cxf-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Aki Yoshida <elak...@gmail.com>
Subject Re: woodstox mandatory?
Date Tue, 02 Apr 2013 14:21:11 GMT
Hi Dan,
I thought the allowInsecureParser option was intended to be used also in osgi.

aki

2013/4/2 Daniel Kulp <dkulp@apache.org>:
>
> On Apr 2, 2013, at 5:25 AM, Aki Yoshida <elakito@gmail.com> wrote:
>
>> that generated a required woodstox import in cxf-api's manifest. That
>> needs to be changed to optional as well.
>
> No, I explicitly did not mark it optional to make sure the OBR would pull it in.
>
> Dan
>
>
>> 2013/4/2 Sergey Beryozkin <sberyozkin@gmail.com>:
>>> On 02/04/13 11:01, Romain Manni-Bucau wrote:
>>>>
>>>> Hi Sergey,
>>>>
>>>> tomee doesn't bring it by default because it is too fatty and not always
>>>> mandatory (same reason we don't bring jackson by default).
>>>>
>>>> i think the issue is not with close() but with the loadclass of staxutils
>>>> which imports woodstox (i run with java 7)
>>>
>>> Yep, see it now... I guess we'll need to externalize a bit the explicit
>>> loading of the Woodstox factory or load it reflectively.
>>> Dan, what would be your preference ?
>>>
>>> Sergey
>>>
>>>
>>>>
>>>> *Romain Manni-Bucau*
>>>> *Twitter: @rmannibucau<https://twitter.com/rmannibucau>*
>>>> *Blog:
>>>> **http://rmannibucau.wordpress.com/*<http://rmannibucau.wordpress.com/>
>>>> *LinkedIn: **http://fr.linkedin.com/in/rmannibucau*
>>>> *Github: https://github.com/rmannibucau*
>>>>
>>>>
>>>>
>>>> 2013/4/2 Sergey Beryozkin<sberyozkin@gmail.com>
>>>>
>>>>> Hi Romain
>>>>>
>>>>> The latest Woodstox has the superior security characteristics with regard
>>>>> to managing large payloads, and this is why it is preferred now,
>>>>> perhaps even TomEE might 'consider' swithcing to it in the future,
>>>>> however, StaxUtils checks a system
>>>>> "org.apache.cxf.stax.**allowInsecureParser"
>>>>> property, in fact at the moment it is set to 'true' by default to let
>>>>> containers like TomEE continue using their parsers of choice.
>>>>>
>>>>> So it appears it is a problem with StaxUtils.close...Or may be you can
>>>>> simply exclude Woodstox from the maven dependencies when upgrading ?
>>>>>
>>>>> Thanks, Sergey
>>>>>
>>>>>
>>>>>
>>>>> On 02/04/13 10:42, Romain Manni-Bucau wrote:
>>>>>
>>>>>> when unmarshalling
>>>>>> (org.apache.cxf.jaxrs.**provider.JAXBElementProvider.**readFrom)
the
>>>>>> reader is
>>>>>> closed thanks to StaxUtils.close(reader); call
>>>>>>
>>>>>> and it triggers:
>>>>>>
>>>>>> org.apache.cxf.jaxrs.client.**ClientWebApplicationException:
>>>>>> java.lang.**NoClassDefFoundError: com/ctc/wstx/stax/**WstxInputFactory
>>>>>>   at org.apache.cxf.jaxrs.client.**WebClient.handleResponse(**
>>>>>> WebClient.java:871)
>>>>>> at
>>>>>> org.apache.cxf.jaxrs.client.**WebClient.doChainedInvocation(**
>>>>>> WebClient.java:841)
>>>>>>   at org.apache.cxf.jaxrs.client.**WebClient.doInvoke(WebClient.**
>>>>>> java:768)
>>>>>> at
>>>>>> org.apache.cxf.jaxrs.client.**WebClient.doInvoke(WebClient.**java:729)
>>>>>>   at
>>>>>> org.apache.cxf.jaxrs.client.**WebClient.invoke(WebClient.**java:345)
>>>>>> at org.apache.cxf.jaxrs.client.**WebClient.get(WebClient.java:**481)
>>>>>>   at
>>>>>> org.superbiz.rest.**UserServiceTest.show(**UserServiceTest.java:95)
>>>>>> at sun.reflect.**NativeMethodAccessorImpl.**invoke0(Native Method)
>>>>>>   at
>>>>>> sun.reflect.**NativeMethodAccessorImpl.**invoke(**
>>>>>> NativeMethodAccessorImpl.java:**57)
>>>>>> at
>>>>>> sun.reflect.**DelegatingMethodAccessorImpl.**invoke(**
>>>>>> DelegatingMethodAccessorImpl.**java:43)
>>>>>>   at
>>>>>> org.junit.runners.model.**FrameworkMethod$1.**runReflectiveCall(**
>>>>>> FrameworkMethod.java:45)
>>>>>> at
>>>>>> org.junit.internal.runners.**model.ReflectiveCallable.run(**
>>>>>> ReflectiveCallable.java:15)
>>>>>>   at
>>>>>> org.junit.runners.model.**FrameworkMethod.**invokeExplosively(**
>>>>>> FrameworkMethod.java:42)
>>>>>> at
>>>>>> org.junit.internal.runners.**statements.InvokeMethod.**
>>>>>> evaluate(InvokeMethod.java:20)
>>>>>>   at org.junit.runners.**ParentRunner.runLeaf(**ParentRunner.java:263)
>>>>>> at
>>>>>> org.junit.runners.**BlockJUnit4ClassRunner.**runChild(**
>>>>>> BlockJUnit4ClassRunner.java:**68)
>>>>>>   at
>>>>>> org.junit.runners.**BlockJUnit4ClassRunner.**runChild(**
>>>>>> BlockJUnit4ClassRunner.java:**47)
>>>>>> at org.junit.runners.**ParentRunner$3.run(**ParentRunner.java:231)
>>>>>>   at
>>>>>> org.junit.runners.**ParentRunner$1.schedule(**ParentRunner.java:60)
>>>>>> at org.junit.runners.**ParentRunner.runChildren(**ParentRunner.java:229)
>>>>>>   at
>>>>>> org.junit.runners.**ParentRunner.access$000(**ParentRunner.java:50)
>>>>>> at org.junit.runners.**ParentRunner$2.evaluate(**ParentRunner.java:222)
>>>>>>   at
>>>>>> org.junit.internal.runners.**statements.RunBefores.**
>>>>>> evaluate(RunBefores.java:28)
>>>>>> at
>>>>>> org.junit.internal.runners.**statements.RunAfters.evaluate(**
>>>>>> RunAfters.java:30)
>>>>>>   at org.junit.runners.**ParentRunner.run(ParentRunner.**java:300)
>>>>>> at org.junit.runner.JUnitCore.**run(JUnitCore.java:157)
>>>>>>   at
>>>>>> com.intellij.junit4.**JUnit4IdeaTestRunner.**startRunnerWithArgs(**
>>>>>> JUnit4IdeaTestRunner.java:77)
>>>>>> at
>>>>>>
>>>>>> com.intellij.rt.execution.**junit.JUnitStarter.**prepareStreamsAndStart(*
>>>>>> *JUnitStarter.java:195)
>>>>>>   at com.intellij.rt.execution.**junit.JUnitStarter.main(**
>>>>>> JUnitStarter.java:63)
>>>>>> at sun.reflect.**NativeMethodAccessorImpl.**invoke0(Native Method)
>>>>>>   at
>>>>>> sun.reflect.**NativeMethodAccessorImpl.**invoke(**
>>>>>> NativeMethodAccessorImpl.java:**57)
>>>>>> at com.intellij.rt.execution.**application.AppMain.main(**
>>>>>> AppMain.java:120)
>>>>>> Caused by: java.lang.**NoClassDefFoundError:
>>>>>> com/ctc/wstx/stax/**WstxInputFactory
>>>>>> at
>>>>>> org.apache.cxf.jaxrs.provider.**JAXBElementProvider.readFrom(**
>>>>>> JAXBElementProvider.java:196)
>>>>>>   at
>>>>>> org.apache.cxf.jaxrs.client.**AbstractClient.readBody(**
>>>>>> AbstractClient.java:446)
>>>>>> at org.apache.cxf.jaxrs.client.**WebClient.handleResponse(**
>>>>>> WebClient.java:857)
>>>>>>   ... 34 more
>>>>>> Caused by: java.lang.**ClassNotFoundException:
>>>>>> com.ctc.wstx.stax.**WstxInputFactory
>>>>>> at java.net.URLClassLoader$1.run(**URLClassLoader.java:366)
>>>>>>   at java.net.URLClassLoader$1.run(**URLClassLoader.java:355)
>>>>>> at java.security.**AccessController.doPrivileged(**Native Method)
>>>>>>   at java.net.URLClassLoader.**findClass(URLClassLoader.java:**354)
>>>>>> at java.lang.ClassLoader.**loadClass(ClassLoader.java:**423)
>>>>>>   at sun.misc.Launcher$**AppClassLoader.loadClass(**Launcher.java:308)
>>>>>> at java.lang.ClassLoader.**loadClass(ClassLoader.java:**356)
>>>>>>   ... 37 more
>>>>>>
>>>>>> *Romain Manni-Bucau*
>>>>>> *Twitter:
>>>>>> @rmannibucau<https://twitter.**com/rmannibucau<https://twitter.com/rmannibucau>
>>>>>>>
>>>>>>> *
>>>>>>
>>>>>> *Blog:
>>>>>> **http://rmannibucau.**wordpress.com/*<http://rmannibucau.wordpress.com/*>
>>>>>> <http://**rmannibucau.wordpress.com/<http://rmannibucau.wordpress.com/>>
>>>>>> *LinkedIn:
>>>>>> **http://fr.linkedin.com/in/**rmannibucau*<http://fr.linkedin.com/in/rmannibucau*>
>>>>>> *Github:
>>>>>> https://github.com/**rmannibucau*<https://github.com/rmannibucau*>
>>>>>>
>>>>>>
>>>>>>
>>>>>> 2013/4/2 Freeman Fang<freeman.fang@gmail.com>
>>>>>>
>>>>>>  Hi,
>>>>>>>
>>>>>>>
>>>>>>> I believe it's just compile time dependency, during runtime,
you still
>>>>>>> can
>>>>>>> use any other stax parser for now.
>>>>>>>
>>>>>>> What's the error you run into?
>>>>>>> -------------
>>>>>>> Freeman(Yue) Fang
>>>>>>>
>>>>>>> Red Hat, Inc.
>>>>>>> FuseSource is now part of Red Hat
>>>>>>> Web: http://fusesource.com | http://www.redhat.com/
>>>>>>> Twitter: freemanfang
>>>>>>> Blog:
>>>>>>> http://freemanfang.blogspot.**com<http://freemanfang.blogspot.com>
>>>>>>>
>>>>>>> http://blog.sina.com.cn/u/**1473905042<http://blog.sina.com.cn/u/1473905042>
>>>>>>> weibo: @Freeman小屋
>>>>>>>
>>>>>>> On 2013-4-2, at 下午3:19, Romain Manni-Bucau wrote:
>>>>>>>
>>>>>>>  Hi,
>>>>>>>>
>>>>>>>>
>>>>>>>> seems woodstox is now mandatory to use cxf (tested with v2.6.7)
>>>>>>>> because
>>>>>>>> of org.apache.cxf.staxutils.**StaxUtils
>>>>>>>>
>>>>>>>> is it normal?
>>>>>>>>
>>>>>>>> in TomEE we were remove it by default so basically it means
we can't
>>>>>>>>
>>>>>>> upgrade
>>>>>>>
>>>>>>>>
>>>>>>>> *Romain Manni-Bucau*
>>>>>>>> *Twitter:
>>>>>>>> @rmannibucau<https://twitter.**com/rmannibucau<https://twitter.com/rmannibucau>
>>>>>>>>>
>>>>>>>>> *
>>>>>>>>
>>>>>>>> *Blog:
>>>>>>>> **http://rmannibucau.**wordpress.com/*<http://rmannibucau.wordpress.com/*>
>>>>>>>> <
>>>>>>>>
>>>>>>> http://rmannibucau.wordpress.**com/<http://rmannibucau.wordpress.com/>>
>>>>>>>
>>>>>>>> *LinkedIn:
>>>>>>>> **http://fr.linkedin.com/in/**rmannibucau*<http://fr.linkedin.com/in/rmannibucau*>
>>>>>>>> *Github:
>>>>>>>> https://github.com/**rmannibucau*<https://github.com/rmannibucau*>
>>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>
>>>>>
>>>>> --
>>>>> Sergey Beryozkin
>>>>>
>>>>> Talend Community Coders
>>>>> http://coders.talend.com/
>>>>>
>>>>> Blog: http://sberyozkin.blogspot.com
>>>>>
>>>>
>>>
>
> --
> Daniel Kulp
> dkulp@apache.org - http://dankulp.com/blog
> Talend Community Coder - http://coders.talend.com
>

Mime
View raw message