CXF 2.7.x Woodstox Compatibility via Maven

Question

In the CXF's documentation it is said that the 2.7.x version requires the Woodstox jars not under the 4.2.0 version to be available in the classpath.

Can somebody, please, suggest Maven dependencies for Woodstox to work with CXF?

The main problem is when I try to use the cxf's client, an exception "Cannot create a secure XMLInputFactory" is raised. According to different forums (for example), it is possible to use the "org.apache.cxf.stax.allowInsecureParser" system property to solve the problem, but it seems not a good way. So that maven dependencies are the way to go...

Thanks in advance.

Solution 1

Well, finally I've got a solution. First of all I'd like to thank StaxMan for a help.

My environment is: Weblogic 11g, CXF 2.7.5

The problem is WLS already contains implementations for StAX API and xml parsers that is why an application doesn't see the Woodstox parser when using CXF.

Here is the pom.xml:

        <!-- CXF -->
        <dependency>
            <groupId>org.apache.cxf</groupId>
            <artifactId>cxf-api</artifactId>
        </dependency>

        <dependency>
            <groupId>org.apache.cxf</groupId>
            <artifactId>cxf-rt-frontend-jaxws</artifactId>
        </dependency>

        <dependency>
            <groupId>org.apache.cxf</groupId>
            <artifactId>cxf-rt-transports-http</artifactId>
        </dependency>

and the main part -- the weblogic-application.xml located in the resources/META-INF/ :

    <prefer-application-packages>
        <package-name>com.ctc.wstx.*</package-name>
        <package-name>org.apache.*</package-name>
    </prefer-application-packages>

Be aware of the fact that if do so there may occure the "NoClassDefinition" errors. If so, please, add maven dependencies that contain missing classes.

Hope this helps somebody.

Solution 2

This worked for me without prefer-application-packages impl:

<dependency>
            <groupId>org.apache.cxf</groupId>
            <artifactId>cxf-rt-frontend-jaxws</artifactId>
            <version>${cxf.version}</version>
            <exclusions>
                <exclusion>
                    <groupId>com.sun.xml.bind</groupId>
                    <artifactId>jaxb-impl</artifactId>
                </exclusion>
            </exclusions>
        </dependency>

        <dependency>
            <groupId>com.sun.xml.bind</groupId>
            <artifactId>jaxb-impl</artifactId>
            <version>2.2.2</version>
        </dependency>
        <dependency>
            <groupId>org.apache.cxf</groupId>
            <artifactId>cxf-rt-transports-http</artifactId>
            <version>${cxf.version}</version>
        </dependency>
        <!-- Jetty is needed if you're using the CXFServlet -->
        <dependency>
            <groupId>org.apache.cxf</groupId>
            <artifactId>cxf-rt-transports-http-jetty</artifactId>
            <version>${cxf.version}</version>
        </dependency>

Solution 3

The only way for now I can solve the problem is to add such lines in the spring's context:

<bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
    <property name="targetObject">
        <bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
            <property name="targetClass" value="java.lang.System" />
            <property name="targetMethod" value="getProperties" />
        </bean>
    </property>
    <property name="targetMethod" value="putAll" />
    <property name="arguments">
        <util:properties>
            <prop key="org.apache.cxf.stax.allowInsecureParser">true</prop>
        </util:properties>
    </property>
</bean>

Comments

[StaxMan]

Is it possible that somehow multiple Stax implementations might be included as dependencies (like BEA's reference implementation, or Sun SJSXP explicitly added)?

[StaxMan]

That would be CXF specific actually. But you can explicitly exclude inclusion of others in pom; first need to see if they are getting in (using "mvn dependency:tree"). Problem is that if CXF uses SPI style stax impl detection, order of precedence between choices in unspecified. But it may have specific overrides.

[Neron]

My friend, this is beautiful. Thanx a lot:)

[Neron]

And I think it is not an option for weblogic 10

[Dmitry]

@Neron, I think there are still some packages in your WLS that brake the configuration. Please, refer to this stackoverflow.com/questions/12716673/… post.

[Neron]

I have added the necessary ones as u gave in your solution but it did not helped. This should not be this much painfull:(

[Dmitry]

It's a pity but with CXF it is always really hard to make something work properly other than basic examples. Some people adviced to exclude the 'javax.xml.*' packages (with the 'prefer-application-packages'). Did you try this? This approach is also given in the post above.

[maiklos]

For a .war only solution in weblogic 10.3.6, I added the same prefer-application-packages element in the container-descriptor element in the the WEB-INF/weblogic.xml file (this means you don't have to create a .ear file unnecessarily).

[2787184]

Thanks Dmitry, I had the same issue and now it is resolved stackoverflow.com/questions/38366024/…

[Azhagu Surya]

@2787184 mentioned link is broken

[2787184]

@AzhaguSurya: Seems post removed by the community.