Workflows Xerces and Hazelcast don't like each other

Workflows
1

This problem occured with the newest A12 Upgrade. During the startup of camunda we got following exception

Caused by: java.lang.IllegalArgumentException: Not supported: http://javax.xml.XMLConstants/property/accessExternalDTD
	at org.apache.xalan.processor.TransformerFactoryImpl.setAttribute(TransformerFactoryImpl.java:571)
	at com.hazelcast.internal.util.XmlUtil.setAttribute(XmlUtil.java:199)

According to this Github issue (Schema validation issue when setting xml attributes to TransformerFactory in AbstractXmlConfigHelper.java · Issue #17998 · hazelcast/hazelcast · GitHub) Xerces and Hazelcast don’t like each other.

The solution according to the issue is, that we should set -Dhazelcast.ignoreXxeProtectionFailures=true but i didn´t find any example in bitbucket so i assume nobody else has this problem, but these frameworks are not declared dependency in our project, they are coming with A12

image
image510×371 34.5 KB

image
image467×349 26.7 KB

Does someone else faced this problem ? Has anyone an idea where the problem lies ? Of course i can try to set the property, but it is uncommon that nobody else had such a problem.

Edit:
Not only Xerces is a problem. In our case Xalan is also a problem.
I found following log statement from Hazelcast

com.hazelcast.internal.util.XmlUtil      : Enabling XXE protection failed. The attribute http://javax.xml.XMLConstants/property/accessExternalDTD is not supported by the TransformerFactory. 
This usually mean an outdated XML processor is present on the classpath (e.g. Xerces, Xalan). If you are not able to resolve the issue by fixing the classpath, the hazelcast.ignoreXxeProtectionFailures system property can be used to disable XML External Entity protections. 
We don't recommend disabling the XXE as such the XML processor configuration is unsecure!
2

I found the problem !

Our ‘old’ Spring BOM which will automatically used when you are using following gradle plugin
org.springframework.boot:2.7.2 set net.sourceforge.htmlunit:htmlunit:2.60.0

Uaa-Rest-Client is using htmlUnit = "2.68.0"

After setting the version explicitly it worked. Now i have to find out how i can disable the BOM functionality of the plugin but still using the bootRun task or if there are bom’s coming from a12 which can be used for overwriting all stuff from spring :slight_smile:

3

We had the same issue in our project recently, while trying to use a library provided by another mgm project which depends on Xerces. We use -Dhazelcast.ignoreXxeProtectionFailures=true as the workaround.

4

Hi @tjorben-atomic-moss,

We had a similar issue with the spring-dependency-management-plugin so we decided to stop using it.

I guess you can set your own reply as “accepted answer” :slight_smile: