subject:"Re\: Cannot create a secure XMLInputFactory"

Re: Cannot create a secure XMLInputFactory

2016-10-19 Thread Steve Goldsmith

I've done a little more digging and the cxf-core jar I built is not
throwing the "Cannot create a secure XMLInputFactory".

Note the comment:

private static boolean setRestrictionProperties(XMLInputFactory
factory) {
//For now, we can only support Woodstox 4.2.x and newer as none of
the other
//stax parsers support these settings

[INFO] +- org.apache.cxf:cxf-core:jar:3.2.0-SNAPSHOT:test
[INFO] |  +- org.codehaus.woodstox:woodstox-core-asl:jar:4.4.1:test
[INFO] |  |  \- org.codehaus.woodstox:stax2-api:jar:3.1.4:test

Shouldn't stax2-api be 4.2.x or higher?


On Tue, Oct 18, 2016 at 4:50 PM, Romain Manni-Bucau 
wrote:

> maybe try to reproduce the issue and share a project on github, would
> probably be more efficient
>
>
> Romain Manni-Bucau
> @rmannibucau  |  Blog
>  | Old Wordpress Blog
>  | Github  rmannibucau> |
> LinkedIn  | Tomitriber
>  | JavaEE Factory
> 
>
> 2016-10-18 22:37 GMT+02:00 Steve Goldsmith :
>
> > This string also exists in createXMLInputFactory, but it's not logging
> > there either (in the exception code) :) I added:
> >
> > public static XMLInputFactory createXMLInputFactory(boolean nsAware)
> {
> > XMLInputFactory factory = null;
> > try {
> > factory = XMLInputFactory.newInstance();
> > System.out.println("XMLInputFactory " +
> > factory.getClass().getName());
> >
> > and get:
> >
> > XMLInputFactory com.ctc.wstx.stax.WstxInputFactory
> >
> >
> >
> >
> > On Tue, Oct 18, 2016 at 4:10 PM, Romain Manni-Bucau <
> rmannibu...@gmail.com
> > >
> > wrote:
> >
> > > Well i dont see this output as well
> > >
> > > Le 18 oct. 2016 20:28, "Steve Goldsmith"  a écrit :
> > >
> > > > It didn't throw an exception there then because I added
> > > > System.out.println("setProperty error" + t.getStackTrace()); in the
> > > catch
> > > > section. This method swallows exceptions any ways, so it couldn't be
> > the
> > > > one throwing the exception?
> > > >
> > > > On Tue, Oct 18, 2016 at 2:18 PM, Romain Manni-Bucau <
> > > rmannibu...@gmail.com
> > > > >
> > > > wrote:
> > > >
> > > > > I dont see any error there or am i abused by gmail formatting?
> > > > >
> > > > > Le 18 oct. 2016 19:28, "Steve Goldsmith"  a
> écrit
> > :
> > > > >
> > > > > > OK, I made the change:
> > > > > >
> > > > > > private static boolean setProperty(XMLInputFactory f, String
> p,
> > > > > Object
> > > > > > o) {
> > > > > > try {
> > > > > > System.out.println("setProperty f: " + f + " p: " +
> p
> > +
> > > "
> > > > > o:"
> > > > > > +
> > > > > > o);
> > > > > > f.setProperty(p,  o);
> > > > > > return true;
> > > > > > } catch (Throwable t) {
> > > > > > System.out.println("setProperty error" +
> > > > t.getStackTrace());
> > > > > > //ignore
> > > > > > }
> > > > > > return false;
> > > > > > }
> > > > > >
> > > > > > and it dumps this:
> > > > > >
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > com.ctc.wstx.maxAttributesPerElement o:500
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > com.ctc.wstx.maxAttributeSize o:65536
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > com.ctc.wstx.maxChildrenPerElement o:5
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > com.ctc.wstx.maxElementCount o:9223372036854775807
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > com.ctc.wstx.maxElementDepth o:100
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > com.ctc.wstx.maxCharacters o:9223372036854775807
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > com.ctc.wstx.maxTextLength o:134217728
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > com.ctc.wstx.minTextSegment o:64
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > javax.xml.stream.isNamespaceAware o:true
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > javax.xml.stream.supportDTD o:false
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > javax.xml.stream.isReplacingEntityReferences o:false
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > javax.xml.stream.isSupportingExternalEntities o:false
> > > > > >
> > > > > >
> > > > > >
> > > > > > On Tue, Oct 18, 2016 at 12:14 PM, Romain Manni-Bucau <
> > > > > > rmannibu...@gmail.com>
> > > > > > wrote:
> > > > > >
> > > > > >

Re: Cannot create a secure XMLInputFactory

2016-10-18 Thread Steve Goldsmith

Yea, unfortunately this is one of those hard to reproduce stand alone apps
since I rely on propritary services for the SOAP clients. I'll keep digging
based on the error string. I'll check for all instances of it in CXF.

On Tue, Oct 18, 2016 at 4:50 PM, Romain Manni-Bucau 
wrote:

> maybe try to reproduce the issue and share a project on github, would
> probably be more efficient
>
>
> Romain Manni-Bucau
> @rmannibucau  |  Blog
>  | Old Wordpress Blog
>  | Github  rmannibucau> |
> LinkedIn  | Tomitriber
>  | JavaEE Factory
> 
>
> 2016-10-18 22:37 GMT+02:00 Steve Goldsmith :
>
> > This string also exists in createXMLInputFactory, but it's not logging
> > there either (in the exception code) :) I added:
> >
> > public static XMLInputFactory createXMLInputFactory(boolean nsAware)
> {
> > XMLInputFactory factory = null;
> > try {
> > factory = XMLInputFactory.newInstance();
> > System.out.println("XMLInputFactory " +
> > factory.getClass().getName());
> >
> > and get:
> >
> > XMLInputFactory com.ctc.wstx.stax.WstxInputFactory
> >
> >
> >
> >
> > On Tue, Oct 18, 2016 at 4:10 PM, Romain Manni-Bucau <
> rmannibu...@gmail.com
> > >
> > wrote:
> >
> > > Well i dont see this output as well
> > >
> > > Le 18 oct. 2016 20:28, "Steve Goldsmith"  a écrit :
> > >
> > > > It didn't throw an exception there then because I added
> > > > System.out.println("setProperty error" + t.getStackTrace()); in the
> > > catch
> > > > section. This method swallows exceptions any ways, so it couldn't be
> > the
> > > > one throwing the exception?
> > > >
> > > > On Tue, Oct 18, 2016 at 2:18 PM, Romain Manni-Bucau <
> > > rmannibu...@gmail.com
> > > > >
> > > > wrote:
> > > >
> > > > > I dont see any error there or am i abused by gmail formatting?
> > > > >
> > > > > Le 18 oct. 2016 19:28, "Steve Goldsmith"  a
> écrit
> > :
> > > > >
> > > > > > OK, I made the change:
> > > > > >
> > > > > > private static boolean setProperty(XMLInputFactory f, String
> p,
> > > > > Object
> > > > > > o) {
> > > > > > try {
> > > > > > System.out.println("setProperty f: " + f + " p: " +
> p
> > +
> > > "
> > > > > o:"
> > > > > > +
> > > > > > o);
> > > > > > f.setProperty(p,  o);
> > > > > > return true;
> > > > > > } catch (Throwable t) {
> > > > > > System.out.println("setProperty error" +
> > > > t.getStackTrace());
> > > > > > //ignore
> > > > > > }
> > > > > > return false;
> > > > > > }
> > > > > >
> > > > > > and it dumps this:
> > > > > >
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > com.ctc.wstx.maxAttributesPerElement o:500
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > com.ctc.wstx.maxAttributeSize o:65536
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > com.ctc.wstx.maxChildrenPerElement o:5
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > com.ctc.wstx.maxElementCount o:9223372036854775807
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > com.ctc.wstx.maxElementDepth o:100
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > com.ctc.wstx.maxCharacters o:9223372036854775807
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > com.ctc.wstx.maxTextLength o:134217728
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > com.ctc.wstx.minTextSegment o:64
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > javax.xml.stream.isNamespaceAware o:true
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > javax.xml.stream.supportDTD o:false
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > javax.xml.stream.isReplacingEntityReferences o:false
> > > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > > javax.xml.stream.isSupportingExternalEntities o:false
> > > > > >
> > > > > >
> > > > > >
> > > > > > On Tue, Oct 18, 2016 at 12:14 PM, Romain Manni-Bucau <
> > > > > > rmannibu...@gmail.com>
> > > > > > wrote:
> > > > > >
> > > > > > > for tomee embedded yes
> > > > > > >
> > > > > > >
> > > > > > > Romain Manni-Bucau
> > > > > > > @rmannibucau  |  Blog
> > > > > > >  | Old Wordpress Blog
> > > > > > >  | Github <
> https://github.com/
> > > > > > > rmannibucau> |
> > > > > > > LinkedIn

Re: Cannot create a secure XMLInputFactory

2016-10-18 Thread Romain Manni-Bucau

maybe try to reproduce the issue and share a project on github, would
probably be more efficient


Romain Manni-Bucau
@rmannibucau  |  Blog
 | Old Wordpress Blog
 | Github  |
LinkedIn  | Tomitriber
 | JavaEE Factory


2016-10-18 22:37 GMT+02:00 Steve Goldsmith :

> This string also exists in createXMLInputFactory, but it's not logging
> there either (in the exception code) :) I added:
>
> public static XMLInputFactory createXMLInputFactory(boolean nsAware) {
> XMLInputFactory factory = null;
> try {
> factory = XMLInputFactory.newInstance();
> System.out.println("XMLInputFactory " +
> factory.getClass().getName());
>
> and get:
>
> XMLInputFactory com.ctc.wstx.stax.WstxInputFactory
>
>
>
>
> On Tue, Oct 18, 2016 at 4:10 PM, Romain Manni-Bucau  >
> wrote:
>
> > Well i dont see this output as well
> >
> > Le 18 oct. 2016 20:28, "Steve Goldsmith"  a écrit :
> >
> > > It didn't throw an exception there then because I added
> > > System.out.println("setProperty error" + t.getStackTrace()); in the
> > catch
> > > section. This method swallows exceptions any ways, so it couldn't be
> the
> > > one throwing the exception?
> > >
> > > On Tue, Oct 18, 2016 at 2:18 PM, Romain Manni-Bucau <
> > rmannibu...@gmail.com
> > > >
> > > wrote:
> > >
> > > > I dont see any error there or am i abused by gmail formatting?
> > > >
> > > > Le 18 oct. 2016 19:28, "Steve Goldsmith"  a écrit
> :
> > > >
> > > > > OK, I made the change:
> > > > >
> > > > > private static boolean setProperty(XMLInputFactory f, String p,
> > > > Object
> > > > > o) {
> > > > > try {
> > > > > System.out.println("setProperty f: " + f + " p: " + p
> +
> > "
> > > > o:"
> > > > > +
> > > > > o);
> > > > > f.setProperty(p,  o);
> > > > > return true;
> > > > > } catch (Throwable t) {
> > > > > System.out.println("setProperty error" +
> > > t.getStackTrace());
> > > > > //ignore
> > > > > }
> > > > > return false;
> > > > > }
> > > > >
> > > > > and it dumps this:
> > > > >
> > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > com.ctc.wstx.maxAttributesPerElement o:500
> > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > com.ctc.wstx.maxAttributeSize o:65536
> > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > com.ctc.wstx.maxChildrenPerElement o:5
> > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > com.ctc.wstx.maxElementCount o:9223372036854775807
> > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > com.ctc.wstx.maxElementDepth o:100
> > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > com.ctc.wstx.maxCharacters o:9223372036854775807
> > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > com.ctc.wstx.maxTextLength o:134217728
> > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > com.ctc.wstx.minTextSegment o:64
> > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > javax.xml.stream.isNamespaceAware o:true
> > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > javax.xml.stream.supportDTD o:false
> > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > javax.xml.stream.isReplacingEntityReferences o:false
> > > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > > javax.xml.stream.isSupportingExternalEntities o:false
> > > > >
> > > > >
> > > > >
> > > > > On Tue, Oct 18, 2016 at 12:14 PM, Romain Manni-Bucau <
> > > > > rmannibu...@gmail.com>
> > > > > wrote:
> > > > >
> > > > > > for tomee embedded yes
> > > > > >
> > > > > >
> > > > > > Romain Manni-Bucau
> > > > > > @rmannibucau  |  Blog
> > > > > >  | Old Wordpress Blog
> > > > > >  | Github  > > > > > rmannibucau> |
> > > > > > LinkedIn  | Tomitriber
> > > > > >  | JavaEE Factory
> > > > > > 
> > > > > >
> > > > > > 2016-10-18 18:11 GMT+02:00 Steve Goldsmith :
> > > > > >
> > > > > > > In other words, if I build a debug logging version of cxf how
> > > would I
> > > > > > > incorporate that into my TomEE embedded test? Can I just add
> the
> > > > > > dependency
> > > > > > > in Maven or do I have to exclude the version bundled in TomEE?
> > > > > > >
> > >

Re: Cannot create a secure XMLInputFactory

2016-10-18 Thread Steve Goldsmith

This string also exists in createXMLInputFactory, but it's not logging
there either (in the exception code) :) I added:

public static XMLInputFactory createXMLInputFactory(boolean nsAware) {
XMLInputFactory factory = null;
try {
factory = XMLInputFactory.newInstance();
System.out.println("XMLInputFactory " +
factory.getClass().getName());

and get:

XMLInputFactory com.ctc.wstx.stax.WstxInputFactory




On Tue, Oct 18, 2016 at 4:10 PM, Romain Manni-Bucau 
wrote:

> Well i dont see this output as well
>
> Le 18 oct. 2016 20:28, "Steve Goldsmith"  a écrit :
>
> > It didn't throw an exception there then because I added
> > System.out.println("setProperty error" + t.getStackTrace()); in the
> catch
> > section. This method swallows exceptions any ways, so it couldn't be the
> > one throwing the exception?
> >
> > On Tue, Oct 18, 2016 at 2:18 PM, Romain Manni-Bucau <
> rmannibu...@gmail.com
> > >
> > wrote:
> >
> > > I dont see any error there or am i abused by gmail formatting?
> > >
> > > Le 18 oct. 2016 19:28, "Steve Goldsmith"  a écrit :
> > >
> > > > OK, I made the change:
> > > >
> > > > private static boolean setProperty(XMLInputFactory f, String p,
> > > Object
> > > > o) {
> > > > try {
> > > > System.out.println("setProperty f: " + f + " p: " + p +
> "
> > > o:"
> > > > +
> > > > o);
> > > > f.setProperty(p,  o);
> > > > return true;
> > > > } catch (Throwable t) {
> > > > System.out.println("setProperty error" +
> > t.getStackTrace());
> > > > //ignore
> > > > }
> > > > return false;
> > > > }
> > > >
> > > > and it dumps this:
> > > >
> > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > com.ctc.wstx.maxAttributesPerElement o:500
> > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > com.ctc.wstx.maxAttributeSize o:65536
> > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > com.ctc.wstx.maxChildrenPerElement o:5
> > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > com.ctc.wstx.maxElementCount o:9223372036854775807
> > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > com.ctc.wstx.maxElementDepth o:100
> > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > com.ctc.wstx.maxCharacters o:9223372036854775807
> > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > com.ctc.wstx.maxTextLength o:134217728
> > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > com.ctc.wstx.minTextSegment o:64
> > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > javax.xml.stream.isNamespaceAware o:true
> > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > javax.xml.stream.supportDTD o:false
> > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > javax.xml.stream.isReplacingEntityReferences o:false
> > > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > > javax.xml.stream.isSupportingExternalEntities o:false
> > > >
> > > >
> > > >
> > > > On Tue, Oct 18, 2016 at 12:14 PM, Romain Manni-Bucau <
> > > > rmannibu...@gmail.com>
> > > > wrote:
> > > >
> > > > > for tomee embedded yes
> > > > >
> > > > >
> > > > > Romain Manni-Bucau
> > > > > @rmannibucau  |  Blog
> > > > >  | Old Wordpress Blog
> > > > >  | Github  > > > > rmannibucau> |
> > > > > LinkedIn  | Tomitriber
> > > > >  | JavaEE Factory
> > > > > 
> > > > >
> > > > > 2016-10-18 18:11 GMT+02:00 Steve Goldsmith :
> > > > >
> > > > > > In other words, if I build a debug logging version of cxf how
> > would I
> > > > > > incorporate that into my TomEE embedded test? Can I just add the
> > > > > dependency
> > > > > > in Maven or do I have to exclude the version bundled in TomEE?
> > > > > >
> > > > > > On Tue, Oct 18, 2016 at 11:52 AM, Romain Manni-Bucau <
> > > > > > rmannibu...@gmail.com>
> > > > > > wrote:
> > > > > >
> > > > > > > you should switch them I guess.
> > > > > > >
> > > > > > > Generally speaking if you include cxf dependencies in your
> > > > application
> > > > > > > there is a property in tomee to ask it to isolate the webapp
> from
> > > the
> > > > > > > container for cxf - not sure I got your question right.
> > > > > > >
> > > > > > >
> > > > > > > Romain Manni-Bucau
> > > > > > > @rmannibucau  |  Blog
> > > > > > >  | Old Wordpress Blog
> > > > > > >  | Github <
> https://github.com/
> > > > > > > rmannibucau> |
> >

Re: Cannot create a secure XMLInputFactory

2016-10-18 Thread Romain Manni-Bucau

Well i dont see this output as well

Le 18 oct. 2016 20:28, "Steve Goldsmith"  a écrit :

> It didn't throw an exception there then because I added
> System.out.println("setProperty error" + t.getStackTrace()); in the catch
> section. This method swallows exceptions any ways, so it couldn't be the
> one throwing the exception?
>
> On Tue, Oct 18, 2016 at 2:18 PM, Romain Manni-Bucau  >
> wrote:
>
> > I dont see any error there or am i abused by gmail formatting?
> >
> > Le 18 oct. 2016 19:28, "Steve Goldsmith"  a écrit :
> >
> > > OK, I made the change:
> > >
> > > private static boolean setProperty(XMLInputFactory f, String p,
> > Object
> > > o) {
> > > try {
> > > System.out.println("setProperty f: " + f + " p: " + p + "
> > o:"
> > > +
> > > o);
> > > f.setProperty(p,  o);
> > > return true;
> > > } catch (Throwable t) {
> > > System.out.println("setProperty error" +
> t.getStackTrace());
> > > //ignore
> > > }
> > > return false;
> > > }
> > >
> > > and it dumps this:
> > >
> > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > com.ctc.wstx.maxAttributesPerElement o:500
> > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > com.ctc.wstx.maxAttributeSize o:65536
> > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > com.ctc.wstx.maxChildrenPerElement o:5
> > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > com.ctc.wstx.maxElementCount o:9223372036854775807
> > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > com.ctc.wstx.maxElementDepth o:100
> > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > com.ctc.wstx.maxCharacters o:9223372036854775807
> > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > com.ctc.wstx.maxTextLength o:134217728
> > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > com.ctc.wstx.minTextSegment o:64
> > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > javax.xml.stream.isNamespaceAware o:true
> > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > javax.xml.stream.supportDTD o:false
> > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > javax.xml.stream.isReplacingEntityReferences o:false
> > > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > > javax.xml.stream.isSupportingExternalEntities o:false
> > >
> > >
> > >
> > > On Tue, Oct 18, 2016 at 12:14 PM, Romain Manni-Bucau <
> > > rmannibu...@gmail.com>
> > > wrote:
> > >
> > > > for tomee embedded yes
> > > >
> > > >
> > > > Romain Manni-Bucau
> > > > @rmannibucau  |  Blog
> > > >  | Old Wordpress Blog
> > > >  | Github  > > > rmannibucau> |
> > > > LinkedIn  | Tomitriber
> > > >  | JavaEE Factory
> > > > 
> > > >
> > > > 2016-10-18 18:11 GMT+02:00 Steve Goldsmith :
> > > >
> > > > > In other words, if I build a debug logging version of cxf how
> would I
> > > > > incorporate that into my TomEE embedded test? Can I just add the
> > > > dependency
> > > > > in Maven or do I have to exclude the version bundled in TomEE?
> > > > >
> > > > > On Tue, Oct 18, 2016 at 11:52 AM, Romain Manni-Bucau <
> > > > > rmannibu...@gmail.com>
> > > > > wrote:
> > > > >
> > > > > > you should switch them I guess.
> > > > > >
> > > > > > Generally speaking if you include cxf dependencies in your
> > > application
> > > > > > there is a property in tomee to ask it to isolate the webapp from
> > the
> > > > > > container for cxf - not sure I got your question right.
> > > > > >
> > > > > >
> > > > > > Romain Manni-Bucau
> > > > > > @rmannibucau  |  Blog
> > > > > >  | Old Wordpress Blog
> > > > > >  | Github  > > > > > rmannibucau> |
> > > > > > LinkedIn  | Tomitriber
> > > > > >  | JavaEE Factory
> > > > > > 
> > > > > >
> > > > > > 2016-10-18 17:40 GMT+02:00 Steve Goldsmith :
> > > > > >
> > > > > > > Do I have to exclude current CXF in TomEE dependencies or just
> > > > include
> > > > > > the
> > > > > > > debug version I'm building?
> > > > > > >
> > > > > > > On Tue, Oct 18, 2016 at 2:46 AM, Romain Manni-Bucau <
> > > > > > rmannibu...@gmail.com
> > > > > > > >
> > > > > > > wrote:
> > > > > > >
> > > > > > > > As mentionned in the previous answer this is not in tomee
> > sources
> > > > but
> > > > > > > CXF,
> > > > > > > > agree it should be

Re: Cannot create a secure XMLInputFactory

2016-10-18 Thread Steve Goldsmith

It didn't throw an exception there then because I added
System.out.println("setProperty error" + t.getStackTrace()); in the catch
section. This method swallows exceptions any ways, so it couldn't be the
one throwing the exception?

On Tue, Oct 18, 2016 at 2:18 PM, Romain Manni-Bucau 
wrote:

> I dont see any error there or am i abused by gmail formatting?
>
> Le 18 oct. 2016 19:28, "Steve Goldsmith"  a écrit :
>
> > OK, I made the change:
> >
> > private static boolean setProperty(XMLInputFactory f, String p,
> Object
> > o) {
> > try {
> > System.out.println("setProperty f: " + f + " p: " + p + "
> o:"
> > +
> > o);
> > f.setProperty(p,  o);
> > return true;
> > } catch (Throwable t) {
> > System.out.println("setProperty error" + t.getStackTrace());
> > //ignore
> > }
> > return false;
> > }
> >
> > and it dumps this:
> >
> > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > com.ctc.wstx.maxAttributesPerElement o:500
> > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > com.ctc.wstx.maxAttributeSize o:65536
> > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > com.ctc.wstx.maxChildrenPerElement o:5
> > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > com.ctc.wstx.maxElementCount o:9223372036854775807
> > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > com.ctc.wstx.maxElementDepth o:100
> > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > com.ctc.wstx.maxCharacters o:9223372036854775807
> > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > com.ctc.wstx.maxTextLength o:134217728
> > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > com.ctc.wstx.minTextSegment o:64
> > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > javax.xml.stream.isNamespaceAware o:true
> > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > javax.xml.stream.supportDTD o:false
> > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > javax.xml.stream.isReplacingEntityReferences o:false
> > setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> > javax.xml.stream.isSupportingExternalEntities o:false
> >
> >
> >
> > On Tue, Oct 18, 2016 at 12:14 PM, Romain Manni-Bucau <
> > rmannibu...@gmail.com>
> > wrote:
> >
> > > for tomee embedded yes
> > >
> > >
> > > Romain Manni-Bucau
> > > @rmannibucau  |  Blog
> > >  | Old Wordpress Blog
> > >  | Github  > > rmannibucau> |
> > > LinkedIn  | Tomitriber
> > >  | JavaEE Factory
> > > 
> > >
> > > 2016-10-18 18:11 GMT+02:00 Steve Goldsmith :
> > >
> > > > In other words, if I build a debug logging version of cxf how would I
> > > > incorporate that into my TomEE embedded test? Can I just add the
> > > dependency
> > > > in Maven or do I have to exclude the version bundled in TomEE?
> > > >
> > > > On Tue, Oct 18, 2016 at 11:52 AM, Romain Manni-Bucau <
> > > > rmannibu...@gmail.com>
> > > > wrote:
> > > >
> > > > > you should switch them I guess.
> > > > >
> > > > > Generally speaking if you include cxf dependencies in your
> > application
> > > > > there is a property in tomee to ask it to isolate the webapp from
> the
> > > > > container for cxf - not sure I got your question right.
> > > > >
> > > > >
> > > > > Romain Manni-Bucau
> > > > > @rmannibucau  |  Blog
> > > > >  | Old Wordpress Blog
> > > > >  | Github  > > > > rmannibucau> |
> > > > > LinkedIn  | Tomitriber
> > > > >  | JavaEE Factory
> > > > > 
> > > > >
> > > > > 2016-10-18 17:40 GMT+02:00 Steve Goldsmith :
> > > > >
> > > > > > Do I have to exclude current CXF in TomEE dependencies or just
> > > include
> > > > > the
> > > > > > debug version I'm building?
> > > > > >
> > > > > > On Tue, Oct 18, 2016 at 2:46 AM, Romain Manni-Bucau <
> > > > > rmannibu...@gmail.com
> > > > > > >
> > > > > > wrote:
> > > > > >
> > > > > > > As mentionned in the previous answer this is not in tomee
> sources
> > > but
> > > > > > CXF,
> > > > > > > agree it should be logged at debug level but with current code
> > > > > debugging
> > > > > > is
> > > > > > > the fastest.
> > > > > > >
> > > > > > > Side note: you dont need to build tomee from sources, just need
> > to
> > > > add
> > > > > > > cxf-core.
> > > > > > >
> > > > > > >
> > > > > > > Romain Manni-Bucau
> > > > > > > @rmannibucau

Re: Cannot create a secure XMLInputFactory

2016-10-18 Thread Romain Manni-Bucau

I dont see any error there or am i abused by gmail formatting?

Le 18 oct. 2016 19:28, "Steve Goldsmith"  a écrit :

> OK, I made the change:
>
> private static boolean setProperty(XMLInputFactory f, String p, Object
> o) {
> try {
> System.out.println("setProperty f: " + f + " p: " + p + " o:"
> +
> o);
> f.setProperty(p,  o);
> return true;
> } catch (Throwable t) {
> System.out.println("setProperty error" + t.getStackTrace());
> //ignore
> }
> return false;
> }
>
> and it dumps this:
>
> setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> com.ctc.wstx.maxAttributesPerElement o:500
> setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> com.ctc.wstx.maxAttributeSize o:65536
> setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> com.ctc.wstx.maxChildrenPerElement o:5
> setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> com.ctc.wstx.maxElementCount o:9223372036854775807
> setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> com.ctc.wstx.maxElementDepth o:100
> setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> com.ctc.wstx.maxCharacters o:9223372036854775807
> setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> com.ctc.wstx.maxTextLength o:134217728
> setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> com.ctc.wstx.minTextSegment o:64
> setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> javax.xml.stream.isNamespaceAware o:true
> setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> javax.xml.stream.supportDTD o:false
> setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> javax.xml.stream.isReplacingEntityReferences o:false
> setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
> javax.xml.stream.isSupportingExternalEntities o:false
>
>
>
> On Tue, Oct 18, 2016 at 12:14 PM, Romain Manni-Bucau <
> rmannibu...@gmail.com>
> wrote:
>
> > for tomee embedded yes
> >
> >
> > Romain Manni-Bucau
> > @rmannibucau  |  Blog
> >  | Old Wordpress Blog
> >  | Github  > rmannibucau> |
> > LinkedIn  | Tomitriber
> >  | JavaEE Factory
> > 
> >
> > 2016-10-18 18:11 GMT+02:00 Steve Goldsmith :
> >
> > > In other words, if I build a debug logging version of cxf how would I
> > > incorporate that into my TomEE embedded test? Can I just add the
> > dependency
> > > in Maven or do I have to exclude the version bundled in TomEE?
> > >
> > > On Tue, Oct 18, 2016 at 11:52 AM, Romain Manni-Bucau <
> > > rmannibu...@gmail.com>
> > > wrote:
> > >
> > > > you should switch them I guess.
> > > >
> > > > Generally speaking if you include cxf dependencies in your
> application
> > > > there is a property in tomee to ask it to isolate the webapp from the
> > > > container for cxf - not sure I got your question right.
> > > >
> > > >
> > > > Romain Manni-Bucau
> > > > @rmannibucau  |  Blog
> > > >  | Old Wordpress Blog
> > > >  | Github  > > > rmannibucau> |
> > > > LinkedIn  | Tomitriber
> > > >  | JavaEE Factory
> > > > 
> > > >
> > > > 2016-10-18 17:40 GMT+02:00 Steve Goldsmith :
> > > >
> > > > > Do I have to exclude current CXF in TomEE dependencies or just
> > include
> > > > the
> > > > > debug version I'm building?
> > > > >
> > > > > On Tue, Oct 18, 2016 at 2:46 AM, Romain Manni-Bucau <
> > > > rmannibu...@gmail.com
> > > > > >
> > > > > wrote:
> > > > >
> > > > > > As mentionned in the previous answer this is not in tomee sources
> > but
> > > > > CXF,
> > > > > > agree it should be logged at debug level but with current code
> > > > debugging
> > > > > is
> > > > > > the fastest.
> > > > > >
> > > > > > Side note: you dont need to build tomee from sources, just need
> to
> > > add
> > > > > > cxf-core.
> > > > > >
> > > > > >
> > > > > > Romain Manni-Bucau
> > > > > > @rmannibucau  |  Blog
> > > > > >  | Old Wordpress Blog
> > > > > >  | Github  > > > > > rmannibucau> |
> > > > > > LinkedIn  | Tomitriber
> > > > > >  | JavaEE Factory
> > > > > > 
> > > > > >
> > > > > > 2016-10-18 3:31 GMT+02:00 Steve Goldsmith :
> > > > > >
> > > > > > > OK, I've built TomEE from source before, but I've not run it in
> > > debug
>

Re: Cannot create a secure XMLInputFactory

2016-10-18 Thread Steve Goldsmith

OK, I made the change:

private static boolean setProperty(XMLInputFactory f, String p, Object
o) {
try {
System.out.println("setProperty f: " + f + " p: " + p + " o:" +
o);
f.setProperty(p,  o);
return true;
} catch (Throwable t) {
System.out.println("setProperty error" + t.getStackTrace());
//ignore
}
return false;
}

and it dumps this:

setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
com.ctc.wstx.maxAttributesPerElement o:500
setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
com.ctc.wstx.maxAttributeSize o:65536
setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
com.ctc.wstx.maxChildrenPerElement o:5
setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
com.ctc.wstx.maxElementCount o:9223372036854775807
setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
com.ctc.wstx.maxElementDepth o:100
setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
com.ctc.wstx.maxCharacters o:9223372036854775807
setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
com.ctc.wstx.maxTextLength o:134217728
setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
com.ctc.wstx.minTextSegment o:64
setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
javax.xml.stream.isNamespaceAware o:true
setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
javax.xml.stream.supportDTD o:false
setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
javax.xml.stream.isReplacingEntityReferences o:false
setProperty f: com.ctc.wstx.stax.WstxInputFactory@5c6fae3c p:
javax.xml.stream.isSupportingExternalEntities o:false



On Tue, Oct 18, 2016 at 12:14 PM, Romain Manni-Bucau 
wrote:

> for tomee embedded yes
>
>
> Romain Manni-Bucau
> @rmannibucau  |  Blog
>  | Old Wordpress Blog
>  | Github  rmannibucau> |
> LinkedIn  | Tomitriber
>  | JavaEE Factory
> 
>
> 2016-10-18 18:11 GMT+02:00 Steve Goldsmith :
>
> > In other words, if I build a debug logging version of cxf how would I
> > incorporate that into my TomEE embedded test? Can I just add the
> dependency
> > in Maven or do I have to exclude the version bundled in TomEE?
> >
> > On Tue, Oct 18, 2016 at 11:52 AM, Romain Manni-Bucau <
> > rmannibu...@gmail.com>
> > wrote:
> >
> > > you should switch them I guess.
> > >
> > > Generally speaking if you include cxf dependencies in your application
> > > there is a property in tomee to ask it to isolate the webapp from the
> > > container for cxf - not sure I got your question right.
> > >
> > >
> > > Romain Manni-Bucau
> > > @rmannibucau  |  Blog
> > >  | Old Wordpress Blog
> > >  | Github  > > rmannibucau> |
> > > LinkedIn  | Tomitriber
> > >  | JavaEE Factory
> > > 
> > >
> > > 2016-10-18 17:40 GMT+02:00 Steve Goldsmith :
> > >
> > > > Do I have to exclude current CXF in TomEE dependencies or just
> include
> > > the
> > > > debug version I'm building?
> > > >
> > > > On Tue, Oct 18, 2016 at 2:46 AM, Romain Manni-Bucau <
> > > rmannibu...@gmail.com
> > > > >
> > > > wrote:
> > > >
> > > > > As mentionned in the previous answer this is not in tomee sources
> but
> > > > CXF,
> > > > > agree it should be logged at debug level but with current code
> > > debugging
> > > > is
> > > > > the fastest.
> > > > >
> > > > > Side note: you dont need to build tomee from sources, just need to
> > add
> > > > > cxf-core.
> > > > >
> > > > >
> > > > > Romain Manni-Bucau
> > > > > @rmannibucau  |  Blog
> > > > >  | Old Wordpress Blog
> > > > >  | Github  > > > > rmannibucau> |
> > > > > LinkedIn  | Tomitriber
> > > > >  | JavaEE Factory
> > > > > 
> > > > >
> > > > > 2016-10-18 3:31 GMT+02:00 Steve Goldsmith :
> > > > >
> > > > > > OK, I've built TomEE from source before, but I've not run it in
> > debug
> > > > > mode.
> > > > > > Wouldn't it be just as easy to simply log vars f, p and o when I
> > > build
> > > > > the
> > > > > > source?
> > > > > >
> > > > > > On Mon, Oct 17, 2016 at 5:09 PM, Romain Manni-Bucau <
> > > > > rmannibu...@gmail.com
> > > > > > >
> > > > > > wrote:
> > > > > >
> > > > > > > cxf ones yes, that's as easy as adding cxf-core as provded
> > > > dependency,
>

Re: Cannot create a secure XMLInputFactory

2016-10-18 Thread Romain Manni-Bucau

for tomee embedded yes


Romain Manni-Bucau
@rmannibucau  |  Blog
 | Old Wordpress Blog
 | Github  |
LinkedIn  | Tomitriber
 | JavaEE Factory


2016-10-18 18:11 GMT+02:00 Steve Goldsmith :

> In other words, if I build a debug logging version of cxf how would I
> incorporate that into my TomEE embedded test? Can I just add the dependency
> in Maven or do I have to exclude the version bundled in TomEE?
>
> On Tue, Oct 18, 2016 at 11:52 AM, Romain Manni-Bucau <
> rmannibu...@gmail.com>
> wrote:
>
> > you should switch them I guess.
> >
> > Generally speaking if you include cxf dependencies in your application
> > there is a property in tomee to ask it to isolate the webapp from the
> > container for cxf - not sure I got your question right.
> >
> >
> > Romain Manni-Bucau
> > @rmannibucau  |  Blog
> >  | Old Wordpress Blog
> >  | Github  > rmannibucau> |
> > LinkedIn  | Tomitriber
> >  | JavaEE Factory
> > 
> >
> > 2016-10-18 17:40 GMT+02:00 Steve Goldsmith :
> >
> > > Do I have to exclude current CXF in TomEE dependencies or just include
> > the
> > > debug version I'm building?
> > >
> > > On Tue, Oct 18, 2016 at 2:46 AM, Romain Manni-Bucau <
> > rmannibu...@gmail.com
> > > >
> > > wrote:
> > >
> > > > As mentionned in the previous answer this is not in tomee sources but
> > > CXF,
> > > > agree it should be logged at debug level but with current code
> > debugging
> > > is
> > > > the fastest.
> > > >
> > > > Side note: you dont need to build tomee from sources, just need to
> add
> > > > cxf-core.
> > > >
> > > >
> > > > Romain Manni-Bucau
> > > > @rmannibucau  |  Blog
> > > >  | Old Wordpress Blog
> > > >  | Github  > > > rmannibucau> |
> > > > LinkedIn  | Tomitriber
> > > >  | JavaEE Factory
> > > > 
> > > >
> > > > 2016-10-18 3:31 GMT+02:00 Steve Goldsmith :
> > > >
> > > > > OK, I've built TomEE from source before, but I've not run it in
> debug
> > > > mode.
> > > > > Wouldn't it be just as easy to simply log vars f, p and o when I
> > build
> > > > the
> > > > > source?
> > > > >
> > > > > On Mon, Oct 17, 2016 at 5:09 PM, Romain Manni-Bucau <
> > > > rmannibu...@gmail.com
> > > > > >
> > > > > wrote:
> > > > >
> > > > > > cxf ones yes, that's as easy as adding cxf-core as provded
> > > dependency,
> > > > > > putting a breakpoint on the mentionned line normally and starting
> > > tomee
> > > > > in
> > > > > > debug mode. Surely the most efficient way to solve it.
> > > > > >
> > > > > >
> > > > > > Romain Manni-Bucau
> > > > > > @rmannibucau  |  Blog
> > > > > >  | Old Wordpress Blog
> > > > > >  | Github  > > > > > rmannibucau> |
> > > > > > LinkedIn  | Tomitriber
> > > > > >  | JavaEE Factory
> > > > > > 
> > > > > >
> > > > > > 2016-10-17 22:52 GMT+02:00 Steve Goldsmith :
> > > > > >
> > > > > > > You mean set a breakpoint in TomEE source?
> > > > > > >
> > > > > > > On Mon, Oct 17, 2016 at 4:43 PM, Romain Manni-Bucau <
> > > > > > rmannibu...@gmail.com
> > > > > > > >
> > > > > > > wrote:
> > > > > > >
> > > > > > > > If you can put a breakpoint at
> > > > > > > > https://github.com/apache/cxf/blob/
> > > eab841d5477c5e1ed21a49918defa7
> > > > > > > > 9a0f1ad533/core/src/main/java/org/apache/cxf/staxutils/
> > > > > > > StaxUtils.java#L381
> > > > > > > > then you would know immediately why the throwable is thrown.
> > > > > > > >
> > > > > > > >
> > > > > > > > Romain Manni-Bucau
> > > > > > > > @rmannibucau  |  Blog
> > > > > > > >  | Old Wordpress Blog
> > > > > > > >  | Github <
> > https://github.com/
> > > > > > > > rmannibucau> |
> > > > > > > > LinkedIn  |
> > Tomitriber
> > > > > > > >  | JavaEE Factory
> > > > > > > > 
> > > > > > > >
> > > > > > > > 2016-10-17 22:41 GMT+02:00 Steve Goldsmith  >:
> > > > > > > >
> > > > > >

Re: Cannot create a secure XMLInputFactory

2016-10-18 Thread Steve Goldsmith

In other words, if I build a debug logging version of cxf how would I
incorporate that into my TomEE embedded test? Can I just add the dependency
in Maven or do I have to exclude the version bundled in TomEE?

On Tue, Oct 18, 2016 at 11:52 AM, Romain Manni-Bucau 
wrote:

> you should switch them I guess.
>
> Generally speaking if you include cxf dependencies in your application
> there is a property in tomee to ask it to isolate the webapp from the
> container for cxf - not sure I got your question right.
>
>
> Romain Manni-Bucau
> @rmannibucau  |  Blog
>  | Old Wordpress Blog
>  | Github  rmannibucau> |
> LinkedIn  | Tomitriber
>  | JavaEE Factory
> 
>
> 2016-10-18 17:40 GMT+02:00 Steve Goldsmith :
>
> > Do I have to exclude current CXF in TomEE dependencies or just include
> the
> > debug version I'm building?
> >
> > On Tue, Oct 18, 2016 at 2:46 AM, Romain Manni-Bucau <
> rmannibu...@gmail.com
> > >
> > wrote:
> >
> > > As mentionned in the previous answer this is not in tomee sources but
> > CXF,
> > > agree it should be logged at debug level but with current code
> debugging
> > is
> > > the fastest.
> > >
> > > Side note: you dont need to build tomee from sources, just need to add
> > > cxf-core.
> > >
> > >
> > > Romain Manni-Bucau
> > > @rmannibucau  |  Blog
> > >  | Old Wordpress Blog
> > >  | Github  > > rmannibucau> |
> > > LinkedIn  | Tomitriber
> > >  | JavaEE Factory
> > > 
> > >
> > > 2016-10-18 3:31 GMT+02:00 Steve Goldsmith :
> > >
> > > > OK, I've built TomEE from source before, but I've not run it in debug
> > > mode.
> > > > Wouldn't it be just as easy to simply log vars f, p and o when I
> build
> > > the
> > > > source?
> > > >
> > > > On Mon, Oct 17, 2016 at 5:09 PM, Romain Manni-Bucau <
> > > rmannibu...@gmail.com
> > > > >
> > > > wrote:
> > > >
> > > > > cxf ones yes, that's as easy as adding cxf-core as provded
> > dependency,
> > > > > putting a breakpoint on the mentionned line normally and starting
> > tomee
> > > > in
> > > > > debug mode. Surely the most efficient way to solve it.
> > > > >
> > > > >
> > > > > Romain Manni-Bucau
> > > > > @rmannibucau  |  Blog
> > > > >  | Old Wordpress Blog
> > > > >  | Github  > > > > rmannibucau> |
> > > > > LinkedIn  | Tomitriber
> > > > >  | JavaEE Factory
> > > > > 
> > > > >
> > > > > 2016-10-17 22:52 GMT+02:00 Steve Goldsmith :
> > > > >
> > > > > > You mean set a breakpoint in TomEE source?
> > > > > >
> > > > > > On Mon, Oct 17, 2016 at 4:43 PM, Romain Manni-Bucau <
> > > > > rmannibu...@gmail.com
> > > > > > >
> > > > > > wrote:
> > > > > >
> > > > > > > If you can put a breakpoint at
> > > > > > > https://github.com/apache/cxf/blob/
> > eab841d5477c5e1ed21a49918defa7
> > > > > > > 9a0f1ad533/core/src/main/java/org/apache/cxf/staxutils/
> > > > > > StaxUtils.java#L381
> > > > > > > then you would know immediately why the throwable is thrown.
> > > > > > >
> > > > > > >
> > > > > > > Romain Manni-Bucau
> > > > > > > @rmannibucau  |  Blog
> > > > > > >  | Old Wordpress Blog
> > > > > > >  | Github <
> https://github.com/
> > > > > > > rmannibucau> |
> > > > > > > LinkedIn  |
> Tomitriber
> > > > > > >  | JavaEE Factory
> > > > > > > 
> > > > > > >
> > > > > > > 2016-10-17 22:41 GMT+02:00 Steve Goldsmith :
> > > > > > >
> > > > > > > > OK, I made the following change and I still get the error:
> > > > > > > >
> > > > > > > > 
> > > > > > > > org.jvnet.jaxb2_commons
> > > > > > > > jaxb2-basics-runtime
> > > > > > > > 0.10.0
> > > > > > > > provided
> > > > > > > > 
> > > > > > > >
> > > > > > > > I even tried:
> > > > > > > >
> > > > > > > > 
> > > > > > > > org.apache.tomee
> > > > > > > > tomee-jaxrs
> > > > > > > > ${tomee.version}
> > > > > > > > test
> > > > > > > > 
> > > > > > > > 
> > > > > > > > com.sun.xml.bind
> > > > > > > >

Re: Cannot create a secure XMLInputFactory

2016-10-18 Thread Romain Manni-Bucau

you should switch them I guess.

Generally speaking if you include cxf dependencies in your application
there is a property in tomee to ask it to isolate the webapp from the
container for cxf - not sure I got your question right.


Romain Manni-Bucau
@rmannibucau  |  Blog
 | Old Wordpress Blog
 | Github  |
LinkedIn  | Tomitriber
 | JavaEE Factory


2016-10-18 17:40 GMT+02:00 Steve Goldsmith :

> Do I have to exclude current CXF in TomEE dependencies or just include the
> debug version I'm building?
>
> On Tue, Oct 18, 2016 at 2:46 AM, Romain Manni-Bucau  >
> wrote:
>
> > As mentionned in the previous answer this is not in tomee sources but
> CXF,
> > agree it should be logged at debug level but with current code debugging
> is
> > the fastest.
> >
> > Side note: you dont need to build tomee from sources, just need to add
> > cxf-core.
> >
> >
> > Romain Manni-Bucau
> > @rmannibucau  |  Blog
> >  | Old Wordpress Blog
> >  | Github  > rmannibucau> |
> > LinkedIn  | Tomitriber
> >  | JavaEE Factory
> > 
> >
> > 2016-10-18 3:31 GMT+02:00 Steve Goldsmith :
> >
> > > OK, I've built TomEE from source before, but I've not run it in debug
> > mode.
> > > Wouldn't it be just as easy to simply log vars f, p and o when I build
> > the
> > > source?
> > >
> > > On Mon, Oct 17, 2016 at 5:09 PM, Romain Manni-Bucau <
> > rmannibu...@gmail.com
> > > >
> > > wrote:
> > >
> > > > cxf ones yes, that's as easy as adding cxf-core as provded
> dependency,
> > > > putting a breakpoint on the mentionned line normally and starting
> tomee
> > > in
> > > > debug mode. Surely the most efficient way to solve it.
> > > >
> > > >
> > > > Romain Manni-Bucau
> > > > @rmannibucau  |  Blog
> > > >  | Old Wordpress Blog
> > > >  | Github  > > > rmannibucau> |
> > > > LinkedIn  | Tomitriber
> > > >  | JavaEE Factory
> > > > 
> > > >
> > > > 2016-10-17 22:52 GMT+02:00 Steve Goldsmith :
> > > >
> > > > > You mean set a breakpoint in TomEE source?
> > > > >
> > > > > On Mon, Oct 17, 2016 at 4:43 PM, Romain Manni-Bucau <
> > > > rmannibu...@gmail.com
> > > > > >
> > > > > wrote:
> > > > >
> > > > > > If you can put a breakpoint at
> > > > > > https://github.com/apache/cxf/blob/
> eab841d5477c5e1ed21a49918defa7
> > > > > > 9a0f1ad533/core/src/main/java/org/apache/cxf/staxutils/
> > > > > StaxUtils.java#L381
> > > > > > then you would know immediately why the throwable is thrown.
> > > > > >
> > > > > >
> > > > > > Romain Manni-Bucau
> > > > > > @rmannibucau  |  Blog
> > > > > >  | Old Wordpress Blog
> > > > > >  | Github  > > > > > rmannibucau> |
> > > > > > LinkedIn  | Tomitriber
> > > > > >  | JavaEE Factory
> > > > > > 
> > > > > >
> > > > > > 2016-10-17 22:41 GMT+02:00 Steve Goldsmith :
> > > > > >
> > > > > > > OK, I made the following change and I still get the error:
> > > > > > >
> > > > > > > 
> > > > > > > org.jvnet.jaxb2_commons
> > > > > > > jaxb2-basics-runtime
> > > > > > > 0.10.0
> > > > > > > provided
> > > > > > > 
> > > > > > >
> > > > > > > I even tried:
> > > > > > >
> > > > > > > 
> > > > > > > org.apache.tomee
> > > > > > > tomee-jaxrs
> > > > > > > ${tomee.version}
> > > > > > > test
> > > > > > > 
> > > > > > > 
> > > > > > > com.sun.xml.bind
> > > > > > > jaxb-impl
> > > > > > > 
> > > > > > > 
> > > > > > > 
> > > > > > >
> > > > > > >
> > > > > > > On Mon, Oct 17, 2016 at 3:37 PM, Romain Manni-Bucau <
> > > > > > rmannibu...@gmail.com
> > > > > > > >
> > > > > > > wrote:
> > > > > > >
> > > > > > > > well jaxb is provided and shouldnt be delivered so you have
> to
> > > > remove
> > > > > > it
> > > > > > > > from WEB-INF/lib. scope=provided should be fine too.
> > > > > > > >
> > > > > > > >
> > > > > > > > Romain Manni-Bucau
> > > > > > > >

Re: Cannot create a secure XMLInputFactory

2016-10-18 Thread Steve Goldsmith

Do I have to exclude current CXF in TomEE dependencies or just include the
debug version I'm building?

On Tue, Oct 18, 2016 at 2:46 AM, Romain Manni-Bucau 
wrote:

> As mentionned in the previous answer this is not in tomee sources but CXF,
> agree it should be logged at debug level but with current code debugging is
> the fastest.
>
> Side note: you dont need to build tomee from sources, just need to add
> cxf-core.
>
>
> Romain Manni-Bucau
> @rmannibucau  |  Blog
>  | Old Wordpress Blog
>  | Github  rmannibucau> |
> LinkedIn  | Tomitriber
>  | JavaEE Factory
> 
>
> 2016-10-18 3:31 GMT+02:00 Steve Goldsmith :
>
> > OK, I've built TomEE from source before, but I've not run it in debug
> mode.
> > Wouldn't it be just as easy to simply log vars f, p and o when I build
> the
> > source?
> >
> > On Mon, Oct 17, 2016 at 5:09 PM, Romain Manni-Bucau <
> rmannibu...@gmail.com
> > >
> > wrote:
> >
> > > cxf ones yes, that's as easy as adding cxf-core as provded dependency,
> > > putting a breakpoint on the mentionned line normally and starting tomee
> > in
> > > debug mode. Surely the most efficient way to solve it.
> > >
> > >
> > > Romain Manni-Bucau
> > > @rmannibucau  |  Blog
> > >  | Old Wordpress Blog
> > >  | Github  > > rmannibucau> |
> > > LinkedIn  | Tomitriber
> > >  | JavaEE Factory
> > > 
> > >
> > > 2016-10-17 22:52 GMT+02:00 Steve Goldsmith :
> > >
> > > > You mean set a breakpoint in TomEE source?
> > > >
> > > > On Mon, Oct 17, 2016 at 4:43 PM, Romain Manni-Bucau <
> > > rmannibu...@gmail.com
> > > > >
> > > > wrote:
> > > >
> > > > > If you can put a breakpoint at
> > > > > https://github.com/apache/cxf/blob/eab841d5477c5e1ed21a49918defa7
> > > > > 9a0f1ad533/core/src/main/java/org/apache/cxf/staxutils/
> > > > StaxUtils.java#L381
> > > > > then you would know immediately why the throwable is thrown.
> > > > >
> > > > >
> > > > > Romain Manni-Bucau
> > > > > @rmannibucau  |  Blog
> > > > >  | Old Wordpress Blog
> > > > >  | Github  > > > > rmannibucau> |
> > > > > LinkedIn  | Tomitriber
> > > > >  | JavaEE Factory
> > > > > 
> > > > >
> > > > > 2016-10-17 22:41 GMT+02:00 Steve Goldsmith :
> > > > >
> > > > > > OK, I made the following change and I still get the error:
> > > > > >
> > > > > > 
> > > > > > org.jvnet.jaxb2_commons
> > > > > > jaxb2-basics-runtime
> > > > > > 0.10.0
> > > > > > provided
> > > > > > 
> > > > > >
> > > > > > I even tried:
> > > > > >
> > > > > > 
> > > > > > org.apache.tomee
> > > > > > tomee-jaxrs
> > > > > > ${tomee.version}
> > > > > > test
> > > > > > 
> > > > > > 
> > > > > > com.sun.xml.bind
> > > > > > jaxb-impl
> > > > > > 
> > > > > > 
> > > > > > 
> > > > > >
> > > > > >
> > > > > > On Mon, Oct 17, 2016 at 3:37 PM, Romain Manni-Bucau <
> > > > > rmannibu...@gmail.com
> > > > > > >
> > > > > > wrote:
> > > > > >
> > > > > > > well jaxb is provided and shouldnt be delivered so you have to
> > > remove
> > > > > it
> > > > > > > from WEB-INF/lib. scope=provided should be fine too.
> > > > > > >
> > > > > > >
> > > > > > > Romain Manni-Bucau
> > > > > > > @rmannibucau  |  Blog
> > > > > > >  | Old Wordpress Blog
> > > > > > >  | Github <
> https://github.com/
> > > > > > > rmannibucau> |
> > > > > > > LinkedIn  |
> Tomitriber
> > > > > > >  | JavaEE Factory
> > > > > > > 
> > > > > > >
> > > > > > > 2016-10-17 20:07 GMT+02:00 Steve Goldsmith :
> > > > > > >
> > > > > > > > I need JAX-B runtime for code generated by jaxws-maven-plugin
> > and
> > > > > XJC.
> > > > > > > > Everything else is in test scope and not used in the deployed
> > > app.
> > > > > > > >
> > > > > > > > 
> > > > > > > > org.jvnet.jaxb2_commons
> > > > > > > > jaxb2-basics-runtime
> > > > > > > > 0.10.0
> > > >

Re: Cannot create a secure XMLInputFactory

2016-10-18 Thread Steve Goldsmith

Nope, it's the same as the other services. I generate SOAP clients from
wsimport and use them in my REST services. I'm not explicitly messing with
threading or class loading. I'll see if I can get CXF debug logging in the
method you pointed out.

On Tue, Oct 18, 2016 at 10:04 AM, Romain Manni-Bucau 
wrote:

> depends what does this service. As mentionned it is a classloading issue so
> if you use some custom threading or loader this can be the cause.
>
>
> Romain Manni-Bucau
> @rmannibucau  |  Blog
>  | Old Wordpress Blog
>  | Github  rmannibucau> |
> LinkedIn  | Tomitriber
>  | JavaEE Factory
> 
>
> 2016-10-18 16:01 GMT+02:00 Steve Goldsmith :
>
> > One thing that is weird is that it only effect one service on the same
> > endpoint I calling other services. Shouldn't this be happening with all
> my
> > services?
> >
> > On Tue, Oct 18, 2016 at 2:46 AM, Romain Manni-Bucau <
> rmannibu...@gmail.com
> > >
> > wrote:
> >
> > > As mentionned in the previous answer this is not in tomee sources but
> > CXF,
> > > agree it should be logged at debug level but with current code
> debugging
> > is
> > > the fastest.
> > >
> > > Side note: you dont need to build tomee from sources, just need to add
> > > cxf-core.
> > >
> > >
> > > Romain Manni-Bucau
> > > @rmannibucau  |  Blog
> > >  | Old Wordpress Blog
> > >  | Github  > > rmannibucau> |
> > > LinkedIn  | Tomitriber
> > >  | JavaEE Factory
> > > 
> > >
> > > 2016-10-18 3:31 GMT+02:00 Steve Goldsmith :
> > >
> > > > OK, I've built TomEE from source before, but I've not run it in debug
> > > mode.
> > > > Wouldn't it be just as easy to simply log vars f, p and o when I
> build
> > > the
> > > > source?
> > > >
> > > > On Mon, Oct 17, 2016 at 5:09 PM, Romain Manni-Bucau <
> > > rmannibu...@gmail.com
> > > > >
> > > > wrote:
> > > >
> > > > > cxf ones yes, that's as easy as adding cxf-core as provded
> > dependency,
> > > > > putting a breakpoint on the mentionned line normally and starting
> > tomee
> > > > in
> > > > > debug mode. Surely the most efficient way to solve it.
> > > > >
> > > > >
> > > > > Romain Manni-Bucau
> > > > > @rmannibucau  |  Blog
> > > > >  | Old Wordpress Blog
> > > > >  | Github  > > > > rmannibucau> |
> > > > > LinkedIn  | Tomitriber
> > > > >  | JavaEE Factory
> > > > > 
> > > > >
> > > > > 2016-10-17 22:52 GMT+02:00 Steve Goldsmith :
> > > > >
> > > > > > You mean set a breakpoint in TomEE source?
> > > > > >
> > > > > > On Mon, Oct 17, 2016 at 4:43 PM, Romain Manni-Bucau <
> > > > > rmannibu...@gmail.com
> > > > > > >
> > > > > > wrote:
> > > > > >
> > > > > > > If you can put a breakpoint at
> > > > > > > https://github.com/apache/cxf/blob/
> > eab841d5477c5e1ed21a49918defa7
> > > > > > > 9a0f1ad533/core/src/main/java/org/apache/cxf/staxutils/
> > > > > > StaxUtils.java#L381
> > > > > > > then you would know immediately why the throwable is thrown.
> > > > > > >
> > > > > > >
> > > > > > > Romain Manni-Bucau
> > > > > > > @rmannibucau  |  Blog
> > > > > > >  | Old Wordpress Blog
> > > > > > >  | Github <
> https://github.com/
> > > > > > > rmannibucau> |
> > > > > > > LinkedIn  |
> Tomitriber
> > > > > > >  | JavaEE Factory
> > > > > > > 
> > > > > > >
> > > > > > > 2016-10-17 22:41 GMT+02:00 Steve Goldsmith :
> > > > > > >
> > > > > > > > OK, I made the following change and I still get the error:
> > > > > > > >
> > > > > > > > 
> > > > > > > > org.jvnet.jaxb2_commons
> > > > > > > > jaxb2-basics-runtime
> > > > > > > > 0.10.0
> > > > > > > > provided
> > > > > > > > 
> > > > > > > >
> > > > > > > > I even tried:
> > > > > > > >
> > > > > > > > 
> > > > > > > > org.apache.tomee
> > > > > > > > tomee-jaxrs
> > > > > > > > ${tomee.version}
> > > > > > > > test
> > > > > > > > 
> > > > > > > > 
> > > > > > > > com.sun.xml.bind
> > > > > > > >

Re: Cannot create a secure XMLInputFactory

2016-10-18 Thread Steve Goldsmith

One thing that is weird is that it only effect one service on the same
endpoint I calling other services. Shouldn't this be happening with all my
services?

On Tue, Oct 18, 2016 at 2:46 AM, Romain Manni-Bucau 
wrote:

> As mentionned in the previous answer this is not in tomee sources but CXF,
> agree it should be logged at debug level but with current code debugging is
> the fastest.
>
> Side note: you dont need to build tomee from sources, just need to add
> cxf-core.
>
>
> Romain Manni-Bucau
> @rmannibucau  |  Blog
>  | Old Wordpress Blog
>  | Github  rmannibucau> |
> LinkedIn  | Tomitriber
>  | JavaEE Factory
> 
>
> 2016-10-18 3:31 GMT+02:00 Steve Goldsmith :
>
> > OK, I've built TomEE from source before, but I've not run it in debug
> mode.
> > Wouldn't it be just as easy to simply log vars f, p and o when I build
> the
> > source?
> >
> > On Mon, Oct 17, 2016 at 5:09 PM, Romain Manni-Bucau <
> rmannibu...@gmail.com
> > >
> > wrote:
> >
> > > cxf ones yes, that's as easy as adding cxf-core as provded dependency,
> > > putting a breakpoint on the mentionned line normally and starting tomee
> > in
> > > debug mode. Surely the most efficient way to solve it.
> > >
> > >
> > > Romain Manni-Bucau
> > > @rmannibucau  |  Blog
> > >  | Old Wordpress Blog
> > >  | Github  > > rmannibucau> |
> > > LinkedIn  | Tomitriber
> > >  | JavaEE Factory
> > > 
> > >
> > > 2016-10-17 22:52 GMT+02:00 Steve Goldsmith :
> > >
> > > > You mean set a breakpoint in TomEE source?
> > > >
> > > > On Mon, Oct 17, 2016 at 4:43 PM, Romain Manni-Bucau <
> > > rmannibu...@gmail.com
> > > > >
> > > > wrote:
> > > >
> > > > > If you can put a breakpoint at
> > > > > https://github.com/apache/cxf/blob/eab841d5477c5e1ed21a49918defa7
> > > > > 9a0f1ad533/core/src/main/java/org/apache/cxf/staxutils/
> > > > StaxUtils.java#L381
> > > > > then you would know immediately why the throwable is thrown.
> > > > >
> > > > >
> > > > > Romain Manni-Bucau
> > > > > @rmannibucau  |  Blog
> > > > >  | Old Wordpress Blog
> > > > >  | Github  > > > > rmannibucau> |
> > > > > LinkedIn  | Tomitriber
> > > > >  | JavaEE Factory
> > > > > 
> > > > >
> > > > > 2016-10-17 22:41 GMT+02:00 Steve Goldsmith :
> > > > >
> > > > > > OK, I made the following change and I still get the error:
> > > > > >
> > > > > > 
> > > > > > org.jvnet.jaxb2_commons
> > > > > > jaxb2-basics-runtime
> > > > > > 0.10.0
> > > > > > provided
> > > > > > 
> > > > > >
> > > > > > I even tried:
> > > > > >
> > > > > > 
> > > > > > org.apache.tomee
> > > > > > tomee-jaxrs
> > > > > > ${tomee.version}
> > > > > > test
> > > > > > 
> > > > > > 
> > > > > > com.sun.xml.bind
> > > > > > jaxb-impl
> > > > > > 
> > > > > > 
> > > > > > 
> > > > > >
> > > > > >
> > > > > > On Mon, Oct 17, 2016 at 3:37 PM, Romain Manni-Bucau <
> > > > > rmannibu...@gmail.com
> > > > > > >
> > > > > > wrote:
> > > > > >
> > > > > > > well jaxb is provided and shouldnt be delivered so you have to
> > > remove
> > > > > it
> > > > > > > from WEB-INF/lib. scope=provided should be fine too.
> > > > > > >
> > > > > > >
> > > > > > > Romain Manni-Bucau
> > > > > > > @rmannibucau  |  Blog
> > > > > > >  | Old Wordpress Blog
> > > > > > >  | Github <
> https://github.com/
> > > > > > > rmannibucau> |
> > > > > > > LinkedIn  |
> Tomitriber
> > > > > > >  | JavaEE Factory
> > > > > > > 
> > > > > > >
> > > > > > > 2016-10-17 20:07 GMT+02:00 Steve Goldsmith :
> > > > > > >
> > > > > > > > I need JAX-B runtime for code generated by jaxws-maven-plugin
> > and
> > > > > XJC.
> > > > > > > > Everything else is in test scope and not used in the deployed
> > > app.
> > > > > > > >
> > > > > > > > 
> > > > > > > > org.jvnet.jaxb2_commons
> > > > > > > >

Re: Cannot create a secure XMLInputFactory

2016-10-18 Thread Christoph Nenning

> From: Steve Goldsmith <sgj...@gmail.com>
> To: users@tomee.apache.org, 
> Date: 18.10.2016 03:31
> Subject: Re: Cannot create a secure XMLInputFactory
> 
> OK, I've built TomEE from source before, but I've not run it in debug 
mode.
> Wouldn't it be just as easy to simply log vars f, p and o when I build 
the
> source?
> 


Hi,

when I want to debug tomee I usually do it like this:
- using my app-development eclipse
- prebuilt tomee setup in eclipse servers view
- beside my app projects I have another source-downloader project
- in that I configure those tomee dependencies which I want to debug (just 
to have source available inside eclipse)
- open class of interesst with ctrl-shift-t
- set a breakpoint
- launch tomee in debug from servers view
- maybe trigger tomee code through my app



Regards,
Christoph





> On Mon, Oct 17, 2016 at 5:09 PM, Romain Manni-Bucau 
<rmannibu...@gmail.com>
> wrote:
> 
> > cxf ones yes, that's as easy as adding cxf-core as provded dependency,
> > putting a breakpoint on the mentionned line normally and starting 
tomee in
> > debug mode. Surely the most efficient way to solve it.
> >
> >
> > Romain Manni-Bucau
> > @rmannibucau <https://twitter.com/rmannibucau> |  Blog
> > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > rmannibucau> |
> > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > <http://www.tomitribe.com> | JavaEE Factory
> > <https://javaeefactory-rmannibucau.rhcloud.com>
> >
> > 2016-10-17 22:52 GMT+02:00 Steve Goldsmith <sgj...@gmail.com>:
> >
> > > You mean set a breakpoint in TomEE source?
> > >
> > > On Mon, Oct 17, 2016 at 4:43 PM, Romain Manni-Bucau <
> > rmannibu...@gmail.com
> > > >
> > > wrote:
> > >
> > > > If you can put a breakpoint at
> > > > https://github.com/apache/cxf/blob/eab841d5477c5e1ed21a49918defa7
> > > > 9a0f1ad533/core/src/main/java/org/apache/cxf/staxutils/
> > > StaxUtils.java#L381
> > > > then you would know immediately why the throwable is thrown.
> > > >
> > > >
> > > > Romain Manni-Bucau
> > > > @rmannibucau <https://twitter.com/rmannibucau> |  Blog
> > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > <http://rmannibucau.wordpress.com> | Github <https://github.com/
> > > > rmannibucau> |
> > > > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Tomitriber
> > > > <http://www.tomitribe.com> | JavaEE Factory
> > > > <https://javaeefactory-rmannibucau.rhcloud.com>
> > > >
> > > > 2016-10-17 22:41 GMT+02:00 Steve Goldsmith <sgj...@gmail.com>:
> > > >
> > > > > OK, I made the following change and I still get the error:
> > > > >
> > > > > 
> > > > > org.jvnet.jaxb2_commons
> > > > > jaxb2-basics-runtime
> > > > > 0.10.0
> > > > > provided
> > > > > 
> > > > >
> > > > > I even tried:
> > > > >
> > > > > 
> > > > > org.apache.tomee
> > > > > tomee-jaxrs
> > > > > ${tomee.version}
> > > > > test
> > > > > 
> > > > > 
> > > > > com.sun.xml.bind
> > > > > jaxb-impl
> > > > > 
> > > > > 
> > > > > 
> > > > >
> > > > >
> > > > > On Mon, Oct 17, 2016 at 3:37 PM, Romain Manni-Bucau <
> > > > rmannibu...@gmail.com
> > > > > >
> > > > > wrote:
> > > > >
> > > > > > well jaxb is provided and shouldnt be delivered so you have to
> > remove
> > > > it
> > > > > > from WEB-INF/lib. scope=provided should be fine too.
> > > > > >
> > > > > >
> > > > > > Romain Manni-Bucau
> > > > > > @rmannibucau <https://twitter.com/rmannibucau> |  Blog
> > > > > > <https://blog-rmannibucau.rhcloud.com> | Old Wordpress Blog
> > > > > > <http://rmannibucau.wordpress.com> |

Re: Cannot create a secure XMLInputFactory

2016-10-18 Thread Romain Manni-Bucau

As mentionned in the previous answer this is not in tomee sources but CXF,
agree it should be logged at debug level but with current code debugging is
the fastest.

Side note: you dont need to build tomee from sources, just need to add
cxf-core.


Romain Manni-Bucau
@rmannibucau  |  Blog
 | Old Wordpress Blog
 | Github  |
LinkedIn  | Tomitriber
 | JavaEE Factory


2016-10-18 3:31 GMT+02:00 Steve Goldsmith :

> OK, I've built TomEE from source before, but I've not run it in debug mode.
> Wouldn't it be just as easy to simply log vars f, p and o when I build the
> source?
>
> On Mon, Oct 17, 2016 at 5:09 PM, Romain Manni-Bucau  >
> wrote:
>
> > cxf ones yes, that's as easy as adding cxf-core as provded dependency,
> > putting a breakpoint on the mentionned line normally and starting tomee
> in
> > debug mode. Surely the most efficient way to solve it.
> >
> >
> > Romain Manni-Bucau
> > @rmannibucau  |  Blog
> >  | Old Wordpress Blog
> >  | Github  > rmannibucau> |
> > LinkedIn  | Tomitriber
> >  | JavaEE Factory
> > 
> >
> > 2016-10-17 22:52 GMT+02:00 Steve Goldsmith :
> >
> > > You mean set a breakpoint in TomEE source?
> > >
> > > On Mon, Oct 17, 2016 at 4:43 PM, Romain Manni-Bucau <
> > rmannibu...@gmail.com
> > > >
> > > wrote:
> > >
> > > > If you can put a breakpoint at
> > > > https://github.com/apache/cxf/blob/eab841d5477c5e1ed21a49918defa7
> > > > 9a0f1ad533/core/src/main/java/org/apache/cxf/staxutils/
> > > StaxUtils.java#L381
> > > > then you would know immediately why the throwable is thrown.
> > > >
> > > >
> > > > Romain Manni-Bucau
> > > > @rmannibucau  |  Blog
> > > >  | Old Wordpress Blog
> > > >  | Github  > > > rmannibucau> |
> > > > LinkedIn  | Tomitriber
> > > >  | JavaEE Factory
> > > > 
> > > >
> > > > 2016-10-17 22:41 GMT+02:00 Steve Goldsmith :
> > > >
> > > > > OK, I made the following change and I still get the error:
> > > > >
> > > > > 
> > > > > org.jvnet.jaxb2_commons
> > > > > jaxb2-basics-runtime
> > > > > 0.10.0
> > > > > provided
> > > > > 
> > > > >
> > > > > I even tried:
> > > > >
> > > > > 
> > > > > org.apache.tomee
> > > > > tomee-jaxrs
> > > > > ${tomee.version}
> > > > > test
> > > > > 
> > > > > 
> > > > > com.sun.xml.bind
> > > > > jaxb-impl
> > > > > 
> > > > > 
> > > > > 
> > > > >
> > > > >
> > > > > On Mon, Oct 17, 2016 at 3:37 PM, Romain Manni-Bucau <
> > > > rmannibu...@gmail.com
> > > > > >
> > > > > wrote:
> > > > >
> > > > > > well jaxb is provided and shouldnt be delivered so you have to
> > remove
> > > > it
> > > > > > from WEB-INF/lib. scope=provided should be fine too.
> > > > > >
> > > > > >
> > > > > > Romain Manni-Bucau
> > > > > > @rmannibucau  |  Blog
> > > > > >  | Old Wordpress Blog
> > > > > >  | Github  > > > > > rmannibucau> |
> > > > > > LinkedIn  | Tomitriber
> > > > > >  | JavaEE Factory
> > > > > > 
> > > > > >
> > > > > > 2016-10-17 20:07 GMT+02:00 Steve Goldsmith :
> > > > > >
> > > > > > > I need JAX-B runtime for code generated by jaxws-maven-plugin
> and
> > > > XJC.
> > > > > > > Everything else is in test scope and not used in the deployed
> > app.
> > > > > > >
> > > > > > > 
> > > > > > > org.jvnet.jaxb2_commons
> > > > > > > jaxb2-basics-runtime
> > > > > > > 0.10.0
> > > > > > > 
> > > > > > >
> > > > > > >
> > > > > > > On Mon, Oct 17, 2016 at 1:57 PM, Romain Manni-Bucau <
> > > > > > rmannibu...@gmail.com
> > > > > > > >
> > > > > > > wrote:
> > > > > > >
> > > > > > > > yep so surely some part of the app running in a conflicting
> > > > > > classloader.
> > > > > > > > Personally I'd just remove stax2-api, woodstox and jaxb to
> > start
> > > > > > > >
> > > > > > > >
> > > > > > > > Romain Manni-Bucau

Re: Cannot create a secure XMLInputFactory

2016-10-17 Thread Steve Goldsmith

OK, I've built TomEE from source before, but I've not run it in debug mode.
Wouldn't it be just as easy to simply log vars f, p and o when I build the
source?

On Mon, Oct 17, 2016 at 5:09 PM, Romain Manni-Bucau 
wrote:

> cxf ones yes, that's as easy as adding cxf-core as provded dependency,
> putting a breakpoint on the mentionned line normally and starting tomee in
> debug mode. Surely the most efficient way to solve it.
>
>
> Romain Manni-Bucau
> @rmannibucau  |  Blog
>  | Old Wordpress Blog
>  | Github  rmannibucau> |
> LinkedIn  | Tomitriber
>  | JavaEE Factory
> 
>
> 2016-10-17 22:52 GMT+02:00 Steve Goldsmith :
>
> > You mean set a breakpoint in TomEE source?
> >
> > On Mon, Oct 17, 2016 at 4:43 PM, Romain Manni-Bucau <
> rmannibu...@gmail.com
> > >
> > wrote:
> >
> > > If you can put a breakpoint at
> > > https://github.com/apache/cxf/blob/eab841d5477c5e1ed21a49918defa7
> > > 9a0f1ad533/core/src/main/java/org/apache/cxf/staxutils/
> > StaxUtils.java#L381
> > > then you would know immediately why the throwable is thrown.
> > >
> > >
> > > Romain Manni-Bucau
> > > @rmannibucau  |  Blog
> > >  | Old Wordpress Blog
> > >  | Github  > > rmannibucau> |
> > > LinkedIn  | Tomitriber
> > >  | JavaEE Factory
> > > 
> > >
> > > 2016-10-17 22:41 GMT+02:00 Steve Goldsmith :
> > >
> > > > OK, I made the following change and I still get the error:
> > > >
> > > > 
> > > > org.jvnet.jaxb2_commons
> > > > jaxb2-basics-runtime
> > > > 0.10.0
> > > > provided
> > > > 
> > > >
> > > > I even tried:
> > > >
> > > > 
> > > > org.apache.tomee
> > > > tomee-jaxrs
> > > > ${tomee.version}
> > > > test
> > > > 
> > > > 
> > > > com.sun.xml.bind
> > > > jaxb-impl
> > > > 
> > > > 
> > > > 
> > > >
> > > >
> > > > On Mon, Oct 17, 2016 at 3:37 PM, Romain Manni-Bucau <
> > > rmannibu...@gmail.com
> > > > >
> > > > wrote:
> > > >
> > > > > well jaxb is provided and shouldnt be delivered so you have to
> remove
> > > it
> > > > > from WEB-INF/lib. scope=provided should be fine too.
> > > > >
> > > > >
> > > > > Romain Manni-Bucau
> > > > > @rmannibucau  |  Blog
> > > > >  | Old Wordpress Blog
> > > > >  | Github  > > > > rmannibucau> |
> > > > > LinkedIn  | Tomitriber
> > > > >  | JavaEE Factory
> > > > > 
> > > > >
> > > > > 2016-10-17 20:07 GMT+02:00 Steve Goldsmith :
> > > > >
> > > > > > I need JAX-B runtime for code generated by jaxws-maven-plugin and
> > > XJC.
> > > > > > Everything else is in test scope and not used in the deployed
> app.
> > > > > >
> > > > > > 
> > > > > > org.jvnet.jaxb2_commons
> > > > > > jaxb2-basics-runtime
> > > > > > 0.10.0
> > > > > > 
> > > > > >
> > > > > >
> > > > > > On Mon, Oct 17, 2016 at 1:57 PM, Romain Manni-Bucau <
> > > > > rmannibu...@gmail.com
> > > > > > >
> > > > > > wrote:
> > > > > >
> > > > > > > yep so surely some part of the app running in a conflicting
> > > > > classloader.
> > > > > > > Personally I'd just remove stax2-api, woodstox and jaxb to
> start
> > > > > > >
> > > > > > >
> > > > > > > Romain Manni-Bucau
> > > > > > > @rmannibucau  |  Blog
> > > > > > >  | Old Wordpress Blog
> > > > > > >  | Github <
> https://github.com/
> > > > > > > rmannibucau> |
> > > > > > > LinkedIn  |
> Tomitriber
> > > > > > >  | JavaEE Factory
> > > > > > > 
> > > > > > >
> > > > > > > 2016-10-17 19:47 GMT+02:00 Steve Goldsmith :
> > > > > > >
> > > > > > > > ~/java/apache-maven-3.3.9/bin/mvn dependency:tree | egrep
> > > > > > 'woo|xml|stax'
> > > > > > > > [INFO] |  | +- javax.xml.bind:jaxb-api:jar:2.2.6:test
> > > > > > > > [INFO] |  | \- com.sun.xml.bind:jaxb-impl:jar:2.2.6:test
> > > > > > > > [INFO] |  | | +- org.apache.santuario:xmlsec:
> > > > jar:2.0.5:test
> > > > > > > >

Re: Cannot create a secure XMLInputFactory

2016-10-17 Thread Romain Manni-Bucau

cxf ones yes, that's as easy as adding cxf-core as provded dependency,
putting a breakpoint on the mentionned line normally and starting tomee in
debug mode. Surely the most efficient way to solve it.


Romain Manni-Bucau
@rmannibucau  |  Blog
 | Old Wordpress Blog
 | Github  |
LinkedIn  | Tomitriber
 | JavaEE Factory


2016-10-17 22:52 GMT+02:00 Steve Goldsmith :

> You mean set a breakpoint in TomEE source?
>
> On Mon, Oct 17, 2016 at 4:43 PM, Romain Manni-Bucau  >
> wrote:
>
> > If you can put a breakpoint at
> > https://github.com/apache/cxf/blob/eab841d5477c5e1ed21a49918defa7
> > 9a0f1ad533/core/src/main/java/org/apache/cxf/staxutils/
> StaxUtils.java#L381
> > then you would know immediately why the throwable is thrown.
> >
> >
> > Romain Manni-Bucau
> > @rmannibucau  |  Blog
> >  | Old Wordpress Blog
> >  | Github  > rmannibucau> |
> > LinkedIn  | Tomitriber
> >  | JavaEE Factory
> > 
> >
> > 2016-10-17 22:41 GMT+02:00 Steve Goldsmith :
> >
> > > OK, I made the following change and I still get the error:
> > >
> > > 
> > > org.jvnet.jaxb2_commons
> > > jaxb2-basics-runtime
> > > 0.10.0
> > > provided
> > > 
> > >
> > > I even tried:
> > >
> > > 
> > > org.apache.tomee
> > > tomee-jaxrs
> > > ${tomee.version}
> > > test
> > > 
> > > 
> > > com.sun.xml.bind
> > > jaxb-impl
> > > 
> > > 
> > > 
> > >
> > >
> > > On Mon, Oct 17, 2016 at 3:37 PM, Romain Manni-Bucau <
> > rmannibu...@gmail.com
> > > >
> > > wrote:
> > >
> > > > well jaxb is provided and shouldnt be delivered so you have to remove
> > it
> > > > from WEB-INF/lib. scope=provided should be fine too.
> > > >
> > > >
> > > > Romain Manni-Bucau
> > > > @rmannibucau  |  Blog
> > > >  | Old Wordpress Blog
> > > >  | Github  > > > rmannibucau> |
> > > > LinkedIn  | Tomitriber
> > > >  | JavaEE Factory
> > > > 
> > > >
> > > > 2016-10-17 20:07 GMT+02:00 Steve Goldsmith :
> > > >
> > > > > I need JAX-B runtime for code generated by jaxws-maven-plugin and
> > XJC.
> > > > > Everything else is in test scope and not used in the deployed app.
> > > > >
> > > > > 
> > > > > org.jvnet.jaxb2_commons
> > > > > jaxb2-basics-runtime
> > > > > 0.10.0
> > > > > 
> > > > >
> > > > >
> > > > > On Mon, Oct 17, 2016 at 1:57 PM, Romain Manni-Bucau <
> > > > rmannibu...@gmail.com
> > > > > >
> > > > > wrote:
> > > > >
> > > > > > yep so surely some part of the app running in a conflicting
> > > > classloader.
> > > > > > Personally I'd just remove stax2-api, woodstox and jaxb to start
> > > > > >
> > > > > >
> > > > > > Romain Manni-Bucau
> > > > > > @rmannibucau  |  Blog
> > > > > >  | Old Wordpress Blog
> > > > > >  | Github  > > > > > rmannibucau> |
> > > > > > LinkedIn  | Tomitriber
> > > > > >  | JavaEE Factory
> > > > > > 
> > > > > >
> > > > > > 2016-10-17 19:47 GMT+02:00 Steve Goldsmith :
> > > > > >
> > > > > > > ~/java/apache-maven-3.3.9/bin/mvn dependency:tree | egrep
> > > > > 'woo|xml|stax'
> > > > > > > [INFO] |  | +- javax.xml.bind:jaxb-api:jar:2.2.6:test
> > > > > > > [INFO] |  | \- com.sun.xml.bind:jaxb-impl:jar:2.2.6:test
> > > > > > > [INFO] |  | | +- org.apache.santuario:xmlsec:
> > > jar:2.0.5:test
> > > > > > > [INFO] |  | | |  |  +-
> > > > > > > org.opensaml:opensaml-xmlsec-api:jar:3.1.1:test
> > > > > > > [INFO] |  | | |  +- org.opensaml:opensaml-xmlsec-
> > > > > > > impl:jar:3.1.1:test
> > > > > > > [INFO] |  | +- org.apache.wss4j:wss4j-ws-
> > > > > > security-stax:jar:2.1.4:test
> > > > > > > [INFO] |  | +-
> > > > > > > org.apache.wss4j:wss4j-ws-security-policy-stax:jar:2.1.4:test
> > > > > > > [INFO] |  | |  +- xml-resolver:xml-resolver:jar:1.2:test
> > > > > > > [INFO] |

Re: Cannot create a secure XMLInputFactory

2016-10-17 Thread Steve Goldsmith

You mean set a breakpoint in TomEE source?

On Mon, Oct 17, 2016 at 4:43 PM, Romain Manni-Bucau 
wrote:

> If you can put a breakpoint at
> https://github.com/apache/cxf/blob/eab841d5477c5e1ed21a49918defa7
> 9a0f1ad533/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java#L381
> then you would know immediately why the throwable is thrown.
>
>
> Romain Manni-Bucau
> @rmannibucau  |  Blog
>  | Old Wordpress Blog
>  | Github  rmannibucau> |
> LinkedIn  | Tomitriber
>  | JavaEE Factory
> 
>
> 2016-10-17 22:41 GMT+02:00 Steve Goldsmith :
>
> > OK, I made the following change and I still get the error:
> >
> > 
> > org.jvnet.jaxb2_commons
> > jaxb2-basics-runtime
> > 0.10.0
> > provided
> > 
> >
> > I even tried:
> >
> > 
> > org.apache.tomee
> > tomee-jaxrs
> > ${tomee.version}
> > test
> > 
> > 
> > com.sun.xml.bind
> > jaxb-impl
> > 
> > 
> > 
> >
> >
> > On Mon, Oct 17, 2016 at 3:37 PM, Romain Manni-Bucau <
> rmannibu...@gmail.com
> > >
> > wrote:
> >
> > > well jaxb is provided and shouldnt be delivered so you have to remove
> it
> > > from WEB-INF/lib. scope=provided should be fine too.
> > >
> > >
> > > Romain Manni-Bucau
> > > @rmannibucau  |  Blog
> > >  | Old Wordpress Blog
> > >  | Github  > > rmannibucau> |
> > > LinkedIn  | Tomitriber
> > >  | JavaEE Factory
> > > 
> > >
> > > 2016-10-17 20:07 GMT+02:00 Steve Goldsmith :
> > >
> > > > I need JAX-B runtime for code generated by jaxws-maven-plugin and
> XJC.
> > > > Everything else is in test scope and not used in the deployed app.
> > > >
> > > > 
> > > > org.jvnet.jaxb2_commons
> > > > jaxb2-basics-runtime
> > > > 0.10.0
> > > > 
> > > >
> > > >
> > > > On Mon, Oct 17, 2016 at 1:57 PM, Romain Manni-Bucau <
> > > rmannibu...@gmail.com
> > > > >
> > > > wrote:
> > > >
> > > > > yep so surely some part of the app running in a conflicting
> > > classloader.
> > > > > Personally I'd just remove stax2-api, woodstox and jaxb to start
> > > > >
> > > > >
> > > > > Romain Manni-Bucau
> > > > > @rmannibucau  |  Blog
> > > > >  | Old Wordpress Blog
> > > > >  | Github  > > > > rmannibucau> |
> > > > > LinkedIn  | Tomitriber
> > > > >  | JavaEE Factory
> > > > > 
> > > > >
> > > > > 2016-10-17 19:47 GMT+02:00 Steve Goldsmith :
> > > > >
> > > > > > ~/java/apache-maven-3.3.9/bin/mvn dependency:tree | egrep
> > > > 'woo|xml|stax'
> > > > > > [INFO] |  | +- javax.xml.bind:jaxb-api:jar:2.2.6:test
> > > > > > [INFO] |  | \- com.sun.xml.bind:jaxb-impl:jar:2.2.6:test
> > > > > > [INFO] |  | | +- org.apache.santuario:xmlsec:
> > jar:2.0.5:test
> > > > > > [INFO] |  | | |  |  +-
> > > > > > org.opensaml:opensaml-xmlsec-api:jar:3.1.1:test
> > > > > > [INFO] |  | | |  +- org.opensaml:opensaml-xmlsec-
> > > > > > impl:jar:3.1.1:test
> > > > > > [INFO] |  | +- org.apache.wss4j:wss4j-ws-
> > > > > security-stax:jar:2.1.4:test
> > > > > > [INFO] |  | +-
> > > > > > org.apache.wss4j:wss4j-ws-security-policy-stax:jar:2.1.4:test
> > > > > > [INFO] |  | |  +- xml-resolver:xml-resolver:jar:1.2:test
> > > > > > [INFO] |  | |  +- org.apache.cxf:cxf-rt-
> > > > bindings-xml:jar:3.1.6:test
> > > > > > [INFO] |  | \- com.sun.xml.messaging.saaj:
> > > > saaj-impl:jar:1.3.18:test
> > > > > > [INFO] |  |  | +- org.codehaus.woodstox:
> > > > woodstox-core-asl:jar:4.4.1:
> > > > > > test
> > > > > > [INFO] |  |  | |  \- org.codehaus.woodstox:stax2-
> > > > api:jar:3.1.4:test
> > > > > > [INFO] |  |  | \- org.apache.ws.xmlschema:
> > > > > > xmlschema-core:jar:2.2.1:test
> > > > > > [INFO] +-
> > > > > > com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider:
> > > jar:2.7.4:test
> > > > > > [INFO] |  +- com.fasterxml.jackson.jaxrs:
> > > jackson-jaxrs-base:jar:2.7.4:
> > > > > test
> > > > > > [INFO] |  +- com.fasterxml.jackson.core:
> > jackson-core:jar:2.7.4:test
> > > > > > [INFO] |  +- com.fasterxml.jackson.core:
> > jackson-databind:jar:2.7.4:
> > > > test
> >

Re: Cannot create a secure XMLInputFactory

2016-10-17 Thread Romain Manni-Bucau

If you can put a breakpoint at
https://github.com/apache/cxf/blob/eab841d5477c5e1ed21a49918defa79a0f1ad533/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java#L381
then you would know immediately why the throwable is thrown.


Romain Manni-Bucau
@rmannibucau  |  Blog
 | Old Wordpress Blog
 | Github  |
LinkedIn  | Tomitriber
 | JavaEE Factory


2016-10-17 22:41 GMT+02:00 Steve Goldsmith :

> OK, I made the following change and I still get the error:
>
> 
> org.jvnet.jaxb2_commons
> jaxb2-basics-runtime
> 0.10.0
> provided
> 
>
> I even tried:
>
> 
> org.apache.tomee
> tomee-jaxrs
> ${tomee.version}
> test
> 
> 
> com.sun.xml.bind
> jaxb-impl
> 
> 
> 
>
>
> On Mon, Oct 17, 2016 at 3:37 PM, Romain Manni-Bucau  >
> wrote:
>
> > well jaxb is provided and shouldnt be delivered so you have to remove it
> > from WEB-INF/lib. scope=provided should be fine too.
> >
> >
> > Romain Manni-Bucau
> > @rmannibucau  |  Blog
> >  | Old Wordpress Blog
> >  | Github  > rmannibucau> |
> > LinkedIn  | Tomitriber
> >  | JavaEE Factory
> > 
> >
> > 2016-10-17 20:07 GMT+02:00 Steve Goldsmith :
> >
> > > I need JAX-B runtime for code generated by jaxws-maven-plugin and XJC.
> > > Everything else is in test scope and not used in the deployed app.
> > >
> > > 
> > > org.jvnet.jaxb2_commons
> > > jaxb2-basics-runtime
> > > 0.10.0
> > > 
> > >
> > >
> > > On Mon, Oct 17, 2016 at 1:57 PM, Romain Manni-Bucau <
> > rmannibu...@gmail.com
> > > >
> > > wrote:
> > >
> > > > yep so surely some part of the app running in a conflicting
> > classloader.
> > > > Personally I'd just remove stax2-api, woodstox and jaxb to start
> > > >
> > > >
> > > > Romain Manni-Bucau
> > > > @rmannibucau  |  Blog
> > > >  | Old Wordpress Blog
> > > >  | Github  > > > rmannibucau> |
> > > > LinkedIn  | Tomitriber
> > > >  | JavaEE Factory
> > > > 
> > > >
> > > > 2016-10-17 19:47 GMT+02:00 Steve Goldsmith :
> > > >
> > > > > ~/java/apache-maven-3.3.9/bin/mvn dependency:tree | egrep
> > > 'woo|xml|stax'
> > > > > [INFO] |  | +- javax.xml.bind:jaxb-api:jar:2.2.6:test
> > > > > [INFO] |  | \- com.sun.xml.bind:jaxb-impl:jar:2.2.6:test
> > > > > [INFO] |  | | +- org.apache.santuario:xmlsec:
> jar:2.0.5:test
> > > > > [INFO] |  | | |  |  +-
> > > > > org.opensaml:opensaml-xmlsec-api:jar:3.1.1:test
> > > > > [INFO] |  | | |  +- org.opensaml:opensaml-xmlsec-
> > > > > impl:jar:3.1.1:test
> > > > > [INFO] |  | +- org.apache.wss4j:wss4j-ws-
> > > > security-stax:jar:2.1.4:test
> > > > > [INFO] |  | +-
> > > > > org.apache.wss4j:wss4j-ws-security-policy-stax:jar:2.1.4:test
> > > > > [INFO] |  | |  +- xml-resolver:xml-resolver:jar:1.2:test
> > > > > [INFO] |  | |  +- org.apache.cxf:cxf-rt-
> > > bindings-xml:jar:3.1.6:test
> > > > > [INFO] |  | \- com.sun.xml.messaging.saaj:
> > > saaj-impl:jar:1.3.18:test
> > > > > [INFO] |  |  | +- org.codehaus.woodstox:
> > > woodstox-core-asl:jar:4.4.1:
> > > > > test
> > > > > [INFO] |  |  | |  \- org.codehaus.woodstox:stax2-
> > > api:jar:3.1.4:test
> > > > > [INFO] |  |  | \- org.apache.ws.xmlschema:
> > > > > xmlschema-core:jar:2.2.1:test
> > > > > [INFO] +-
> > > > > com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider:
> > jar:2.7.4:test
> > > > > [INFO] |  +- com.fasterxml.jackson.jaxrs:
> > jackson-jaxrs-base:jar:2.7.4:
> > > > test
> > > > > [INFO] |  +- com.fasterxml.jackson.core:
> jackson-core:jar:2.7.4:test
> > > > > [INFO] |  +- com.fasterxml.jackson.core:
> jackson-databind:jar:2.7.4:
> > > test
> > > > > [INFO] |  |  \-
> > > > > com.fasterxml.jackson.core:jackson-annotations:jar:2.7.0:test
> > > > > [INFO] |  \-
> > > > > com.fasterxml.jackson.module:jackson-module-jaxb-
> > > > > annotations:jar:2.7.4:test
> > > > >
> > > > >
> > > > > On Mon, Oct 17, 2016 at 11:40 AM, Romain Manni-Bucau <
> > > > > rmannibu...@gmail.com>
> > > > > wrote:
> > > > >
> > > > > > mvn dependency:tree

Re: Cannot create a secure XMLInputFactory

2016-10-17 Thread Steve Goldsmith

OK, I made the following change and I still get the error:


org.jvnet.jaxb2_commons
jaxb2-basics-runtime
0.10.0
provided


I even tried:


org.apache.tomee
tomee-jaxrs
${tomee.version}
test


com.sun.xml.bind
jaxb-impl





On Mon, Oct 17, 2016 at 3:37 PM, Romain Manni-Bucau 
wrote:

> well jaxb is provided and shouldnt be delivered so you have to remove it
> from WEB-INF/lib. scope=provided should be fine too.
>
>
> Romain Manni-Bucau
> @rmannibucau  |  Blog
>  | Old Wordpress Blog
>  | Github  rmannibucau> |
> LinkedIn  | Tomitriber
>  | JavaEE Factory
> 
>
> 2016-10-17 20:07 GMT+02:00 Steve Goldsmith :
>
> > I need JAX-B runtime for code generated by jaxws-maven-plugin and XJC.
> > Everything else is in test scope and not used in the deployed app.
> >
> > 
> > org.jvnet.jaxb2_commons
> > jaxb2-basics-runtime
> > 0.10.0
> > 
> >
> >
> > On Mon, Oct 17, 2016 at 1:57 PM, Romain Manni-Bucau <
> rmannibu...@gmail.com
> > >
> > wrote:
> >
> > > yep so surely some part of the app running in a conflicting
> classloader.
> > > Personally I'd just remove stax2-api, woodstox and jaxb to start
> > >
> > >
> > > Romain Manni-Bucau
> > > @rmannibucau  |  Blog
> > >  | Old Wordpress Blog
> > >  | Github  > > rmannibucau> |
> > > LinkedIn  | Tomitriber
> > >  | JavaEE Factory
> > > 
> > >
> > > 2016-10-17 19:47 GMT+02:00 Steve Goldsmith :
> > >
> > > > ~/java/apache-maven-3.3.9/bin/mvn dependency:tree | egrep
> > 'woo|xml|stax'
> > > > [INFO] |  | +- javax.xml.bind:jaxb-api:jar:2.2.6:test
> > > > [INFO] |  | \- com.sun.xml.bind:jaxb-impl:jar:2.2.6:test
> > > > [INFO] |  | | +- org.apache.santuario:xmlsec:jar:2.0.5:test
> > > > [INFO] |  | | |  |  +-
> > > > org.opensaml:opensaml-xmlsec-api:jar:3.1.1:test
> > > > [INFO] |  | | |  +- org.opensaml:opensaml-xmlsec-
> > > > impl:jar:3.1.1:test
> > > > [INFO] |  | +- org.apache.wss4j:wss4j-ws-
> > > security-stax:jar:2.1.4:test
> > > > [INFO] |  | +-
> > > > org.apache.wss4j:wss4j-ws-security-policy-stax:jar:2.1.4:test
> > > > [INFO] |  | |  +- xml-resolver:xml-resolver:jar:1.2:test
> > > > [INFO] |  | |  +- org.apache.cxf:cxf-rt-
> > bindings-xml:jar:3.1.6:test
> > > > [INFO] |  | \- com.sun.xml.messaging.saaj:
> > saaj-impl:jar:1.3.18:test
> > > > [INFO] |  |  | +- org.codehaus.woodstox:
> > woodstox-core-asl:jar:4.4.1:
> > > > test
> > > > [INFO] |  |  | |  \- org.codehaus.woodstox:stax2-
> > api:jar:3.1.4:test
> > > > [INFO] |  |  | \- org.apache.ws.xmlschema:
> > > > xmlschema-core:jar:2.2.1:test
> > > > [INFO] +-
> > > > com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider:
> jar:2.7.4:test
> > > > [INFO] |  +- com.fasterxml.jackson.jaxrs:
> jackson-jaxrs-base:jar:2.7.4:
> > > test
> > > > [INFO] |  +- com.fasterxml.jackson.core:jackson-core:jar:2.7.4:test
> > > > [INFO] |  +- com.fasterxml.jackson.core:jackson-databind:jar:2.7.4:
> > test
> > > > [INFO] |  |  \-
> > > > com.fasterxml.jackson.core:jackson-annotations:jar:2.7.0:test
> > > > [INFO] |  \-
> > > > com.fasterxml.jackson.module:jackson-module-jaxb-
> > > > annotations:jar:2.7.4:test
> > > >
> > > >
> > > > On Mon, Oct 17, 2016 at 11:40 AM, Romain Manni-Bucau <
> > > > rmannibu...@gmail.com>
> > > > wrote:
> > > >
> > > > > mvn dependency:tree | egrep 'woo|xml|stax'
> > > > >
> > > > >
> > > > > Romain Manni-Bucau
> > > > > @rmannibucau  |  Blog
> > > > >  | Old Wordpress Blog
> > > > >  | Github  > > > > rmannibucau> |
> > > > > LinkedIn  | Tomitriber
> > > > >  | JavaEE Factory
> > > > > 
> > > > >
> > > > > 2016-10-17 17:36 GMT+02:00 Steve Goldsmith :
> > > > >
> > > > > > My compile dependencies are (do you see anything that sticks
> out):
> > > > > >
> > > > > > 
> > > > > > org.jsr107.ri
> > > > > > cache-annotations-ri-cdi
> > > > > > 1.0.0
> > > > > > 
> > > > > > 
> > > > > > org.jvnet.jaxb2_commons
> > > >

Re: Cannot create a secure XMLInputFactory

2016-10-17 Thread Romain Manni-Bucau

well jaxb is provided and shouldnt be delivered so you have to remove it
from WEB-INF/lib. scope=provided should be fine too.


Romain Manni-Bucau
@rmannibucau  |  Blog
 | Old Wordpress Blog
 | Github  |
LinkedIn  | Tomitriber
 | JavaEE Factory


2016-10-17 20:07 GMT+02:00 Steve Goldsmith :

> I need JAX-B runtime for code generated by jaxws-maven-plugin and XJC.
> Everything else is in test scope and not used in the deployed app.
>
> 
> org.jvnet.jaxb2_commons
> jaxb2-basics-runtime
> 0.10.0
> 
>
>
> On Mon, Oct 17, 2016 at 1:57 PM, Romain Manni-Bucau  >
> wrote:
>
> > yep so surely some part of the app running in a conflicting classloader.
> > Personally I'd just remove stax2-api, woodstox and jaxb to start
> >
> >
> > Romain Manni-Bucau
> > @rmannibucau  |  Blog
> >  | Old Wordpress Blog
> >  | Github  > rmannibucau> |
> > LinkedIn  | Tomitriber
> >  | JavaEE Factory
> > 
> >
> > 2016-10-17 19:47 GMT+02:00 Steve Goldsmith :
> >
> > > ~/java/apache-maven-3.3.9/bin/mvn dependency:tree | egrep
> 'woo|xml|stax'
> > > [INFO] |  | +- javax.xml.bind:jaxb-api:jar:2.2.6:test
> > > [INFO] |  | \- com.sun.xml.bind:jaxb-impl:jar:2.2.6:test
> > > [INFO] |  | | +- org.apache.santuario:xmlsec:jar:2.0.5:test
> > > [INFO] |  | | |  |  +-
> > > org.opensaml:opensaml-xmlsec-api:jar:3.1.1:test
> > > [INFO] |  | | |  +- org.opensaml:opensaml-xmlsec-
> > > impl:jar:3.1.1:test
> > > [INFO] |  | +- org.apache.wss4j:wss4j-ws-
> > security-stax:jar:2.1.4:test
> > > [INFO] |  | +-
> > > org.apache.wss4j:wss4j-ws-security-policy-stax:jar:2.1.4:test
> > > [INFO] |  | |  +- xml-resolver:xml-resolver:jar:1.2:test
> > > [INFO] |  | |  +- org.apache.cxf:cxf-rt-
> bindings-xml:jar:3.1.6:test
> > > [INFO] |  | \- com.sun.xml.messaging.saaj:
> saaj-impl:jar:1.3.18:test
> > > [INFO] |  |  | +- org.codehaus.woodstox:
> woodstox-core-asl:jar:4.4.1:
> > > test
> > > [INFO] |  |  | |  \- org.codehaus.woodstox:stax2-
> api:jar:3.1.4:test
> > > [INFO] |  |  | \- org.apache.ws.xmlschema:
> > > xmlschema-core:jar:2.2.1:test
> > > [INFO] +-
> > > com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider:jar:2.7.4:test
> > > [INFO] |  +- com.fasterxml.jackson.jaxrs:jackson-jaxrs-base:jar:2.7.4:
> > test
> > > [INFO] |  +- com.fasterxml.jackson.core:jackson-core:jar:2.7.4:test
> > > [INFO] |  +- com.fasterxml.jackson.core:jackson-databind:jar:2.7.4:
> test
> > > [INFO] |  |  \-
> > > com.fasterxml.jackson.core:jackson-annotations:jar:2.7.0:test
> > > [INFO] |  \-
> > > com.fasterxml.jackson.module:jackson-module-jaxb-
> > > annotations:jar:2.7.4:test
> > >
> > >
> > > On Mon, Oct 17, 2016 at 11:40 AM, Romain Manni-Bucau <
> > > rmannibu...@gmail.com>
> > > wrote:
> > >
> > > > mvn dependency:tree | egrep 'woo|xml|stax'
> > > >
> > > >
> > > > Romain Manni-Bucau
> > > > @rmannibucau  |  Blog
> > > >  | Old Wordpress Blog
> > > >  | Github  > > > rmannibucau> |
> > > > LinkedIn  | Tomitriber
> > > >  | JavaEE Factory
> > > > 
> > > >
> > > > 2016-10-17 17:36 GMT+02:00 Steve Goldsmith :
> > > >
> > > > > My compile dependencies are (do you see anything that sticks out):
> > > > >
> > > > > 
> > > > > org.jsr107.ri
> > > > > cache-annotations-ri-cdi
> > > > > 1.0.0
> > > > > 
> > > > > 
> > > > > org.jvnet.jaxb2_commons
> > > > > jaxb2-basics-runtime
> > > > > 0.10.0
> > > > > 
> > > > > 
> > > > > org.slf4j
> > > > > slf4j-api
> > > > > ${slf4j.version}
> > > > > 
> > > > > 
> > > > > ch.qos.logback
> > > > > logback-classic
> > > > > ${logback.version}
> > > > > 
> > > > > 
> > > > > ch.qos.logback
> > > > > logback-core
> > > > > ${logback.version}
> > > > > 
> > > > > 
> > > > > org.apache.commons
> > > > > commons-pool2
> > > > > 2.4.2
> > > > > 
> > > > > 
> > > > > commons-configuration
> > > > >

Re: Cannot create a secure XMLInputFactory

2016-10-17 Thread Steve Goldsmith

I need JAX-B runtime for code generated by jaxws-maven-plugin and XJC.
Everything else is in test scope and not used in the deployed app.


org.jvnet.jaxb2_commons
jaxb2-basics-runtime
0.10.0



On Mon, Oct 17, 2016 at 1:57 PM, Romain Manni-Bucau 
wrote:

> yep so surely some part of the app running in a conflicting classloader.
> Personally I'd just remove stax2-api, woodstox and jaxb to start
>
>
> Romain Manni-Bucau
> @rmannibucau  |  Blog
>  | Old Wordpress Blog
>  | Github  rmannibucau> |
> LinkedIn  | Tomitriber
>  | JavaEE Factory
> 
>
> 2016-10-17 19:47 GMT+02:00 Steve Goldsmith :
>
> > ~/java/apache-maven-3.3.9/bin/mvn dependency:tree | egrep 'woo|xml|stax'
> > [INFO] |  | +- javax.xml.bind:jaxb-api:jar:2.2.6:test
> > [INFO] |  | \- com.sun.xml.bind:jaxb-impl:jar:2.2.6:test
> > [INFO] |  | | +- org.apache.santuario:xmlsec:jar:2.0.5:test
> > [INFO] |  | | |  |  +-
> > org.opensaml:opensaml-xmlsec-api:jar:3.1.1:test
> > [INFO] |  | | |  +- org.opensaml:opensaml-xmlsec-
> > impl:jar:3.1.1:test
> > [INFO] |  | +- org.apache.wss4j:wss4j-ws-
> security-stax:jar:2.1.4:test
> > [INFO] |  | +-
> > org.apache.wss4j:wss4j-ws-security-policy-stax:jar:2.1.4:test
> > [INFO] |  | |  +- xml-resolver:xml-resolver:jar:1.2:test
> > [INFO] |  | |  +- org.apache.cxf:cxf-rt-bindings-xml:jar:3.1.6:test
> > [INFO] |  | \- com.sun.xml.messaging.saaj:saaj-impl:jar:1.3.18:test
> > [INFO] |  |  | +- org.codehaus.woodstox:woodstox-core-asl:jar:4.4.1:
> > test
> > [INFO] |  |  | |  \- org.codehaus.woodstox:stax2-api:jar:3.1.4:test
> > [INFO] |  |  | \- org.apache.ws.xmlschema:
> > xmlschema-core:jar:2.2.1:test
> > [INFO] +-
> > com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider:jar:2.7.4:test
> > [INFO] |  +- com.fasterxml.jackson.jaxrs:jackson-jaxrs-base:jar:2.7.4:
> test
> > [INFO] |  +- com.fasterxml.jackson.core:jackson-core:jar:2.7.4:test
> > [INFO] |  +- com.fasterxml.jackson.core:jackson-databind:jar:2.7.4:test
> > [INFO] |  |  \-
> > com.fasterxml.jackson.core:jackson-annotations:jar:2.7.0:test
> > [INFO] |  \-
> > com.fasterxml.jackson.module:jackson-module-jaxb-
> > annotations:jar:2.7.4:test
> >
> >
> > On Mon, Oct 17, 2016 at 11:40 AM, Romain Manni-Bucau <
> > rmannibu...@gmail.com>
> > wrote:
> >
> > > mvn dependency:tree | egrep 'woo|xml|stax'
> > >
> > >
> > > Romain Manni-Bucau
> > > @rmannibucau  |  Blog
> > >  | Old Wordpress Blog
> > >  | Github  > > rmannibucau> |
> > > LinkedIn  | Tomitriber
> > >  | JavaEE Factory
> > > 
> > >
> > > 2016-10-17 17:36 GMT+02:00 Steve Goldsmith :
> > >
> > > > My compile dependencies are (do you see anything that sticks out):
> > > >
> > > > 
> > > > org.jsr107.ri
> > > > cache-annotations-ri-cdi
> > > > 1.0.0
> > > > 
> > > > 
> > > > org.jvnet.jaxb2_commons
> > > > jaxb2-basics-runtime
> > > > 0.10.0
> > > > 
> > > > 
> > > > org.slf4j
> > > > slf4j-api
> > > > ${slf4j.version}
> > > > 
> > > > 
> > > > ch.qos.logback
> > > > logback-classic
> > > > ${logback.version}
> > > > 
> > > > 
> > > > ch.qos.logback
> > > > logback-core
> > > > ${logback.version}
> > > > 
> > > > 
> > > > org.apache.commons
> > > > commons-pool2
> > > > 2.4.2
> > > > 
> > > > 
> > > > commons-configuration
> > > > commons-configuration
> > > > 1.10
> > > > 
> > > > 
> > > > org.jasypt
> > > > jasypt
> > > > 1.9.3-SNAPSHOT
> > > > 
> > > >
> > > >
> > > > On Mon, Oct 17, 2016 at 11:30 AM, Romain Manni-Bucau <
> > > > rmannibu...@gmail.com>
> > > > wrote:
> > > >
> > > > > Hello
> > > > >
> > > > > can happen if you provide some xml libraries in your app - like
> > > woodstox
> > > > or
> > > > > stax*api - and it conflicts at some point.
> > > > >
> > > > >
> > > > > Romain Manni-Bucau
> > > > > @rmannibucau  |  Blog
> > > > >  | Old Wordpress Blog
> > > > >  | Github  > > > > rmannibucau> |
> > > > > LinkedIn

Re: Cannot create a secure XMLInputFactory

2016-10-17 Thread Steve Goldsmith

~/java/apache-maven-3.3.9/bin/mvn dependency:tree | egrep 'woo|xml|stax'
[INFO] |  | +- javax.xml.bind:jaxb-api:jar:2.2.6:test
[INFO] |  | \- com.sun.xml.bind:jaxb-impl:jar:2.2.6:test
[INFO] |  | | +- org.apache.santuario:xmlsec:jar:2.0.5:test
[INFO] |  | | |  |  +-
org.opensaml:opensaml-xmlsec-api:jar:3.1.1:test
[INFO] |  | | |  +- org.opensaml:opensaml-xmlsec-impl:jar:3.1.1:test
[INFO] |  | +- org.apache.wss4j:wss4j-ws-security-stax:jar:2.1.4:test
[INFO] |  | +-
org.apache.wss4j:wss4j-ws-security-policy-stax:jar:2.1.4:test
[INFO] |  | |  +- xml-resolver:xml-resolver:jar:1.2:test
[INFO] |  | |  +- org.apache.cxf:cxf-rt-bindings-xml:jar:3.1.6:test
[INFO] |  | \- com.sun.xml.messaging.saaj:saaj-impl:jar:1.3.18:test
[INFO] |  |  | +- org.codehaus.woodstox:woodstox-core-asl:jar:4.4.1:test
[INFO] |  |  | |  \- org.codehaus.woodstox:stax2-api:jar:3.1.4:test
[INFO] |  |  | \- org.apache.ws.xmlschema:xmlschema-core:jar:2.2.1:test
[INFO] +-
com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider:jar:2.7.4:test
[INFO] |  +- com.fasterxml.jackson.jaxrs:jackson-jaxrs-base:jar:2.7.4:test
[INFO] |  +- com.fasterxml.jackson.core:jackson-core:jar:2.7.4:test
[INFO] |  +- com.fasterxml.jackson.core:jackson-databind:jar:2.7.4:test
[INFO] |  |  \-
com.fasterxml.jackson.core:jackson-annotations:jar:2.7.0:test
[INFO] |  \-
com.fasterxml.jackson.module:jackson-module-jaxb-annotations:jar:2.7.4:test


On Mon, Oct 17, 2016 at 11:40 AM, Romain Manni-Bucau 
wrote:

> mvn dependency:tree | egrep 'woo|xml|stax'
>
>
> Romain Manni-Bucau
> @rmannibucau  |  Blog
>  | Old Wordpress Blog
>  | Github  rmannibucau> |
> LinkedIn  | Tomitriber
>  | JavaEE Factory
> 
>
> 2016-10-17 17:36 GMT+02:00 Steve Goldsmith :
>
> > My compile dependencies are (do you see anything that sticks out):
> >
> > 
> > org.jsr107.ri
> > cache-annotations-ri-cdi
> > 1.0.0
> > 
> > 
> > org.jvnet.jaxb2_commons
> > jaxb2-basics-runtime
> > 0.10.0
> > 
> > 
> > org.slf4j
> > slf4j-api
> > ${slf4j.version}
> > 
> > 
> > ch.qos.logback
> > logback-classic
> > ${logback.version}
> > 
> > 
> > ch.qos.logback
> > logback-core
> > ${logback.version}
> > 
> > 
> > org.apache.commons
> > commons-pool2
> > 2.4.2
> > 
> > 
> > commons-configuration
> > commons-configuration
> > 1.10
> > 
> > 
> > org.jasypt
> > jasypt
> > 1.9.3-SNAPSHOT
> > 
> >
> >
> > On Mon, Oct 17, 2016 at 11:30 AM, Romain Manni-Bucau <
> > rmannibu...@gmail.com>
> > wrote:
> >
> > > Hello
> > >
> > > can happen if you provide some xml libraries in your app - like
> woodstox
> > or
> > > stax*api - and it conflicts at some point.
> > >
> > >
> > > Romain Manni-Bucau
> > > @rmannibucau  |  Blog
> > >  | Old Wordpress Blog
> > >  | Github  > > rmannibucau> |
> > > LinkedIn  | Tomitriber
> > >  | JavaEE Factory
> > > 
> > >
> > > 2016-10-17 17:18 GMT+02:00 sgjava :
> > >
> > > > Periodically I'm seeing "Cannot create a secure XMLInputFactory" in
> > TomEE
> > > > 7.0.2-SNAPSHOT. One solution is for CXF using
> > > > -Dorg.apache.cxf.stax.allowInsecureParser=1. This is an older 7.0.2
> > from
> > > > 7/4/16.
> > > >
> > > >
> > > >
> > > > --
> > > > View this message in context: http://tomee-openejb.979440.
> > > > n4.nabble.com/Cannot-create-a-secure-XMLInputFactory-tp4680348.html
> > > > Sent from the TomEE Users mailing list archive at Nabble.com.
> > > >
> > >
> >
> >
> >
> > --
> > Steven P. Goldsmith
> >
>



-- 
Steven P. Goldsmith

Re: Cannot create a secure XMLInputFactory

2016-10-17 Thread Steve Goldsmith

My compile dependencies are (do you see anything that sticks out):


org.jsr107.ri
cache-annotations-ri-cdi
1.0.0


org.jvnet.jaxb2_commons
jaxb2-basics-runtime
0.10.0


org.slf4j
slf4j-api
${slf4j.version}


ch.qos.logback
logback-classic
${logback.version}


ch.qos.logback
logback-core
${logback.version}


org.apache.commons
commons-pool2
2.4.2


commons-configuration
commons-configuration
1.10


org.jasypt
jasypt
1.9.3-SNAPSHOT



On Mon, Oct 17, 2016 at 11:30 AM, Romain Manni-Bucau 
wrote:

> Hello
>
> can happen if you provide some xml libraries in your app - like woodstox or
> stax*api - and it conflicts at some point.
>
>
> Romain Manni-Bucau
> @rmannibucau  |  Blog
>  | Old Wordpress Blog
>  | Github  rmannibucau> |
> LinkedIn  | Tomitriber
>  | JavaEE Factory
> 
>
> 2016-10-17 17:18 GMT+02:00 sgjava :
>
> > Periodically I'm seeing "Cannot create a secure XMLInputFactory" in TomEE
> > 7.0.2-SNAPSHOT. One solution is for CXF using
> > -Dorg.apache.cxf.stax.allowInsecureParser=1. This is an older 7.0.2 from
> > 7/4/16.
> >
> >
> >
> > --
> > View this message in context: http://tomee-openejb.979440.
> > n4.nabble.com/Cannot-create-a-secure-XMLInputFactory-tp4680348.html
> > Sent from the TomEE Users mailing list archive at Nabble.com.
> >
>



-- 
Steven P. Goldsmith

Re: Cannot create a secure XMLInputFactory

2016-10-17 Thread Romain Manni-Bucau

Hello

can happen if you provide some xml libraries in your app - like woodstox or
stax*api - and it conflicts at some point.


Romain Manni-Bucau
@rmannibucau  |  Blog
 | Old Wordpress Blog
 | Github  |
LinkedIn  | Tomitriber
 | JavaEE Factory


2016-10-17 17:18 GMT+02:00 sgjava :

> Periodically I'm seeing "Cannot create a secure XMLInputFactory" in TomEE
> 7.0.2-SNAPSHOT. One solution is for CXF using
> -Dorg.apache.cxf.stax.allowInsecureParser=1. This is an older 7.0.2 from
> 7/4/16.
>
>
>
> --
> View this message in context: http://tomee-openejb.979440.
> n4.nabble.com/Cannot-create-a-secure-XMLInputFactory-tp4680348.html
> Sent from the TomEE Users mailing list archive at Nabble.com.
>

Re: Cannot create a secure XMLInputFactory

Re: Cannot create a secure XMLInputFactory

Re: Cannot create a secure XMLInputFactory

Re: Cannot create a secure XMLInputFactory

Re: Cannot create a secure XMLInputFactory

Re: Cannot create a secure XMLInputFactory

Re: Cannot create a secure XMLInputFactory

Re: Cannot create a secure XMLInputFactory

Re: Cannot create a secure XMLInputFactory

Re: Cannot create a secure XMLInputFactory

Re: Cannot create a secure XMLInputFactory

Re: Cannot create a secure XMLInputFactory

Re: Cannot create a secure XMLInputFactory

Re: Cannot create a secure XMLInputFactory

Re: Cannot create a secure XMLInputFactory

Re: Cannot create a secure XMLInputFactory

Re: Cannot create a secure XMLInputFactory

Re: Cannot create a secure XMLInputFactory

Re: Cannot create a secure XMLInputFactory

Re: Cannot create a secure XMLInputFactory

Re: Cannot create a secure XMLInputFactory

Re: Cannot create a secure XMLInputFactory

Re: Cannot create a secure XMLInputFactory

Re: Cannot create a secure XMLInputFactory

Re: Cannot create a secure XMLInputFactory

Re: Cannot create a secure XMLInputFactory

26 matches

Site Navigation

Mail list logo

Footer information