turns out Xalan is the one that's causing the problem

git-svn-id: https://hudson.dev.java.net/svn/hudson/trunk/hudson/main@2782 71c3de6d-444a-0410-be80-ed276b4c234a

war/pom.xml

@@ -236,11 +236,6 @@
       -->
       <scope>test</scope>
     </dependency>
-    <dependency>
-      <groupId>xalan</groupId>
-      <artifactId>xalan</artifactId>
-      <version>2.7.0</version>
-    </dependency>
     <dependency>
       <groupId>org.jvnet.hudson.main</groupId>
       <artifactId>hudson-core</artifactId>
@@ -252,10 +247,10 @@
           <groupId>javax.servlet</groupId>
           <artifactId>servlet-api</artifactId>
         </exclusion>
-        <!--exclusion>
+        <exclusion>
           <groupId>xalan</groupId>
           <artifactId>xalan</artifactId>
-        </exclusion-->
+        </exclusion>
         <exclusion>
           <groupId>xerces</groupId>
           <artifactId>xercesImpl</artifactId>