[jbossws-issues] [JBoss JIRA] Created: (JBWS-3144) Server side misuse of CXF default bus

Wed Oct 6 06:25:39 EDT 2010

Server side misuse of CXF default bus
-------------------------------------

                 Key: JBWS-3144
                 URL: https://jira.jboss.org/browse/JBWS-3144
             Project: JBoss Web Services
          Issue Type: Bug
      Security Level: Public (Everyone can see)
          Components: jbossws-cxf
    Affects Versions: jbossws-cxf-3.3.1,  jbossws-cxf-3.3.0
            Reporter: Alessio Soldano
            Assignee: Alessio Soldano
            Priority: Critical
             Fix For: jbossws-cxf-3.4.0

Apache CXF BusFactory stores a default bus instance in a static member attribute. Unless the createIfNeeded is set to false (default is true), that default bus is used whenever the BusFactory is asked for either the default bus or the thread bus and the current thread is not associated to a bus yet. On server side, that's likely to be a potential problem, as the default bus might end up being one related to a specific deployment.
The CXF and JBossWS-CXF bus factories already set the default bus only using the BusFactory.possiblySetDefaultBus(Bus b) method, which basically sets the bus only if it's not been set yet. However we currently erase the default bus in multiple locations during the deployment...

We need to:
1) never explicitly set/erase the default bus in the jbossws-cxf integration code (deployers, invokers, etc.)
2) never rely on default bus for the jbossws-cxf integration code (as that might have been changed and after all there's really no reason for falling back to that when the thread def bus should always be set on server side; when on client side, a new bus should simply be created in the integration code)
3) "eagerly" create/set a proper default bus on server side, avoiding pushing deployment specific stuff in it (ideally at boot time)

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira