Uploaded image for project: 'Confluence Server and Data Center'
  1. Confluence Server and Data Center
  2. CONFSERVER-27669

Force the CCL to be the webapp CL in every StAX factory instantiation



    • Suggestion
    • Status: Closed (View Workflow)
    • Resolution: Won't Fix
    • None
    • None
    • None
    • We collect Confluence feedback from various sources, and we evaluate what we've collected when planning our product roadmap. To understand how this piece of feedback will be reviewed, see our Implementation of New Features Policy.


      NOTE: This suggestion is for Confluence Server. Using Confluence Cloud? See the corresponding suggestion.

      A call like


      will prefer the context CL for the discovery of the StAX factory implementation. Now if a plugin uses one of our concrete "API" classes, e.g. com.atlassian.confluence.content.render.xhtml.XmlOutputFactoryFactoryBean (l.35) or com.atlassian.confluence.content.render.xhtml.DefaultXmlEventReaderFactory (l.142) during one of the runtime module descriptors, e.g. RestModuleDescriptor, the DelegatingPluginFilter will set the CCL to the bundle's CL. Now if the bundle embeds a StAX factory implementation by accident or on purpose, that is bound to fail.

      Imo we should identify all of those invocations in our core classes, and enfore the context CL to be set to the webapp CL. In most cases (those where you know that your class is defined by the webapp CL) you can use the current CL. E.g. com.atlassian.confluence.content.render.xhtml.XmlOutputFactoryFactoryBean.getObject()

                  xmlOutputFactory = new ConfluenceXmlOutputFactory(ContextClassLoaderSwitchingUtil.runInContext(this.getClass().getClassLoader(), new Callable<XMLOutputFactory>()
                      public XMLOutputFactory call() throws Exception
                          return XMLOutputFactory.newInstance();

      Now we can choose two paths here, one is a contract change where we say we use the webapp CL by default and provide overloaded constructors/methods allowing the parametrisation of a ClassLoader used for discovery, or we deprecate each of these constructors/methods and update all over our clients to parametrise the webapp CL (thus not breaking the current "contract").


        Issue Links



              Unassigned Unassigned
              fakraemer fabs
              0 Vote for this issue
              7 Start watching this issue