diff --git a/docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/issues/168-t2-3-cxf-logging-hardening.md b/docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/issues/168-t2-3-cxf-logging-hardening.md index 9c5788aad..74b66fdfc 100644 --- a/docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/issues/168-t2-3-cxf-logging-hardening.md +++ b/docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/issues/168-t2-3-cxf-logging-hardening.md @@ -14,10 +14,19 @@ The default `` in CXF 3.5.x: - uses multi-line pretty-printed format (slow, large) The new `cxfLoggingFeature` bean is configured with safe defaults: -- `verbose=false` — log only the first line of each message (method + URL + status), not the payload -- `limit=4096` — cap logged payload at 4 KB +- `limit=4096` — cap the logged payload at 4 KB (this is what does the actual safety work in 3.5.x; the interceptor writes a single-line summary once the limit is reached and truncates the rest) - `prettyLogging=false` — single-line format (faster, smaller) +> **CXF 3.5.x note:** `LoggingFeature` no longer exposes a `verbose` setter in 3.5.x +> (it was removed when the inner `LoggingFeature$Portable` class was introduced; the +> public API is now `setLimit(int)` and `setPrettyLogging(boolean)` plus the +> `LoggingFeature(String, String, int, boolean, boolean)` constructor for `inLocation`, +> `outLocation`, `limit`, `prettyLogging`, and `showBinary`). The earlier revision of +> this doc and the original bean both set ``, which +> makes Spring throw `NotWritablePropertyException` at startup and prevents the +> Rhythmyx webapp from starting. The bean has been corrected to use only the +> properties that 3.5.11 actually supports. + ### Scope This applies to the **sitemanage-jax-rs** server only. The other `` blocks in the file don't have `` and are unaffected. The 5 delivery-tier-suite webapps use Jersey (not CXF) and are out of scope for this PR (separate workstream). diff --git a/projects/sitemanage/src/main/resources/Rhythmyx/AppServer/server/rx/deploy/rxapp.ear/rxapp.war/WEB-INF/config/spring/projects/sitemanage-beans.xml b/projects/sitemanage/src/main/resources/Rhythmyx/AppServer/server/rx/deploy/rxapp.ear/rxapp.war/WEB-INF/config/spring/projects/sitemanage-beans.xml index c55a0918a..8ce3198c0 100644 --- a/projects/sitemanage/src/main/resources/Rhythmyx/AppServer/server/rx/deploy/rxapp.ear/rxapp.war/WEB-INF/config/spring/projects/sitemanage-beans.xml +++ b/projects/sitemanage/src/main/resources/Rhythmyx/AppServer/server/rx/deploy/rxapp.ear/rxapp.war/WEB-INF/config/spring/projects/sitemanage-beans.xml @@ -1865,7 +1865,6 @@ http://cxf.apache.org/schemas/jaxrs.xsd"> (method + URL + status) and caps the payload at 4 KB. --> -