jboss中调用webservice时报java.lang.RuntimeException: Cannot create a secure XMLInputFactory的异常

需求是这样的：现在写了一个调用webservice的程序，而需要将这个程序部署到jboss5.x服务器上来供前端调用，在本地调用webservice没有问题，但是部署到服务器上就会报这个错误了。

java.lang.RuntimeException: Cannot create a secure XMLInputFactory
        at org.apache.cxf.staxutils.StaxUtils.createXMLInputFactory(StaxUtils.java:315)
        at org.apache.cxf.staxutils.StaxUtils.getXMLInputFactory(StaxUtils.java:265)
        at org.apache.cxf.staxutils.StaxUtils.createXMLStreamReader(StaxUtils.java:1701)
        at org.apache.cxf.interceptor.StaxInInterceptor.handleMessage(StaxInInterceptor.java:123)
        at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:307)
        at org.apache.cxf.endpoint.ClientImpl.onMessage(ClientImpl.java:802)
        at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleResponseInternal(HTTPConduit.java:1638)
        at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleResponse(HTTPConduit.java:1527)
        at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.close(HTTPConduit.java:1330)
        at org.apache.cxf.transport.AbstractConduit.close(AbstractConduit.java:56)
        at org.apache.cxf.transport.http.HTTPConduit.close(HTTPConduit.java:638)
        at org.apache.cxf.interceptor.MessageSenderInterceptor$MessageSenderEndingInterceptor.handleMessage(MessageSenderInterceptor.java:62)
        at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:307)
        at org.apache.cxf.endpoint.ClientImpl.doInvoke(ClientImpl.java:516)
        at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:425)

网上众说纷纭，也不知道该如何解决，看来还是直接看源码吧。

    public static XMLInputFactory createXMLInputFactory(boolean nsAware) {
        XMLInputFactory factory = null;
        try {
            factory = XMLInputFactory.newInstance();
        } catch (Throwable t) {
            factory = null;
        }
        if (factory == null || !setRestrictionProperties(factory)) {
            try {
                factory = createWoodstoxFactory();
            } catch (Throwable t) {
                //ignore for now
            }
            if (!setRestrictionProperties(factory)) {
                if (allowInsecureParser) {
                    LOG.log(Level.WARNING, "INSECURE_PARSER_DETECTED", factory.getClass().getName());
                } else {
                    throw new RuntimeException("Cannot create a secure XMLInputFactory");
                }
            }
        }
        setProperty(factory, XMLInputFactory.IS_NAMESPACE_AWARE, nsAware);
        setProperty(factory, XMLInputFactory.SUPPORT_DTD, Boolean.FALSE);
        setProperty(factory, XMLInputFactory.IS_REPLACING_ENTITY_REFERENCES, Boolean.FALSE);
        setProperty(factory, XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.FALSE);
        factory.setXMLResolver(new XMLResolver() {
            public Object resolveEntity(String publicID, String systemID,
                                        String baseURI, String namespace)
                throws XMLStreamException {
                throw new XMLStreamException("Reading external entities is disabled");
            }
        });

        return factory;
    }

从源代码可以看出，抛出异常的原因是allowInsecureParser为false，那我们再看看allowInsecureParser到底是何方神圣。

   static {
        int i = getInteger("org.apache.cxf.staxutils.pool-size", 20);

        NS_AWARE_INPUT_FACTORY_POOL = new ArrayBlockingQueue<XMLInputFactory>(i);
        OUTPUT_FACTORY_POOL = new ArrayBlockingQueue<XMLOutputFactory>(i);

        //old names
        innerElementCountThreshold = getInteger(INNER_ELEMENT_COUNT_SYSTEM_PROP, innerElementCountThreshold);
        innerElementLevelThreshold = getInteger(INNER_ELEMENT_LEVEL_SYSTEM_PROP, innerElementLevelThreshold);
        //new names
        innerElementCountThreshold = getInteger(MAX_CHILD_ELEMENTS, innerElementCountThreshold);
        innerElementLevelThreshold = getInteger(MAX_ELEMENT_DEPTH, innerElementLevelThreshold);
        maxAttributeCount = getInteger(MAX_ATTRIBUTE_COUNT, maxAttributeCount); 
        maxAttributeSize = getInteger(MAX_ATTRIBUTE_SIZE, maxAttributeSize);
        maxTextLength = getInteger(MAX_TEXT_LENGTH, maxTextLength); 
        maxElementCount = getLong(MAX_ELEMENT_COUNT, maxElementCount);
        maxXMLCharacters = getLong(MAX_XML_CHARACTERS, maxXMLCharacters);

        **String s = SystemPropertyAction.getPropertyOrNull(ALLOW_INSECURE_PARSER);**
        if (!StringUtils.isEmpty(s)) {
            allowInsecureParser = "1".equals(s) || Boolean.parseBoolean(s);
        }

        XMLInputFactory xif = null;
        try {
            xif = createXMLInputFactory(true);
            String xifClassName = xif.getClass().getName();
            if (!xifClassName.contains("ctc.wstx") && !xifClassName.contains("xml.xlxp")
                    && !xifClassName.contains("xml.xlxp2") && !xifClassName.contains("bea.core")) {
                xif = null;
            }
        } catch (Throwable t) {
            //ignore, can always drop down to the pooled factories
            xif = null;
        }
        SAFE_INPUT_FACTORY = xif;

        XMLOutputFactory xof = null;
        try {
            xof = XMLOutputFactory.newInstance();
            String xofClassName = xof.getClass().getName();
            if (!xofClassName.contains("ctc.wstx") && !xofClassName.contains("xml.xlxp")
                && !xofClassName.contains("xml.xlxp2") && !xofClassName.contains("bea.core")) {
                xof = null;
            }
        } catch (Throwable t) {
            //ignore, can always drop down to the pooled factories
        }
        SAFE_OUTPUT_FACTORY = xof;  
    }

####从源代码可以看出，allowInsecureParser是类StaxUtils的一个静态变量，而这个变量的值取决于SystemPropertyAction.getPropertyOrNull(ALLOW_INSECURE_PARSER);
继续往下走，我们可以看看SystemPropertyAction是什么(SystemPropertyAction.java)：

public final class SystemPropertyAction implements PrivilegedAction<String> {
    private static final Logger LOG = LogUtils.getL7dLogger(SystemPropertyAction.class);
    private final String property;
    private final String def;
    private SystemPropertyAction(String name) {
        property = name;
        def = null;
    }
    private SystemPropertyAction(String name, String d) {
        property = name;
        def = d;
    }

    /* (non-Javadoc)
     * @see java.security.PrivilegedAction#run()
     */
    public String run() {
        if (def != null) {
            return System.getProperty(property, def);
        }
        return System.getProperty(property);
    }

    public static String getProperty(String name) {
        return AccessController.doPrivileged(new SystemPropertyAction(name));
    }

    public static String getProperty(String name, String def) {
        try {
            return AccessController.doPrivileged(new SystemPropertyAction(name, def));
        } catch (SecurityException ex) {
            LOG.log(Level.FINE, "SecurityException raised getting property " + name, ex);
            return def;
        }
    }

    /**
     * Get the system property via the AccessController, but if a SecurityException is 
     * raised, just return null;
     * @param name
     */
    public static String getPropertyOrNull(String name) {
        try {
            return AccessController.doPrivileged(new SystemPropertyAction(name));
        } catch (SecurityException ex) {
            LOG.log(Level.FINE, "SecurityException raised getting property " + name, ex);
            return null;
        }
    }
}

从代码中可以看出，实际上最后返回的值时System.getProperty(ALLOW_INSECURE_PARSER)。而这种方式得到的值需要在JVM Options中添加-D($ALLOW_INSECURE_PARSER)=true，其中ALLOW_INSECURE_PARSER=org.apache.cxf.stax.allowInsecureParser。这个值需要在jboss的run.conf中添加。