNAPSHOT. One solution is for CXF using
> -Dorg.apache.cxf.stax.allowInsecureParser=1. This is an older 7.0.2 from
> 7/4/16.
>
>
>
> --
> View this message in context: http://tomee-openejb.979440.
> n4.nabble.com/Cannot-create-a-secure-XMLInputFactory-tp4680348.html
> Sent from the TomEE Users mailing list archive at Nabble.com.
>