1. 技术文章
  2. CXF web service client: “Cannot create a secure XMLInputFactory”

CXF web service client: “Cannot create a secure XMLInputFactory”

由 拜拜、爱过 提交于 2019-11-27 13:09:41

Had this problem when upgrading from CXF 2.3.x to 2.7.x

Added stax2-api and woodstox-core-asl jars from the 2.7.x CXF distribution and the webservice works again.

Since version 2.7.4, CXF added a feature in order to ensure that the XMLInputFactory is secured and loaded from woodstox (>= 4.2.x packages, see StaxUtil implementation) in order to deal with a Denial of Service vulnerability

But the fact is that in a J2EE environment, by default, webservices-rt.jar has the priority over war libs (and then over the woodstock jar). That is why the non-secure implementation is loaded, triggering the exception.

Turning off the org.apache.cxf.stax.allowInsecureParser property, is not an option as it brings back the DOS vulnerability.

In order to make the class loader to prefer woodstox (ear/war lib) over webservices-rt.jar (j2ee lib), the solution depends on your application server and is described in CXF application server specific configuration guide

Krish

I had similar problem

After adding this -Dorg.apache.cxf.stax.allowInsecureParser=1 to the JAVA_OPTIONS in setDomainEnv.sh, It is working fine now.

I had this problem on weblogic and fixed the problem by adding this to my weblogic-application.xml

<prefer-application-packages>
       <package-name>com.ctc.wstx.*</package-name>
</prefer-application-packages>

Check for any other versions of woodstox that may be found on the classpath or in the jre's lib/endorsed or similar. It sounds like an older 4.1 version may be picked up.

There was not an answer here that describes the root cause of this error message for my issue. We had transitive dependencies on both a new version woodstox-core-asl-4.2.0.jar and and old wstx-asl-3.2.1.jar

Excluding the old version from our build did the trick.

If you dig into the bowels of the old version, you'll find that it fails with an exception that ends up getting wrapped in another exception with this generic message that is not very informative.

I had the same problem whenI upgraded CXF to 2.7.x. I resolved this by adding following dependencies in POM

<dependency>
    <groupId>org.codehaus.woodstox</groupId>
    <artifactId>stax2-api</artifactId>
    <version>4.0.0</version>
</dependency>
<dependency>
    <groupId>org.codehaus.woodstox</groupId>
    <artifactId>woodstox-core-asl</artifactId>
    <version>4.4.1</version>
</dependency>

I hit this issue and it was because, when i upgraded from an older version of cxf, i did not change stax-api-*.jar to stax2-api-*.jar in my client classpath.

If you upgrade to 3.0.0 or later, you shouldn't add woodstock dependencies

The problem was some missing CXF jar files in the web service deployment on the server. This was tough to debug because there were no errors on the server.

In my case there were two jars (Cxf 3.0.1, Jboss 7.1.1)

javax.xml.stream:stax-api:jar:1.0-2:compile

org.codehaus.woodstox:stax2-api:jar:3.1.4:compile

I removed the 1st one and it started working

from my end, I had to do both remove the stax-api-1.0-2.jar (leaving stax2-api-3.1.4.jar & woodstock 4.4 jar) and specify in the weblogic-application.xml at the end of it: 

     .
     .
     <package-name>com.ctc.wstx.*</package-name>  
     <package-name>org.codehaus.stax2.*</package-name>
 </prefer-application-packages>

I had this problem on weblogic, Application get Deployed Successfully but when i fired the soap-request then i got this fault : Cannot create a secure XMLInputFactory.

fixed the problem by adding this package to weblogic-application.xml

com.ctc.wstx.*

I looked through my dependencies to find version conflicts with woodstox or stax-api.

Turns out that axis2-transport-http introduced these conflicts.

If you happen to have this dependency as well, add the following exclusion to your pom dependency that introduced it

<exclusions>
            <exclusion>
                <groupId>org.apache.axis2</groupId>
                <artifactId>axis2-transport-http</artifactId>
            </exclusion>
        </exclusions>
Aldo Fernando Saia

I can solve this problem by adding weblogic.xml in the WEB-INF folder of my app with the following code:

<prefer-web-inf-classes>false</prefer-web-inf-classes>

<prefer-application-packages>
    <package-name>com.ctc.*</package-name>
</prefer-application-packages>

1: -Dorg.apache.cxf.stax.allowInsecureParser=1 to the JAVA_OPTIONS
or
2: rename woodstox-core-asl-4.4.1.jar -> awoodstox-core-asl-4.4.1.jar

标签
web-services
cxf
woodstox
易学教程内所有资源均来自网络或用户发布的内容，如有违反法律规定的内容欢迎反馈！
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!