From 5b02d4eda6cc4d8358c029d3e95bc0c27e6e4d85 Mon Sep 17 00:00:00 2001 From: Nate Chadwick <263952448+natechadwick-intsof@users.noreply.github.com> Date: Tue, 8 Sep 2026 12:36:54 -0400 Subject: [PATCH] fix(sitemanage): drop non-existent verbose property on CXF LoggingFeature bean The cxfLoggingFeature bean in projects/sitemanage/.../sitemanage-beans.xml sets a 'verbose' property on org.apache.cxf.feature.LoggingFeature, but CXF 3.5.11 does not expose a setVerbose setter on that class. The 'verbose' flag was removed when the inner LoggingFeature$Portable class was introduced in 3.5.x; the public setters on LoggingFeature are now only setLimit(int) and setPrettyLogging(boolean) (plus the (String, String, int, boolean, boolean) constructor for inLocation, outLocation, limit, prettyLogging, showBinary). Spring's BeanWrapper throws NotWritablePropertyException at startup when trying to apply the 'verbose' property. That cascades: cxfLoggingFeature bean fails -> rest-jax-rs bean (which references it) fails -> root Spring ApplicationContext fails to refresh -> the Rhythmyx webapp goes UNAVAILABLE. Confirmed against the cxf-core-3.5.11.jar on the runtime classpath; javap on org.apache.cxf.feature.LoggingFeature shows only setLimit and setPrettyLogging. The limit=4096 and prettyLogging=false settings already provide the actual safety controls (cap logged payload bytes, single-line summary format) and remain in place. The analysis doc for the original T2.3 PR has a post-merge revision note documenting the 3.5.x API change so the verbose property doesn't get re-added. Refs #168 > Co-Authored by Mavis Mavis-Code using MiniMax-M3 with agent mavis. --- .../issues/168-t2-3-cxf-logging-hardening.md | 13 +++++++++++-- .../config/spring/projects/sitemanage-beans.xml | 1 - 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/issues/168-t2-3-cxf-logging-hardening.md b/docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/issues/168-t2-3-cxf-logging-hardening.md index 9c5788aad..74b66fdfc 100644 --- a/docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/issues/168-t2-3-cxf-logging-hardening.md +++ b/docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/issues/168-t2-3-cxf-logging-hardening.md @@ -14,10 +14,19 @@ The default `` in CXF 3.5.x: - uses multi-line pretty-printed format (slow, large) The new `cxfLoggingFeature` bean is configured with safe defaults: -- `verbose=false` — log only the first line of each message (method + URL + status), not the payload -- `limit=4096` — cap logged payload at 4 KB +- `limit=4096` — cap the logged payload at 4 KB (this is what does the actual safety work in 3.5.x; the interceptor writes a single-line summary once the limit is reached and truncates the rest) - `prettyLogging=false` — single-line format (faster, smaller) +> **CXF 3.5.x note:** `LoggingFeature` no longer exposes a `verbose` setter in 3.5.x +> (it was removed when the inner `LoggingFeature$Portable` class was introduced; the +> public API is now `setLimit(int)` and `setPrettyLogging(boolean)` plus the +> `LoggingFeature(String, String, int, boolean, boolean)` constructor for `inLocation`, +> `outLocation`, `limit`, `prettyLogging`, and `showBinary`). The earlier revision of +> this doc and the original bean both set ``, which +> makes Spring throw `NotWritablePropertyException` at startup and prevents the +> Rhythmyx webapp from starting. The bean has been corrected to use only the +> properties that 3.5.11 actually supports. + ### Scope This applies to the **sitemanage-jax-rs** server only. The other `` blocks in the file don't have `` and are unaffected. The 5 delivery-tier-suite webapps use Jersey (not CXF) and are out of scope for this PR (separate workstream). diff --git a/projects/sitemanage/src/main/resources/Rhythmyx/AppServer/server/rx/deploy/rxapp.ear/rxapp.war/WEB-INF/config/spring/projects/sitemanage-beans.xml b/projects/sitemanage/src/main/resources/Rhythmyx/AppServer/server/rx/deploy/rxapp.ear/rxapp.war/WEB-INF/config/spring/projects/sitemanage-beans.xml index c55a0918a..8ce3198c0 100644 --- a/projects/sitemanage/src/main/resources/Rhythmyx/AppServer/server/rx/deploy/rxapp.ear/rxapp.war/WEB-INF/config/spring/projects/sitemanage-beans.xml +++ b/projects/sitemanage/src/main/resources/Rhythmyx/AppServer/server/rx/deploy/rxapp.ear/rxapp.war/WEB-INF/config/spring/projects/sitemanage-beans.xml @@ -1865,7 +1865,6 @@ http://cxf.apache.org/schemas/jaxrs.xsd"> (method + URL + status) and caps the payload at 4 KB. --> -