http://coldfusion.com logo
Join Slack
Powered by
is there an issue with the owasp extension and tom...
# lucee
t
is there an issue with the owasp extension and tomcat? this gist on try cf works fine https://trycf.com/gist/a976d64c9209b55ca074ae79215c1c14/lucee5?theme=monokai but on my local tomcat see thread
I get
the bottom of the stack is
Copy code
Caused by: org.owasp.esapi.errors.ConfigurationException: java.lang.ClassNotFoundException: org.lucee.extension.esapi.log.LogFactoryImpl not found by org.lucee.esapi [54] LogFactory class (org.lucee.extension.esapi.log.LogFactoryImpl) must be in class path.
that is with the same versions as trycf lucee5.3.8.206 and owasp 2.2.0.1
if I update owasp to 2.2.4.5 i get a bit further
so it works once but the member function fails with the same error as before
Copy code
Caused by: org.owasp.esapi.errors.ConfigurationException: java.lang.ClassNotFoundException: Unable to load class 'org.lucee.extension.esapi.log.LogFactoryImpl' because the bundle wiring for org.lucee.esapi is no longer valid. LogFactory class (org.lucee.extension.esapi.log.LogFactoryImpl) must be in class path.
    at org.owasp.esapi.util.ObjFactory.make(ObjFactory.java:108)
    at org.owasp.esapi.ESAPI.logFactory(ESAPI.java:137)
    at org.owasp.esapi.ESAPI.getLogger(ESAPI.java:153)
    at org.owasp.esapi.reference.DefaultEncoder.<init>(DefaultEncoder.java:83)
    at org.owasp.esapi.reference.DefaultEncoder.getInstance(DefaultEncoder.java:67)
    ... 67 more
Caused by: java.lang.ClassNotFoundException: Unable to load class 'org.lucee.extension.esapi.log.LogFactoryImpl' because the bundle wiring for org.lucee.esapi is no longer valid.
    at org.apache.felix.framework.BundleWiringImpl.findClassOrResourceByDelegation(BundleWiringImpl.java:1562)
    at org.apache.felix.framework.BundleWiringImpl.access$300(BundleWiringImpl.java:79)
    at org.apache.felix.framework.BundleWiringImpl$BundleClassLoader.loadClass(BundleWiringImpl.java:1982)
    at java.lang.ClassLoader.loadClass(ClassLoader.java:351)
    at java.lang.Class.forName0(Native Method)
    at java.lang.Class.forName(Class.java:264)
    at org.owasp.esapi.util.ObjFactory.loadClassByStringName(ObjFactory.java:158)
    at org.owasp.esapi.util.ObjFactory.make(ObjFactory.java:81)
    ... 71 more
anyone else come accross this?
j
Might be way off base, could this be to do with log4j being upgraded in the yet-to-be-released version of Lucee... I'm sure Zac mentioned all extensions needed to be latest for that to work... could it be your using a too new version of ESAPI with the version of Lucee...
t
I have extracted ESAPI.properties from the 2.2.4.5 bundle and placed it in WEB-INF/lib and that seems to have got thing working.
j
I think this is ssort-of what I was trying to say... https://dev.lucee.org/t/5-3-9-80-release-candidate-1/9672
👍 1
t
@Jedihomer Townend I hope not the owasp extension is available from the lucee admin you would hope that wouldnt be the case if it were incompatable
j
Yes I'd hope so too... it was just that it was complaining about LogFactory and that got the little grey cells running
t
from Zacs post it should be version=2.2.3.1-2-SNAPSHOT smaller than 2.2.4.5 but not available from the admin
j
Then I've no idea 😉
b
You can still download the extension and install it manually in the same extensions UI (or, if you are using commandbox, add it to the dependencies in box.json)
t
I don't think the version is the problem the error gets better when I move from 2.2.0.1 to 2.2.4.5 in that only the member function fails but it still fails unless I work round OSGI and place the ESAPI.properties on the class path
you can see an imediate issue if you open the bundle
2.2.0.1 doesnt have the log package
b
The app I deal with this most in used to run CFESAPI and still contains a mix as we move CFESAPI out of it in favor of the Lucee extension ...so we also still have the properties file in the class path. Now you have me scared that the world will implode when I eventually remove that. heh
t
I have just updated my pom I already download the lex as our installs are often on air tight servers, so the pom now extracts the properties from the lex sticks them on the classpath and caries on there is a large comment to review at a future date 😁
b
my TODO Tree plugin has a custom "KICKCAN" type too 😉
2 Views
Open in Slack
PreviousNext
Powered by