We Keep Coding

SpringBoot webapp under Java SecurityManager throws exceptions when granted AllPermission

We have a Spring Boot (1.1.6) application deployed as a .war file to a Tomcat 7.0.52 / OpenJDK 7 server. We need to run this server under a SecurityManager.
Even when we operate the server with a policy that allows AllPermission to all code (essentially the same as not running under a SecurityManager) we get exceptions thrown due to reflection activity. Here's a full stack trace of one of the exceptions.
java.lang.IllegalAccessException: Class org.apache.catalina.security.SecurityUtil$1 can not access a member of class org.springframework.boot.context.web.ErrorPageFilter with modifiers "public"
at sun.reflect.Reflection.ensureMemberAccess(Reflection.java:109) ~[na:1.7.0_65]
at java.lang.reflect.AccessibleObject.slowCheckMemberAccess(AccessibleObject.java:261) ~[na:1.7.0_65]
at java.lang.reflect.AccessibleObject.checkAccess(AccessibleObject.java:253) ~[na:1.7.0_65]
at java.lang.reflect.Method.invoke(Method.java:599) ~[na:1.7.0_65]
at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:277) ~[catalina.jar:7.0.52]
at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:274) ~[catalina.jar:7.0.52]
at java.security.AccessController.doPrivileged(Native Method) ~[na:1.7.0_65]
at javax.security.auth.Subject.doAsPrivileged(Subject.java:536) ~[na:1.7.0_65]
at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:309) ~[catalina.jar:7.0.52]
at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:249) ~[catalina.jar:7.0.52]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:237) ~[catalina.jar:7.0.52]
at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:55) ~[catalina.jar:7.0.52]
at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:191) ~[catalina.jar:7.0.52]
at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:187) ~[catalina.jar:7.0.52]
at java.security.AccessController.doPrivileged(Native Method) ~[na:1.7.0_65]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:186) ~[catalina.jar:7.0.52]
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220) ~[catalina.jar:7.0.52]
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122) [catalina.jar:7.0.52]
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:501) [catalina.jar:7.0.52]
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:170) [catalina.jar:7.0.52]
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:98) [catalina.jar:7.0.52]
at org.apache.catalina.valves.RemoteIpValve.invoke(RemoteIpValve.java:683) [catalina.jar:7.0.52]
at ch.qos.logback.access.tomcat.LogbackValve.invoke(LogbackValve.java:178) [logback-access-1.0.13.jar:na]
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116) [catalina.jar:7.0.52]
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:408) [catalina.jar:7.0.52]
at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1040) [tomcat-coyote.jar:7.0.52]
at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:607) [tomcat-coyote.jar:7.0.52]
at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:313) [tomcat-coyote.jar:7.0.52]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) [na:1.7.0_65]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) [na:1.7.0_65]
at java.lang.Thread.run(Thread.java:745) [na:1.7.0_65]
The policy file which is applied to the server is shown below:
grant {
permission java.security.AllPermission;
permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
};
.. we added the explicit ReflectPermission just in case AllPermission didn't include it but we tried it both ways.
Any pointers as to why the exception gets thrown only when we run under a SecurityManager with the above policy?

The error is caused not by Java Security, but by Java Language access rules.
The ErrorPageFilter class is package-visible [1]. Tomcat tries to call public method of that class via reflection, but cannot because by Java Language rules the class itself is not accessible.
[1] https://github.com/spring-projects/spring-boot/blob/master/spring-boot/src/main/java/org/springframework/boot/context/web/ErrorPageFilter.java
(I am linking to master branch, but you are actually using version 1.1.6, so content of the above link may change over time)
A non-public Filter is unusual. In old times when all filters were declared in web.xml it was not possible to use such non-public filters. I do not know Spring Boot internals, but I guess that this filter was added to the web application programmatically, using Servlet 3.0 APIs.
Possible ways to proceed:
a) Ask Spring Boot developers to make the class public
b) Change Apache Tomcat so that instead of looking for method declared by specific class it were looking for method declared by specific interface. A java.lang.reflect.Method declared by interface can be invoked on a class implementing that interface. I expect that this solution will pass those checks in sun.reflect.Reflection.ensureMemberAccess(), but actual testing is needed.
This needs changing internal Tomcat APIs to pass the interface class (in this case, javax.servlet.Filter) as an additional argument to those methods.
Technically, this needs:
File an issue into Tomcat Bugzilla - DONE.
Provide a simple reproduction recipe, so that this can be tested
Wait for the next release
Update: I filed this into Bugzilla,
https://issues.apache.org/bugzilla/show_bug.cgi?id=57281

Managed Bean Property Missing

type: Exception report
message: description The server encountered an internal error () that prevented it from fulfilling this request.
exception: javax.servlet.ServletException: /SSCPageMapping.jsp(39,5) '#{UpdateSSCPageMap.pageMap}' Property 'pageMap' not found UpdateSSCPageMap
javax.faces.webapp.FacesServlet.service(FacesServlet.java:277)
org.apache.myfaces.component.html.util.ExtensionsFilter.doFilter(ExtensionsFilter.java:122)
org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:96)
root: cause org.apache.jasper.el.JspPropertyNotFoundException: /SSCPageMapping.jsp(39,5) '#{UpdateSSCPageMap.pageMap}' Property 'pageMap' not found on type UpdateSSCPageMap
org.apache.jasper.el.JspValueExpression.getValue(JspValueExpression.java:104)
javax.faces.component.UIData.getValue(UIData.java:614)
javax.faces.component.UIData.getDataModel(UIData.java:1129)
javax.faces.component.UIData.setRowIndex(UIData.java:451)
com.sun.faces.renderkit.html_basic.TableRenderer.encodeBegin(TableRenderer.java:77)
javax.faces.component.UIComponentBase.encodeBegin(UIComponentBase.java:813)
javax.faces.component.UIData.encodeBegin(UIData.java:967)
javax.faces.component.UIComponent.encodeAll(UIComponent.java:928)
javax.faces.render.Renderer.encodeChildren(Renderer.java:148)
javax.faces.component.UIComponentBase.encodeChildren(UIComponentBase.java:837)
javax.faces.component.UIComponent.encodeAll(UIComponent.java:930)
javax.faces.component.UIComponent.encodeAll(UIComponent.java:933)
com.sun.faces.application.ViewHandlerImpl.doRenderView(ViewHandlerImpl.java:266)
com.sun.faces.application.ViewHandlerImpl.renderView(ViewHandlerImpl.java:197)
com.sun.faces.lifecycle.RenderResponsePhase.execute(RenderResponsePhase.java:110)
com.sun.faces.lifecycle.Phase.doPhase(Phase.java:100)
com.sun.faces.lifecycle.LifecycleImpl.render(LifecycleImpl.java:139)
javax.faces.webapp.FacesServlet.service(FacesServlet.java:266)
org.apache.myfaces.component.html.util.ExtensionsFilter.doFilter(ExtensionsFilter.java:122)
org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:96)
This is the HTTP 500 Error I received. A collegue and I spent about an hour troubleshooting the unmapped managed bean property that can't be found although the following is confirmed:
Verified bean property names; renamed; and verified again
faces-config.xml has proper definitions including the manage bean properties
The Java code has been checked, double checked, triple checked.
Neither of us could determine the root cause preventing the bean class from being registered with the jsp page. The jsp page was verified and it appears there is something very minor that was missed.
Within the faces-config.xml file it has highlighted that the bean properties can't be found. How is this possible?
If you can suggest any place to look for further verification I would appreciate it.

spring MVC3 errors Could not instantiate bean class [java.util.List]: Specified class is an interface Occasional

I am using spring MVC3, I found code like below:
#Controller
class IndexController
{
#ModelAttribute("allTags")
public List<ArticleTag> allTags()
{
return Collections.emptyList();
}
}
Sometimes errors with message
(Not always)
SEVERE: Servlet.service() for servlet [appServlet] in context with path [] threw exception [Request processing failed; nested exception is org.springframework.beans.BeanInstantiationException: Could not instantiate bean class [java.util.List]: Specified class is an interface] with root cause
org.springframework.beans.BeanInstantiationException: Could not instantiate bean class [java.util.List]: Specified class is an interface
at org.springframework.beans.BeanUtils.instantiateClass(BeanUtils.java:101)
at org.springframework.web.method.annotation.ModelAttributeMethodProcessor.createAttribute(ModelAttributeMethodProcessor.java:132)
at org.springframework.web.servlet.mvc.method.annotation.ServletModelAttributeMethodProcessor.createAttribute(ServletModelAttributeMethodProcessor.java:81)
at org.springframework.web.method.annotation.ModelAttributeMethodProcessor.resolveArgument(ModelAttributeMethodProcessor.java:103)
at org.springframework.web.method.support.HandlerMethodArgumentResolverComposite.resolveArgument(HandlerMethodArgumentResolverComposite.java:75)
at org.springframework.web.method.support.InvocableHandlerMethod.getMethodArgumentValues(InvocableHandlerMethod.java:156)
at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:117)
at org.springframework.web.method.annotation.ModelFactory.invokeModelAttributeMethods(ModelFactory.java:123)
at org.springframework.web.method.annotation.ModelFactory.initModel(ModelFactory.java:97)
at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:614)
at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:578)
at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:80)
at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:923)
at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:852)
at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:882)
at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:778)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:621)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:722)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305)
Someone Says, List is a interface, plz use ArrayList or LinkedList instead
But, My Question is, Why the code above is not always eror?
When the error above occured, not matter how to refresh the page, error continues, nevery disappear！But, If you restart tomcat, you have a good opportunity to walk through this error!If no error like above occur,it never occurs util next tomcat restart!
Same as #ModelAttribute with type int or Integer, it will very likely error, but on some host, It never occurs

Change the code as below
public ArticleTag allTags()
For more information, please refer to below link
[http://forum.spring.io/forum/spring-projects/data/nosql/724397-mapping-exception-with-mongodb-aggregation-framework][1]
Also refer to Mongo Issue fixed
[https://jira.spring.io/browse/DATAMONGO-229]

SpringMvc Instantiating Beans - Singleton

In the under mentioned code i created this because i was getting java.lang.NullPointerException see my error log under. When i implemented this it was fixed and it worked perfectly. However i was told by one of the members here that -
"you are creating new beans for every call to getOfficerRegistrationValidation. this includes recreating the database objects which are every expensive and can cost error if some object are supposed to be created only once (singleton). you should find a way to make OfficerRegistrationValidation reusable and threadsafe so that you can have only one of it and inject this to wherever you want using only IoC"
and i think hes right can someone tell me whats the best way to do this without having to instantiate all my beans again. I just want to instantiate only the certain beans and not run into this problem.
public final class BeanFactory() {
private static ClassPathXmlApplicationContext context;
private static ClassPathXmlApplicationContext getContext() {
if (context== null) {
context = new ClassPathXmlApplicationContext("applicationContext.xml");
}
return context;
}
public static OfficerRegistrationValidation getOfficerRegistrationValidation() {
return (OfficerRegistrationValidation) getContext().getBean("officerRegistrationValidation");
}
}
In the controller make a call like : `BeanFactory.getOfficerRegistrationValidation().validate(....)
Error Log:
java.lang.NullPointerException
at com.crimetrack.service.OfficerRegistrationValidation.validate(OfficerRegistrationValidation.java:51)
at org.springframework.validation.DataBinder.validate(DataBinder.java:725)
at org.springframework.web.bind.annotation.support.HandlerMethodInvoker.doBind(HandlerMethodInvoker.java:815)
at org.springframework.web.bind.annotation.support.HandlerMethodInvoker.resolveHandlerArguments(HandlerMethodInvoker.java:367)
at org.springframework.web.bind.annotation.support.HandlerMethodInvoker.invokeHandlerMethod(HandlerMethodInvoker.java:171)
at org.springframework.web.servlet.mvc.annotation.AnnotationMethodHandlerAdapter.invokeHandlerMethod(AnnotationMethodHandlerAdapter.java:436)
at org.springframework.web.servlet.mvc.annotation.AnnotationMethodHandlerAdapter.handle(AnnotationMethodHandlerAdapter.java:424)
at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:923)
at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:852)
at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:882)
at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:789)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:637)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293)
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859)
at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:602)
at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
at java.lang.Thread.run(Unknown Source)

I'm going to hazard a guess at what you are asking about (as your question doesn't provide your motivation for using a beanfactory and doesn't provide enough code to give a complete picture)...
Spring beans are by default instantiated as singletons. So you should be able to configure Spring to create your OfficerRegistrationValidation object using either XML or annotation (#Component) and then get it injected into your controller by using the #Inject annotation.
Annotations are the way to go - just make sure you have the following in your Spring config XML (applicationContext.xml):
<context:component-scan base-package="com.acme.project" />
<mvc:annotation-driven />
Then simply add the #Component annotation to the class declaration of your OfficerRegistrationValidation class:
#Component
public class OfficerRegistrationValidation {
// ...
}
and then in your controller, declare a field for your OfficerRegistrationValidation and annotate it thus:
#Controller
public class MyController {
#Inject
private OfficerRegistrationValidation officerRegistrationValidation;
// ...
}
Now you will have access to the OfficerRegistrationValidation singleton bean in your controller - only ~4 lines of code needed!

LazyInitializationException (Spring and Vaadin) despite of OpenEntityManagerInView

I am using Spring Roo and Vaadin for a (simple) database application. There is a view displaying a Table containing entities. For the table to be displayed, Hibernate needs to lazily load 1:n referenced entities. This works for small tables, but as soon as the table gets bigger, only the first part is displayed correctly, and the following exception occurs.
com.vaadin.data.util.MethodProperty$MethodException
at com.vaadin.data.util.MethodProperty.getValue(MethodProperty.java:612)
at com.vaadin.data.util.AbstractProperty.toString(AbstractProperty.java:78)
at com.vaadin.ui.Table.formatPropertyValue(Table.java:3476)
at eu.wuttke.tinyscrum.ui.dashboard.DashboardTaskStoryTable.formatPropertyValue(DashboardTaskStoryTable.java:66)
at com.vaadin.ui.Table.getPropertyValue(Table.java:3428)
at com.vaadin.ui.Table.getVisibleCellsNoCache(Table.java:1853)
at com.vaadin.ui.Table.refreshRenderedCells(Table.java:1477)
at com.vaadin.ui.Table.enableContentRefreshing(Table.java:2645)
at com.vaadin.ui.Table.changeVariables(Table.java:2491)
at com.vaadin.terminal.gwt.server.AbstractCommunicationManager.changeVariables(AbstractCommunicationManager.java:1455)
at com.vaadin.terminal.gwt.server.AbstractCommunicationManager.handleVariableBurst(AbstractCommunicationManager.java:1399)
at com.vaadin.terminal.gwt.server.AbstractCommunicationManager.handleVariables(AbstractCommunicationManager.java:1318)
at com.vaadin.terminal.gwt.server.AbstractCommunicationManager.doHandleUidlRequest(AbstractCommunicationManager.java:763)
at com.vaadin.terminal.gwt.server.CommunicationManager.handleUidlRequest(CommunicationManager.java:296)
at com.vaadin.terminal.gwt.server.AbstractApplicationServlet.service(AbstractApplicationServlet.java:501)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.springframework.orm.jpa.support.OpenEntityManagerInViewFilter.doFilterInternal(OpenEntityManagerInViewFilter.java:147)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:76)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298)
at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190)
at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:291)
at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:769)
at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:698)
at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:891)
at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690)
at java.lang.Thread.run(Thread.java:679)
Caused by: java.lang.reflect.InvocationTargetException
at sun.reflect.GeneratedMethodAccessor841.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:616)
at com.vaadin.data.util.MethodProperty.getValue(MethodProperty.java:610)
... 34 more
Caused by: org.hibernate.LazyInitializationException: could not initialize proxy - no Session
at org.hibernate.proxy.AbstractLazyInitializer.initialize(AbstractLazyInitializer.java:167)
at org.hibernate.proxy.AbstractLazyInitializer.getImplementation(AbstractLazyInitializer.java:215)
at org.hibernate.proxy.pojo.javassist.JavassistLazyInitializer.invoke(JavassistLazyInitializer.java:190)
at eu.wuttke.tinyscrum.domain.Iteration_$$_javassist_1.getName(Iteration_$$_javassist_1.java)
at eu.wuttke.tinyscrum.domain.Iteration_Roo_JavaBean.ajc$interMethodDispatch1$eu_wuttke_tinyscrum_domain_Iteration_Roo_JavaBean$eu_wuttke_tinyscrum_domain_Iteration$getName(Iteration_Roo_JavaBean.aj)
at eu.wuttke.tinyscrum.domain.TaskAndStory.getIterationName(TaskAndStory.java:32)
... 38 more
I know this LazyInitializationException exception from other Hibernate applications, where it occurs when the session is not open or already closed again. But looking at the stack trace, it seems the OpenEntityManagerInView filter is getting called.
Any ideas? Thanks a lot!

Vaadin has a persistent state on the server side. If you bind objects to Vaadin components (e.g. by using a BeanItemContainer) your objects will "live" for more then one request on the server side.
On the other hand Spring (via OpenEntityManagerInView) will create a new EntityManager for each request (EntityManagers are not threa safe) and close it after the request. This way your already loaded Entities will become detached (the EM is no longer avaiable), and when Vaadin makes a new request to e.g. load more table rows, the lazy loading fileds will not be able to load (and you will get the LazyInitializationException) since the EM that loaded them no longer exists.
Some solutions:
Use the Eager JPA Fetch (#ManyToOne (fetch= FetchType.EAGER))
Load you object with JOIN FETCH queries (e.g. SELECT mag FROM Magazine mag LEFT JOIN FETCH mag.articles WHERE mag.id = 1 See more)
Use EclipseLink (EclipseLink will open a new Session to load the lazy load fields for detached objects) [We are using this approach]