cxf 2way ssl not webservice Give无法创建安全的XMLInputFactory

Question

In my client of a web service which developed by cxf like this , and is supposed to be a 2-way ssl implementation I get the following exception.

java.lang.RuntimeException: Cannot create a secure XMLInputFactory

Unless I set the following environment property with value 1.

org.apache.cxf.stax.allowInsecureParser

But I guess it means that the connection will be insecure. Am I right?

Answer 1

That exception has nothing to do with SSL.

If your service consumes XML content and is accessed by untrusted clients (for example, it is exposed to the Internet), it will be vulnerable to an XXE attack . To mitigate, you need to have Woodstox 4.2.0 or later on the classpath. See WSTX-285 .

If your service doesn't accept XML content, you should be OK.

Answer 2

I added these three lines and worked fine

Properties props = System.getProperties(); props.setProperty("org.apache.cxf.stax.allowInsecureParser", "1"); props.setProperty("UseSunHttpHandler", "true");