SAX Feature Not Supported in Spring Boot 2.6.1

Spring boot 2.6.1 supports logback 1.2.7

I've added the following dependencies in project

        <dependency>
            <groupId>ch.qos.logback</groupId>
            <artifactId>logback-classic</artifactId>
        </dependency>
        <dependency>
            <groupId>ch.qos.logback</groupId>
            <artifactId>logback-core</artifactId>
        </dependency>

But the build fails with below exception:

Caused by: javax.xml.parsers.ParserConfigurationException: SAX feature 'http://xml.org/sax/features/external-general-entities' not supported.
    at oracle.xml.jaxp.JXSAXParserFactory.setFeature(JXSAXParserFactory.java:272)
    at ch.qos.logback.core.joran.event.SaxEventRecorder.buildSaxParser(SaxEventRecorder.java:82)
    ... 44 more

In SaxEventRecorder.class, it fails while building the SAX parser

    private SAXParser buildSaxParser() throws JoranException {
        try {
            SAXParserFactory spf = SAXParserFactory.newInstance();
            spf.setValidating(false);
            //spf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
            spf.setFeature("http://xml.org/sax/features/external-general-entities", false);
            spf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
            spf.setNamespaceAware(true);
            return spf.newSAXParser();
        } catch (Exception pce) {
            String errMsg = "Parser configuration error occurred";
            addError(errMsg, pce);
            throw new JoranException(errMsg, pce);
        }
    }

Is there a way to override the implementation?

Thanks :)

Solution

Had the same issue during an upgrade. It wasn't a Spring issue, and you don't want to override the implementation yourself.

SAXParserFactory is an abstract class - it can have multiple implementations. The newInstance method picks the last/top implementation on the classpath.

I had found that I had an "extra" implementation on my classpath due to a dependency having their own implementation of SAXParserFactory rather than the 'typical' implementation that Logback expects. And this "extra" SAXParserFactory did not support the feature that Logback is trying to enable.

I had to explicitly declare a xerces implementation higher in my dependencies in order for a "real" implementation to take precedence over the other "extra" implementation on the classpath.

So my advice is for you to see what implementations of this abstract class you have (I could easily see this using the IntelliJ IDE), then manage/re-arrange your dependencies so that a proper implementation supporting the feature has a higher precedence on your classpath.