As we don't have dependency="true" for woodstox bundles in cxf features.xml, so I think even cxf-api optionally import woodstox package, the woodstox bundle could get installed anyway －－－－－－－－－－－－－ Freeman(Yue) Fang
Red Hat, Inc. FuseSource is now part of Red Hat Web: http://fusesource.com | http://www.redhat.com/ Twitter: freemanfang Blog: http://freemanfang.blogspot.com http://blog.sina.com.cn/u/1473905042 weibo: @Freeman小屋 On 2013-4-2, at 下午10:21, Aki Yoshida wrote: > Hi Dan, > I thought the allowInsecureParser option was intended to be used also in osgi. > > aki > > 2013/4/2 Daniel Kulp <[email protected]>: >> >> On Apr 2, 2013, at 5:25 AM, Aki Yoshida <[email protected]> wrote: >> >>> that generated a required woodstox import in cxf-api's manifest. That >>> needs to be changed to optional as well. >> >> No, I explicitly did not mark it optional to make sure the OBR would pull it >> in. >> >> Dan >> >> >>> 2013/4/2 Sergey Beryozkin <[email protected]>: >>>> On 02/04/13 11:01, Romain Manni-Bucau wrote: >>>>> >>>>> Hi Sergey, >>>>> >>>>> tomee doesn't bring it by default because it is too fatty and not always >>>>> mandatory (same reason we don't bring jackson by default). >>>>> >>>>> i think the issue is not with close() but with the loadclass of staxutils >>>>> which imports woodstox (i run with java 7) >>>> >>>> Yep, see it now... I guess we'll need to externalize a bit the explicit >>>> loading of the Woodstox factory or load it reflectively. >>>> Dan, what would be your preference ? >>>> >>>> Sergey >>>> >>>> >>>>> >>>>> *Romain Manni-Bucau* >>>>> *Twitter: @rmannibucau<https://twitter.com/rmannibucau>* >>>>> *Blog: >>>>> **http://rmannibucau.wordpress.com/*<http://rmannibucau.wordpress.com/> >>>>> *LinkedIn: **http://fr.linkedin.com/in/rmannibucau* >>>>> *Github: https://github.com/rmannibucau* >>>>> >>>>> >>>>> >>>>> 2013/4/2 Sergey Beryozkin<[email protected]> >>>>> >>>>>> Hi Romain >>>>>> >>>>>> The latest Woodstox has the superior security characteristics with regard >>>>>> to managing large payloads, and this is why it is preferred now, >>>>>> perhaps even TomEE might 'consider' swithcing to it in the future, >>>>>> however, StaxUtils checks a system >>>>>> "org.apache.cxf.stax.**allowInsecureParser" >>>>>> property, in fact at the moment it is set to 'true' by default to let >>>>>> containers like TomEE continue using their parsers of choice. >>>>>> >>>>>> So it appears it is a problem with StaxUtils.close...Or may be you can >>>>>> simply exclude Woodstox from the maven dependencies when upgrading ? >>>>>> >>>>>> Thanks, Sergey >>>>>> >>>>>> >>>>>> >>>>>> On 02/04/13 10:42, Romain Manni-Bucau wrote: >>>>>> >>>>>>> when unmarshalling >>>>>>> (org.apache.cxf.jaxrs.**provider.JAXBElementProvider.**readFrom) the >>>>>>> reader is >>>>>>> closed thanks to StaxUtils.close(reader); call >>>>>>> >>>>>>> and it triggers: >>>>>>> >>>>>>> org.apache.cxf.jaxrs.client.**ClientWebApplicationException: >>>>>>> java.lang.**NoClassDefFoundError: com/ctc/wstx/stax/**WstxInputFactory >>>>>>> at org.apache.cxf.jaxrs.client.**WebClient.handleResponse(** >>>>>>> WebClient.java:871) >>>>>>> at >>>>>>> org.apache.cxf.jaxrs.client.**WebClient.doChainedInvocation(** >>>>>>> WebClient.java:841) >>>>>>> at org.apache.cxf.jaxrs.client.**WebClient.doInvoke(WebClient.** >>>>>>> java:768) >>>>>>> at >>>>>>> org.apache.cxf.jaxrs.client.**WebClient.doInvoke(WebClient.**java:729) >>>>>>> at >>>>>>> org.apache.cxf.jaxrs.client.**WebClient.invoke(WebClient.**java:345) >>>>>>> at org.apache.cxf.jaxrs.client.**WebClient.get(WebClient.java:**481) >>>>>>> at >>>>>>> org.superbiz.rest.**UserServiceTest.show(**UserServiceTest.java:95) >>>>>>> at sun.reflect.**NativeMethodAccessorImpl.**invoke0(Native Method) >>>>>>> at >>>>>>> sun.reflect.**NativeMethodAccessorImpl.**invoke(** >>>>>>> NativeMethodAccessorImpl.java:**57) >>>>>>> at >>>>>>> sun.reflect.**DelegatingMethodAccessorImpl.**invoke(** >>>>>>> DelegatingMethodAccessorImpl.**java:43) >>>>>>> at >>>>>>> org.junit.runners.model.**FrameworkMethod$1.**runReflectiveCall(** >>>>>>> FrameworkMethod.java:45) >>>>>>> at >>>>>>> org.junit.internal.runners.**model.ReflectiveCallable.run(** >>>>>>> ReflectiveCallable.java:15) >>>>>>> at >>>>>>> org.junit.runners.model.**FrameworkMethod.**invokeExplosively(** >>>>>>> FrameworkMethod.java:42) >>>>>>> at >>>>>>> org.junit.internal.runners.**statements.InvokeMethod.** >>>>>>> evaluate(InvokeMethod.java:20) >>>>>>> at org.junit.runners.**ParentRunner.runLeaf(**ParentRunner.java:263) >>>>>>> at >>>>>>> org.junit.runners.**BlockJUnit4ClassRunner.**runChild(** >>>>>>> BlockJUnit4ClassRunner.java:**68) >>>>>>> at >>>>>>> org.junit.runners.**BlockJUnit4ClassRunner.**runChild(** >>>>>>> BlockJUnit4ClassRunner.java:**47) >>>>>>> at org.junit.runners.**ParentRunner$3.run(**ParentRunner.java:231) >>>>>>> at >>>>>>> org.junit.runners.**ParentRunner$1.schedule(**ParentRunner.java:60) >>>>>>> at org.junit.runners.**ParentRunner.runChildren(**ParentRunner.java:229) >>>>>>> at >>>>>>> org.junit.runners.**ParentRunner.access$000(**ParentRunner.java:50) >>>>>>> at org.junit.runners.**ParentRunner$2.evaluate(**ParentRunner.java:222) >>>>>>> at >>>>>>> org.junit.internal.runners.**statements.RunBefores.** >>>>>>> evaluate(RunBefores.java:28) >>>>>>> at >>>>>>> org.junit.internal.runners.**statements.RunAfters.evaluate(** >>>>>>> RunAfters.java:30) >>>>>>> at org.junit.runners.**ParentRunner.run(ParentRunner.**java:300) >>>>>>> at org.junit.runner.JUnitCore.**run(JUnitCore.java:157) >>>>>>> at >>>>>>> com.intellij.junit4.**JUnit4IdeaTestRunner.**startRunnerWithArgs(** >>>>>>> JUnit4IdeaTestRunner.java:77) >>>>>>> at >>>>>>> >>>>>>> com.intellij.rt.execution.**junit.JUnitStarter.**prepareStreamsAndStart(* >>>>>>> *JUnitStarter.java:195) >>>>>>> at com.intellij.rt.execution.**junit.JUnitStarter.main(** >>>>>>> JUnitStarter.java:63) >>>>>>> at sun.reflect.**NativeMethodAccessorImpl.**invoke0(Native Method) >>>>>>> at >>>>>>> sun.reflect.**NativeMethodAccessorImpl.**invoke(** >>>>>>> NativeMethodAccessorImpl.java:**57) >>>>>>> at com.intellij.rt.execution.**application.AppMain.main(** >>>>>>> AppMain.java:120) >>>>>>> Caused by: java.lang.**NoClassDefFoundError: >>>>>>> com/ctc/wstx/stax/**WstxInputFactory >>>>>>> at >>>>>>> org.apache.cxf.jaxrs.provider.**JAXBElementProvider.readFrom(** >>>>>>> JAXBElementProvider.java:196) >>>>>>> at >>>>>>> org.apache.cxf.jaxrs.client.**AbstractClient.readBody(** >>>>>>> AbstractClient.java:446) >>>>>>> at org.apache.cxf.jaxrs.client.**WebClient.handleResponse(** >>>>>>> WebClient.java:857) >>>>>>> ... 34 more >>>>>>> Caused by: java.lang.**ClassNotFoundException: >>>>>>> com.ctc.wstx.stax.**WstxInputFactory >>>>>>> at java.net.URLClassLoader$1.run(**URLClassLoader.java:366) >>>>>>> at java.net.URLClassLoader$1.run(**URLClassLoader.java:355) >>>>>>> at java.security.**AccessController.doPrivileged(**Native Method) >>>>>>> at java.net.URLClassLoader.**findClass(URLClassLoader.java:**354) >>>>>>> at java.lang.ClassLoader.**loadClass(ClassLoader.java:**423) >>>>>>> at sun.misc.Launcher$**AppClassLoader.loadClass(**Launcher.java:308) >>>>>>> at java.lang.ClassLoader.**loadClass(ClassLoader.java:**356) >>>>>>> ... 37 more >>>>>>> >>>>>>> *Romain Manni-Bucau* >>>>>>> *Twitter: >>>>>>> @rmannibucau<https://twitter.**com/rmannibucau<https://twitter.com/rmannibucau> >>>>>>>> >>>>>>>> * >>>>>>> >>>>>>> *Blog: >>>>>>> **http://rmannibucau.**wordpress.com/*<http://rmannibucau.wordpress.com/*> >>>>>>> <http://**rmannibucau.wordpress.com/<http://rmannibucau.wordpress.com/>> >>>>>>> *LinkedIn: >>>>>>> **http://fr.linkedin.com/in/**rmannibucau*<http://fr.linkedin.com/in/rmannibucau*> >>>>>>> *Github: >>>>>>> https://github.com/**rmannibucau*<https://github.com/rmannibucau*> >>>>>>> >>>>>>> >>>>>>> >>>>>>> 2013/4/2 Freeman Fang<[email protected]> >>>>>>> >>>>>>> Hi, >>>>>>>> >>>>>>>> >>>>>>>> I believe it's just compile time dependency, during runtime, you still >>>>>>>> can >>>>>>>> use any other stax parser for now. >>>>>>>> >>>>>>>> What's the error you run into? >>>>>>>> －－－－－－－－－－－－－ >>>>>>>> Freeman(Yue) Fang >>>>>>>> >>>>>>>> Red Hat, Inc. >>>>>>>> FuseSource is now part of Red Hat >>>>>>>> Web: http://fusesource.com | http://www.redhat.com/ >>>>>>>> Twitter: freemanfang >>>>>>>> Blog: >>>>>>>> http://freemanfang.blogspot.**com<http://freemanfang.blogspot.com> >>>>>>>> >>>>>>>> http://blog.sina.com.cn/u/**1473905042<http://blog.sina.com.cn/u/1473905042> >>>>>>>> weibo: @Freeman小屋 >>>>>>>> >>>>>>>> On 2013-4-2, at 下午3:19, Romain Manni-Bucau wrote: >>>>>>>> >>>>>>>> Hi, >>>>>>>>> >>>>>>>>> >>>>>>>>> seems woodstox is now mandatory to use cxf (tested with v2.6.7) >>>>>>>>> because >>>>>>>>> of org.apache.cxf.staxutils.**StaxUtils >>>>>>>>> >>>>>>>>> is it normal? >>>>>>>>> >>>>>>>>> in TomEE we were remove it by default so basically it means we can't >>>>>>>>> >>>>>>>> upgrade >>>>>>>> >>>>>>>>> >>>>>>>>> *Romain Manni-Bucau* >>>>>>>>> *Twitter: >>>>>>>>> @rmannibucau<https://twitter.**com/rmannibucau<https://twitter.com/rmannibucau> >>>>>>>>>> >>>>>>>>>> * >>>>>>>>> >>>>>>>>> *Blog: >>>>>>>>> **http://rmannibucau.**wordpress.com/*<http://rmannibucau.wordpress.com/*> >>>>>>>>> < >>>>>>>>> >>>>>>>> http://rmannibucau.wordpress.**com/<http://rmannibucau.wordpress.com/>> >>>>>>>> >>>>>>>>> *LinkedIn: >>>>>>>>> **http://fr.linkedin.com/in/**rmannibucau*<http://fr.linkedin.com/in/rmannibucau*> >>>>>>>>> *Github: >>>>>>>>> https://github.com/**rmannibucau*<https://github.com/rmannibucau*> >>>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>> >>>>>> >>>>>> -- >>>>>> Sergey Beryozkin >>>>>> >>>>>> Talend Community Coders >>>>>> http://coders.talend.com/ >>>>>> >>>>>> Blog: http://sberyozkin.blogspot.com >>>>>> >>>>> >>>> >> >> -- >> Daniel Kulp >> [email protected] - http://dankulp.com/blog >> Talend Community Coder - http://coders.talend.com >>
