How to override 'org.apache.cxf.stax.maxChildElements' property value inside a TomEE container?

Question

I've got a JAX-WS web service endpoint configured purely via annotations running in TomEE 7 environment. Basically, the method being called has to return a List<String> of all node names contained in a graph data structure. The response of such a request can contain more thank 50k elements.

With CXF 2.6.x this worked fine. However, when I call the WS-method under CXF 3.x (bundled in TomEE 7.x), the following exception is thrown on the server side:

org.apache.cxf.interceptor.Fault: Unmarshalling Error: Maximum Number of Child Elements limit (50000) Exceeded 
    at org.apache.cxf.jaxb.JAXBEncoderDecoder.unmarshall(JAXBEncoderDecoder.java:906)
    at org.apache.cxf.jaxb.JAXBEncoderDecoder.unmarshall(JAXBEncoderDecoder.java:712)
    at org.apache.cxf.jaxb.io.DataReaderImpl.read(DataReaderImpl.java:179)
    at org.apache.cxf.wsdl.interceptors.DocLiteralInInterceptor.handleMessage(DocLiteralInInterceptor.java:109)
    at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:308)
    at org.apache.cxf.endpoint.ClientImpl.onMessage(ClientImpl.java:801)
    at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleResponseInternal(HTTPConduit.java:1680)
    at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleResponse(HTTPConduit.java:1559)
    at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.close(HTTPConduit.java:1356)
    at org.apache.cxf.transport.AbstractConduit.close(AbstractConduit.java:56)
    at org.apache.cxf.transport.http.HTTPConduit.close(HTTPConduit.java:653)
    at org.apache.cxf.interceptor.MessageSenderInterceptor$MessageSenderEndingInterceptor.handleMessage(MessageSenderInterceptor.java:62)
    at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:308)
    at org.apache.cxf.endpoint.ClientImpl.doInvoke(ClientImpl.java:514)
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:423)
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:324)
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:277)
    at org.apache.cxf.frontend.ClientProxy.invokeSync(ClientProxy.java:96)
    at org.apache.cxf.jaxws.JaxWsClientProxy.invoke(JaxWsClientProxy.java:139)
    at com.sun.proxy.$Proxy51.getAllNodeNames(Unknown Source)
Caused by: javax.xml.bind.UnmarshalException
 - with linked exception:
[javax.xml.stream.XMLStreamException: Maximum Number of Child Elements limit (50000) Exceeded]
    at com.sun.xml.bind.v2.runtime.unmarshaller.UnmarshallerImpl.handleStreamException(UnmarshallerImpl.java:485)
    at com.sun.xml.bind.v2.runtime.unmarshaller.UnmarshallerImpl.unmarshal0(UnmarshallerImpl.java:417)
    at com.sun.xml.bind.v2.runtime.unmarshaller.UnmarshallerImpl.unmarshal(UnmarshallerImpl.java:394)
    at org.apache.cxf.jaxb.JAXBEncoderDecoder.doUnmarshal(JAXBEncoderDecoder.java:855)
    at org.apache.cxf.jaxb.JAXBEncoderDecoder.access$100(JAXBEncoderDecoder.java:102)
    at org.apache.cxf.jaxb.JAXBEncoderDecoder$2.run(JAXBEncoderDecoder.java:894)
    at java.security.AccessController.doPrivileged(Native Method)
    at org.apache.cxf.jaxb.JAXBEncoderDecoder.unmarshall(JAXBEncoderDecoder.java:892)
    ... 21 more
Caused by: javax.xml.stream.XMLStreamException: Maximum Number of Child Elements limit (50000) Exceeded
    at com.ctc.wstx.sr.InputElementStack.push(InputElementStack.java:340)
    at com.ctc.wstx.sr.BasicStreamReader.handleStartElem(BasicStreamReader.java:2951)
    at com.ctc.wstx.sr.BasicStreamReader.nextFromTree(BasicStreamReader.java:2839)
    at com.ctc.wstx.sr.BasicStreamReader.next(BasicStreamReader.java:1073)
    at com.sun.xml.bind.v2.runtime.unmarshaller.StAXStreamConnector.bridge(StAXStreamConnector.java:196)
    at com.sun.xml.bind.v2.runtime.unmarshaller.UnmarshallerImpl.unmarshal0(UnmarshallerImpl.java:415)
    ... 27 more
Error: Maximum Number of Child Elements limit (50000) Exceeded 

So far, I've read the official CXF documentation on this issue, checked a HowTo at the TomEE website and read many related, yet older posts in forums.

I tried to set the properties - as advised by the TomEE documentation - via openejb-jar.xml in the webservice's WEB-INF folder:

<?xml version="1.0" encoding="UTF-8"?>
<openejb-jar>
 <ejb-deployment ejb-name="MyWebService">
   <properties>
     org.apache.cxf.stax.maxChildElements = 100000
   </properties>
 </ejb-deployment>
</openejb-jar>

I also tried with the shorter property cxf.stax.maxChildElements to check whether this would be accepted, yet without success.

For testing/debugging, I start the TomEE instance via the tomee-maven-plugin, Therefore, I tried the set the maxChildElement property as an environment property like so:

<plugin>
    <groupId>org.apache.tomee.maven</groupId>
    <artifactId>tomee-maven-plugin</artifactId>
    <version>${tomee.plugin.version}</version>
    <configuration>
        <tomeeVersion>${tomee.version}</tomeeVersion>
        <tomeeClassifier>plus</tomeeClassifier>
        <debug>false</debug>
        <tomeeHttpPort>8181</tomeeHttpPort>
        <debugPort>5005</debugPort>
        <args>-Dfoo=bar</args>
        <skipCurrentProject>true</skipCurrentProject>
        <webapps>
            <webapp>my.ws:${webservice.artifact.name}:${webservice.artifact.version}?name=ws-endpoint</webapp>
        </webapps>
        <libs>
            <!-- Third party libraries needed in the global lib folder of TomEE -->
            <lib>log4j:log4j:${log4j.version}</lib>
        </libs>
        <systemVariables>
            <!--
                special property needed to allow for more childElements in StAX Parser
            -->
            <org.apache.cxf.stax.maxChildElement>100000</org.apache.cxf.stax.maxChildElement>
        </systemVariables>
    </configuration>
</plugin>

Sadly, it has no effect on the runtime configuration of CXF/StAX (Woodstox).

Question

How can we override the maxChildElements property via a configuration in openejb-jar.xml or as an external property at TomEE startup.

Answer 1

Finally, I got it working with the help of Romain Manni-Bucau (credits to him for pointing me into the right direction). Yet, his original answer is not the final solution. Therefore, I give the working configuration here.

1.) Put the following openejb-jar.xml to the WEB-INF folder:

<?xml version="1.0" encoding="UTF-8"?>
<openejb-jar>
    <ejb-deployment ejb-name="MyWebService">
        <properties>
            cxf.jaxws.properties = cxfConfig
        </properties>
    </ejb-deployment>
</openejb-jar>

2.) Provide a new (or add to an existing) resources.xml file, again via WEB-INF:

<?xml version="1.0" encoding="UTF-8"?>
<resources>
    <Service id="cxfConfig" class-name="org.apache.openejb.config.sys.MapFactory" factory-name="create">
        org.apache.cxf.stax.maxChildElements = 100000
    </Service>
</resources>

Note well the configuration link via the MapFactory object with the id cxfConfig.

3.) Configure JAX-WS clients to set corresponding property as well. For instance, given a Spring client, this can be configured like so:

<bean id="wsClientProxy" class="org.apache.cxf.jaxws.JaxWsProxyFactoryBean">
    <property name="serviceClass" value="com.acme.ws.jaxb.MyWebservice"/>
    <property name="address" value="${ws.endpoint.url}"/>
    <property name="properties">
        <map>
            <entry key="org.apache.cxf.stax.maxChildElements" value="100000" />
        </map>
    </property>
</bean>

In general, this might also be useful for people trying to set other CXF-related properties as listed in the XML section of the CXF security guideline, in particular to increase or decrease conservative default values.

I tested the above configuration steps successfully under a TomEE 7.0.3 and 8.0.9 environment, yet this should also reliably work with all 7.0.x and 8.0.x releases.

For other use cases, this blog post by Romain might also be worth reading, as it covers basic configuration concepts quite well.

Hope this helps others.

Answer 2

You can try -Dorg.apache.cxf.stax.maxChildElements=100000 It should also work

Answer 3

I think you need to define a resources.xml with a Service of type (class-name) java.util.Properties and the properties inside:

1. openejb-jar.xml would get this property:

   cxf.jaxws.properties = cxfConfig

2. resources.xml would get

   org.apache.cxf.stax.maxChildElements = 1

This test does it programmatically: https://github.com/apache/tomee/blob/master/server/openejb-cxf/src/test/java/org/apache/openejb/server/cxf/MaxChildTest.java