You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@struts.apache.org by "Leonard Broman (JIRA)" <ji...@apache.org> on 2009/04/30 22:26:30 UTC
[jira] Created: (WW-3114) Work around getSystemClassloader call for
compatibility with GAE
Work around getSystemClassloader call for compatibility with GAE
----------------------------------------------------------------
Key: WW-3114
URL: https://issues.apache.org/struts/browse/WW-3114
Project: Struts 2
Issue Type: Improvement
Components: Plugin - Convention
Affects Versions: 2.1.7
Reporter: Leonard Broman
The Google App Engine sandbox does not allow application to access the system classloader using the ClassLoader.getSystemClassLoader() accessor. The convention plugin uses this to exclude urls to scan in PackageBasedActionConfigBuilder.java.
Due to this, convention plugin is not functioning properly in the GAE sandbox.
Stacktrace from app engine:
com.opensymphony.xwork2.util.logging.jdk.JdkLogger error: Unable to scan named packages
java.security.AccessControlException: access denied (java.lang.RuntimePermission getClassLoader)
at java.security.AccessControlContext.checkPermission(Unknown Source)
at java.security.AccessController.checkPermission(Unknown Source)
at java.lang.SecurityManager.checkPermission(Unknown Source)
at java.lang.ClassLoader.getSystemClassLoader(Unknown Source)
at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildUrlSet(PackageBasedActionConfigBuilder.java:324)
at org.apache.struts2.convention.PackageBasedActionConfigBuilder.findActions(PackageBasedActionConfigBuilder.java:295)
at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildActionConfigs(PackageBasedActionConfigBuilder.java:277)
at org.apache.struts2.convention.ClasspathPackageProvider.loadPackages(ClasspathPackageProvider.java:52)
at com.opensymphony.xwork2.config.impl.DefaultConfiguration.reloadContainer(DefaultConfiguration.java:200)
at com.opensymphony.xwork2.config.ConfigurationManager.getConfiguration(ConfigurationManager.java:55)
at org.apache.struts2.dispatcher.Dispatcher.init_PreloadConfiguration(Dispatcher.java:360)
at org.apache.struts2.dispatcher.Dispatcher.init(Dispatcher.java:403)
at org.apache.struts2.dispatcher.FilterDispatcher.init(FilterDispatcher.java:190)
at org.mortbay.jetty.servlet.FilterHolder.doStart(FilterHolder.java:99)
at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
at org.mortbay.jetty.servlet.ServletHandler.initialize(ServletHandler.java:589)
at org.mortbay.jetty.servlet.Context.startContext(Context.java:139)
at org.mortbay.jetty.webapp.WebAppContext.startContext(WebAppContext.java:1218)
at org.mortbay.jetty.handler.ContextHandler.doStart(ContextHandler.java:500)
at org.mortbay.jetty.webapp.WebAppContext.doStart(WebAppContext.java:448)
at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.createHandler(AppVersionHandlerMap.java:190)
at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.getHandler(AppVersionHandlerMap.java:167)
at com.google.apphosting.runtime.jetty.JettyServletEngineAdapter.serviceRequest(JettyServletEngineAdapter.java:113)
at com.google.apphosting.runtime.JavaRuntime.handleRequest(JavaRuntime.java:235)
at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4547)
at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4545)
at com.google.net.rpc.impl.BlockingApplicationHandler.handleRequest(BlockingApplicationHandler.java:24)
at com.google.net.rpc.impl.RpcUtil.runRpcInApplication(RpcUtil.java:359)
at com.google.net.rpc.impl.Server$2.run(Server.java:792)
at com.google.tracing.LocalTraceSpanRunnable.run(LocalTraceSpanRunnable.java:56)
at com.google.tracing.LocalTraceSpanBuilder.internalContinueSpan(LocalTraceSpanBuilder.java:489)
at com.google.net.rpc.impl.Server.startRpc(Server.java:748)
at com.google.net.rpc.impl.Server.processRequest(Server.java:340)
at com.google.net.rpc.impl.ServerConnection.messageReceived(ServerConnection.java:422)
at com.google.net.rpc.impl.RpcConnection.parseMessages(RpcConnection.java:319)
at com.google.net.rpc.impl.RpcConnection.dataReceived(RpcConnection.java:290)
at com.google.net.async.Connection.handleReadEvent(Connection.java:419)
at com.google.net.async.EventDispatcher.processNetworkEvents(EventDispatcher.java:733)
at com.google.net.async.EventDispatcher.internalLoop(EventDispatcher.java:207)
at com.google.net.async.EventDispatcher.loop(EventDispatcher.java:101)
at com.google.net.rpc.RpcService.runUntilServerShutdown(RpcService.java:249)
at com.google.apphosting.runtime.JavaRuntime$RpcRunnable.run(JavaRuntime.java:373)
at java.lang.Thread.run(Unknown Source)
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Issue Comment Edited: (WW-3114) Work around
getSystemClassloader call for compatibility with GAE
Posted by "Kent R. Spillner (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/struts/browse/WW-3114?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=46290#action_46290 ]
Kent R. Spillner edited comment on WW-3114 at 5/29/09 2:56 PM:
---------------------------------------------------------------
Hi, Musachy-
Thanks again for your suggestions; I apologize for taking so long to get back to you!
Renaming index.jsp to index.ftl works correctly. Awesome! Now, at least, I have a work-around. :D
Below are the full trace logs available from the AppEngine dashboard for two separate requests: /foo/ which successfully renders WEB-INF/content/foo/index.ftl, and / which incorrectly renders WEB-INF/content/index.jsp. Unfortunately, I believe this is all of the logging information available from AppEngine.
There are no errors reported in either, and the two look very similar. The only thing that looks odd to me is the double slash in the lookup path.
#########################################################
#
# Request for /foo/ which correctly renders WEB-INF/content/foo/index.ftl
#
05-29 02:47PM 02.262 /foo/ 200 79ms 124cpu_ms 0kb *REDACTED*.appspot.com Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.10) Gecko/2009042315 Firefox/3.0.10,gzip(gfe)
xxx.xxx.xxx.xxx - - [29/May/2009:14:47:02 -0700] "GET /foo/ HTTP/1.1" 200 228 - "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.10) Gecko/2009042315 Firefox/3.0.10,gzip(gfe)" "*REDACTED*.appspot.com"
D 05-29 02:47PM 02.302
com.opensymphony.xwork2.util.logging.commons.CommonsLogger trace: Checking for [/WEB-INF/content/foo//index.jspx]
D 05-29 02:47PM 02.304
com.opensymphony.xwork2.util.logging.commons.CommonsLogger trace: Checking for [/WEB-INF/content/foo//index.vm]
D 05-29 02:47PM 02.304
com.opensymphony.xwork2.util.logging.commons.CommonsLogger trace: Checking for [/WEB-INF/content/foo//index.jsp]
D 05-29 02:47PM 02.305
com.opensymphony.xwork2.util.logging.commons.CommonsLogger trace: Checking for [/WEB-INF/content/foo//index.ftl]
#########################################################
#
# Request for / which incorrectly renders WEB-INF/content/index.jsp
#
05-29 02:44PM 17.933 / 200 56ms 92cpu_ms 0kb *REDACTED*.appspot.com Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.10) Gecko/2009042315 Firefox/3.0.10,gzip(gfe)
xxx.xxx.xxx.xxx - - [29/May/2009:14:44:17 -0700] "GET / HTTP/1.1" 200 302 - "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.10) Gecko/2009042315 Firefox/3.0.10,gzip(gfe)" "*REDACTED*.appspot.com"
D 05-29 02:44PM 17.964
com.opensymphony.xwork2.util.logging.commons.CommonsLogger trace: Checking for [/WEB-INF/content//index.jspx]
D 05-29 02:44PM 17.966
com.opensymphony.xwork2.util.logging.commons.CommonsLogger trace: Checking for [/WEB-INF/content//index.vm]
D 05-29 02:44PM 17.969
com.opensymphony.xwork2.util.logging.commons.CommonsLogger trace: Checking for [/WEB-INF/content//index.jsp]
was (Author: sl4mmy):
Hi, Musachy-
Thanks again for your suggestions; I apologize for taking so long to get back to you!
Renaming index.jsp to index.ftl works correctly. Awesome! Now, at least, I have a work-around. :D
Below are the full trace logs available from the AppEngine dashboard for two separate requests: /foo/ which successfully renders WEB-INF/content/foo/index.ftl, and / which incorrectly renders WEB-INF/content/index.jsp. Unfortunately, I believe this is all of the logging information available from AppEngine.
There are no errors reported in either, and the two look very similar. The only thing that looks odd to me is the double slash in the lookup path.
#########################################################
#
# Request for /foo/ which correctly renders WEB-INF/content/foo/index.ftl
#
05-29 02:47PM 02.262 /foo/ 200 79ms 124cpu_ms 0kb 6.latest.ozgeandkent.appspot.com Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.10) Gecko/2009042315 Firefox/3.0.10,gzip(gfe)
75.27.59.135 - - [29/May/2009:14:47:02 -0700] "GET /foo/ HTTP/1.1" 200 228 - "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.10) Gecko/2009042315 Firefox/3.0.10,gzip(gfe)" "6.latest.ozgeandkent.appspot.com"
D 05-29 02:47PM 02.302
com.opensymphony.xwork2.util.logging.commons.CommonsLogger trace: Checking for [/WEB-INF/content/foo//index.jspx]
D 05-29 02:47PM 02.304
com.opensymphony.xwork2.util.logging.commons.CommonsLogger trace: Checking for [/WEB-INF/content/foo//index.vm]
D 05-29 02:47PM 02.304
com.opensymphony.xwork2.util.logging.commons.CommonsLogger trace: Checking for [/WEB-INF/content/foo//index.jsp]
D 05-29 02:47PM 02.305
com.opensymphony.xwork2.util.logging.commons.CommonsLogger trace: Checking for [/WEB-INF/content/foo//index.ftl]
#########################################################
#
# Request for / which incorrectly renders WEB-INF/content/index.jsp
#
05-29 02:44PM 17.933 / 200 56ms 92cpu_ms 0kb *REDACTED*.appspot.com Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.10) Gecko/2009042315 Firefox/3.0.10,gzip(gfe)
xxx.xxx.xxx.xxx - - [29/May/2009:14:44:17 -0700] "GET / HTTP/1.1" 200 302 - "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.10) Gecko/2009042315 Firefox/3.0.10,gzip(gfe)" "*REDACTED*.appspot.com"
D 05-29 02:44PM 17.964
com.opensymphony.xwork2.util.logging.commons.CommonsLogger trace: Checking for [/WEB-INF/content//index.jspx]
D 05-29 02:44PM 17.966
com.opensymphony.xwork2.util.logging.commons.CommonsLogger trace: Checking for [/WEB-INF/content//index.vm]
D 05-29 02:44PM 17.969
com.opensymphony.xwork2.util.logging.commons.CommonsLogger trace: Checking for [/WEB-INF/content//index.jsp]
> Work around getSystemClassloader call for compatibility with GAE
> ----------------------------------------------------------------
>
> Key: WW-3114
> URL: https://issues.apache.org/struts/browse/WW-3114
> Project: Struts 2
> Issue Type: Bug
> Components: Plugin - Convention
> Affects Versions: 2.1.7
> Reporter: Leonard Broman
> Assignee: Wes Wannemacher
> Fix For: 2.1.7
>
> Attachments: demonstrate-gae-security-hole.war, gae-patch.txt
>
>
> The Google App Engine sandbox does not allow application to access the system classloader using the ClassLoader.getSystemClassLoader() accessor. The convention plugin uses this to exclude urls to scan in PackageBasedActionConfigBuilder.java.
> Due to this, convention plugin is not functioning properly in the GAE sandbox.
> Stacktrace from app engine:
> com.opensymphony.xwork2.util.logging.jdk.JdkLogger error: Unable to scan named packages
> java.security.AccessControlException: access denied (java.lang.RuntimePermission getClassLoader)
> at java.security.AccessControlContext.checkPermission(Unknown Source)
> at java.security.AccessController.checkPermission(Unknown Source)
> at java.lang.SecurityManager.checkPermission(Unknown Source)
> at java.lang.ClassLoader.getSystemClassLoader(Unknown Source)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildUrlSet(PackageBasedActionConfigBuilder.java:324)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.findActions(PackageBasedActionConfigBuilder.java:295)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildActionConfigs(PackageBasedActionConfigBuilder.java:277)
> at org.apache.struts2.convention.ClasspathPackageProvider.loadPackages(ClasspathPackageProvider.java:52)
> at com.opensymphony.xwork2.config.impl.DefaultConfiguration.reloadContainer(DefaultConfiguration.java:200)
> at com.opensymphony.xwork2.config.ConfigurationManager.getConfiguration(ConfigurationManager.java:55)
> at org.apache.struts2.dispatcher.Dispatcher.init_PreloadConfiguration(Dispatcher.java:360)
> at org.apache.struts2.dispatcher.Dispatcher.init(Dispatcher.java:403)
> at org.apache.struts2.dispatcher.FilterDispatcher.init(FilterDispatcher.java:190)
> at org.mortbay.jetty.servlet.FilterHolder.doStart(FilterHolder.java:99)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at org.mortbay.jetty.servlet.ServletHandler.initialize(ServletHandler.java:589)
> at org.mortbay.jetty.servlet.Context.startContext(Context.java:139)
> at org.mortbay.jetty.webapp.WebAppContext.startContext(WebAppContext.java:1218)
> at org.mortbay.jetty.handler.ContextHandler.doStart(ContextHandler.java:500)
> at org.mortbay.jetty.webapp.WebAppContext.doStart(WebAppContext.java:448)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.createHandler(AppVersionHandlerMap.java:190)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.getHandler(AppVersionHandlerMap.java:167)
> at com.google.apphosting.runtime.jetty.JettyServletEngineAdapter.serviceRequest(JettyServletEngineAdapter.java:113)
> at com.google.apphosting.runtime.JavaRuntime.handleRequest(JavaRuntime.java:235)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4547)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4545)
> at com.google.net.rpc.impl.BlockingApplicationHandler.handleRequest(BlockingApplicationHandler.java:24)
> at com.google.net.rpc.impl.RpcUtil.runRpcInApplication(RpcUtil.java:359)
> at com.google.net.rpc.impl.Server$2.run(Server.java:792)
> at com.google.tracing.LocalTraceSpanRunnable.run(LocalTraceSpanRunnable.java:56)
> at com.google.tracing.LocalTraceSpanBuilder.internalContinueSpan(LocalTraceSpanBuilder.java:489)
> at com.google.net.rpc.impl.Server.startRpc(Server.java:748)
> at com.google.net.rpc.impl.Server.processRequest(Server.java:340)
> at com.google.net.rpc.impl.ServerConnection.messageReceived(ServerConnection.java:422)
> at com.google.net.rpc.impl.RpcConnection.parseMessages(RpcConnection.java:319)
> at com.google.net.rpc.impl.RpcConnection.dataReceived(RpcConnection.java:290)
> at com.google.net.async.Connection.handleReadEvent(Connection.java:419)
> at com.google.net.async.EventDispatcher.processNetworkEvents(EventDispatcher.java:733)
> at com.google.net.async.EventDispatcher.internalLoop(EventDispatcher.java:207)
> at com.google.net.async.EventDispatcher.loop(EventDispatcher.java:101)
> at com.google.net.rpc.RpcService.runUntilServerShutdown(RpcService.java:249)
> at com.google.apphosting.runtime.JavaRuntime$RpcRunnable.run(JavaRuntime.java:373)
> at java.lang.Thread.run(Unknown Source)
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (WW-3114) Work around getSystemClassloader call for
compatibility with GAE
Posted by "Leonard Broman (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/struts/browse/WW-3114?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Leonard Broman updated WW-3114:
-------------------------------
Flags: [Patch]
Issue Type: Bug (was: Improvement)
> Work around getSystemClassloader call for compatibility with GAE
> ----------------------------------------------------------------
>
> Key: WW-3114
> URL: https://issues.apache.org/struts/browse/WW-3114
> Project: Struts 2
> Issue Type: Bug
> Components: Plugin - Convention
> Affects Versions: 2.1.7
> Reporter: Leonard Broman
> Attachments: gae-patch.txt
>
>
> The Google App Engine sandbox does not allow application to access the system classloader using the ClassLoader.getSystemClassLoader() accessor. The convention plugin uses this to exclude urls to scan in PackageBasedActionConfigBuilder.java.
> Due to this, convention plugin is not functioning properly in the GAE sandbox.
> Stacktrace from app engine:
> com.opensymphony.xwork2.util.logging.jdk.JdkLogger error: Unable to scan named packages
> java.security.AccessControlException: access denied (java.lang.RuntimePermission getClassLoader)
> at java.security.AccessControlContext.checkPermission(Unknown Source)
> at java.security.AccessController.checkPermission(Unknown Source)
> at java.lang.SecurityManager.checkPermission(Unknown Source)
> at java.lang.ClassLoader.getSystemClassLoader(Unknown Source)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildUrlSet(PackageBasedActionConfigBuilder.java:324)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.findActions(PackageBasedActionConfigBuilder.java:295)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildActionConfigs(PackageBasedActionConfigBuilder.java:277)
> at org.apache.struts2.convention.ClasspathPackageProvider.loadPackages(ClasspathPackageProvider.java:52)
> at com.opensymphony.xwork2.config.impl.DefaultConfiguration.reloadContainer(DefaultConfiguration.java:200)
> at com.opensymphony.xwork2.config.ConfigurationManager.getConfiguration(ConfigurationManager.java:55)
> at org.apache.struts2.dispatcher.Dispatcher.init_PreloadConfiguration(Dispatcher.java:360)
> at org.apache.struts2.dispatcher.Dispatcher.init(Dispatcher.java:403)
> at org.apache.struts2.dispatcher.FilterDispatcher.init(FilterDispatcher.java:190)
> at org.mortbay.jetty.servlet.FilterHolder.doStart(FilterHolder.java:99)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at org.mortbay.jetty.servlet.ServletHandler.initialize(ServletHandler.java:589)
> at org.mortbay.jetty.servlet.Context.startContext(Context.java:139)
> at org.mortbay.jetty.webapp.WebAppContext.startContext(WebAppContext.java:1218)
> at org.mortbay.jetty.handler.ContextHandler.doStart(ContextHandler.java:500)
> at org.mortbay.jetty.webapp.WebAppContext.doStart(WebAppContext.java:448)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.createHandler(AppVersionHandlerMap.java:190)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.getHandler(AppVersionHandlerMap.java:167)
> at com.google.apphosting.runtime.jetty.JettyServletEngineAdapter.serviceRequest(JettyServletEngineAdapter.java:113)
> at com.google.apphosting.runtime.JavaRuntime.handleRequest(JavaRuntime.java:235)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4547)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4545)
> at com.google.net.rpc.impl.BlockingApplicationHandler.handleRequest(BlockingApplicationHandler.java:24)
> at com.google.net.rpc.impl.RpcUtil.runRpcInApplication(RpcUtil.java:359)
> at com.google.net.rpc.impl.Server$2.run(Server.java:792)
> at com.google.tracing.LocalTraceSpanRunnable.run(LocalTraceSpanRunnable.java:56)
> at com.google.tracing.LocalTraceSpanBuilder.internalContinueSpan(LocalTraceSpanBuilder.java:489)
> at com.google.net.rpc.impl.Server.startRpc(Server.java:748)
> at com.google.net.rpc.impl.Server.processRequest(Server.java:340)
> at com.google.net.rpc.impl.ServerConnection.messageReceived(ServerConnection.java:422)
> at com.google.net.rpc.impl.RpcConnection.parseMessages(RpcConnection.java:319)
> at com.google.net.rpc.impl.RpcConnection.dataReceived(RpcConnection.java:290)
> at com.google.net.async.Connection.handleReadEvent(Connection.java:419)
> at com.google.net.async.EventDispatcher.processNetworkEvents(EventDispatcher.java:733)
> at com.google.net.async.EventDispatcher.internalLoop(EventDispatcher.java:207)
> at com.google.net.async.EventDispatcher.loop(EventDispatcher.java:101)
> at com.google.net.rpc.RpcService.runUntilServerShutdown(RpcService.java:249)
> at com.google.apphosting.runtime.JavaRuntime$RpcRunnable.run(JavaRuntime.java:373)
> at java.lang.Thread.run(Unknown Source)
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (WW-3114) Work around getSystemClassloader call
for compatibility with GAE
Posted by "Kent R. Spillner (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/struts/browse/WW-3114?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=46292#action_46292 ]
Kent R. Spillner commented on WW-3114:
--------------------------------------
Hi, Musachy-
Like you said before: "we still don't know, but we're getting closer." :)
I've identified the *real* bug, and I've got a patch to work around it, but I still don't know if the root cause is a Struts issue or a GAE issue (or a combination of the two).
I'll create a new JIRA issue so I have a spot to hang the patch and detail my hypothesis. Hopefully, someone familiar with Struts' & XWork's internals can help me identify the correct solution.
Thanks again!
Best,
Kent
> Work around getSystemClassloader call for compatibility with GAE
> ----------------------------------------------------------------
>
> Key: WW-3114
> URL: https://issues.apache.org/struts/browse/WW-3114
> Project: Struts 2
> Issue Type: Bug
> Components: Plugin - Convention
> Affects Versions: 2.1.7
> Reporter: Leonard Broman
> Assignee: Wes Wannemacher
> Fix For: 2.1.7
>
> Attachments: demonstrate-gae-security-hole.war, gae-patch.txt
>
>
> The Google App Engine sandbox does not allow application to access the system classloader using the ClassLoader.getSystemClassLoader() accessor. The convention plugin uses this to exclude urls to scan in PackageBasedActionConfigBuilder.java.
> Due to this, convention plugin is not functioning properly in the GAE sandbox.
> Stacktrace from app engine:
> com.opensymphony.xwork2.util.logging.jdk.JdkLogger error: Unable to scan named packages
> java.security.AccessControlException: access denied (java.lang.RuntimePermission getClassLoader)
> at java.security.AccessControlContext.checkPermission(Unknown Source)
> at java.security.AccessController.checkPermission(Unknown Source)
> at java.lang.SecurityManager.checkPermission(Unknown Source)
> at java.lang.ClassLoader.getSystemClassLoader(Unknown Source)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildUrlSet(PackageBasedActionConfigBuilder.java:324)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.findActions(PackageBasedActionConfigBuilder.java:295)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildActionConfigs(PackageBasedActionConfigBuilder.java:277)
> at org.apache.struts2.convention.ClasspathPackageProvider.loadPackages(ClasspathPackageProvider.java:52)
> at com.opensymphony.xwork2.config.impl.DefaultConfiguration.reloadContainer(DefaultConfiguration.java:200)
> at com.opensymphony.xwork2.config.ConfigurationManager.getConfiguration(ConfigurationManager.java:55)
> at org.apache.struts2.dispatcher.Dispatcher.init_PreloadConfiguration(Dispatcher.java:360)
> at org.apache.struts2.dispatcher.Dispatcher.init(Dispatcher.java:403)
> at org.apache.struts2.dispatcher.FilterDispatcher.init(FilterDispatcher.java:190)
> at org.mortbay.jetty.servlet.FilterHolder.doStart(FilterHolder.java:99)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at org.mortbay.jetty.servlet.ServletHandler.initialize(ServletHandler.java:589)
> at org.mortbay.jetty.servlet.Context.startContext(Context.java:139)
> at org.mortbay.jetty.webapp.WebAppContext.startContext(WebAppContext.java:1218)
> at org.mortbay.jetty.handler.ContextHandler.doStart(ContextHandler.java:500)
> at org.mortbay.jetty.webapp.WebAppContext.doStart(WebAppContext.java:448)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.createHandler(AppVersionHandlerMap.java:190)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.getHandler(AppVersionHandlerMap.java:167)
> at com.google.apphosting.runtime.jetty.JettyServletEngineAdapter.serviceRequest(JettyServletEngineAdapter.java:113)
> at com.google.apphosting.runtime.JavaRuntime.handleRequest(JavaRuntime.java:235)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4547)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4545)
> at com.google.net.rpc.impl.BlockingApplicationHandler.handleRequest(BlockingApplicationHandler.java:24)
> at com.google.net.rpc.impl.RpcUtil.runRpcInApplication(RpcUtil.java:359)
> at com.google.net.rpc.impl.Server$2.run(Server.java:792)
> at com.google.tracing.LocalTraceSpanRunnable.run(LocalTraceSpanRunnable.java:56)
> at com.google.tracing.LocalTraceSpanBuilder.internalContinueSpan(LocalTraceSpanBuilder.java:489)
> at com.google.net.rpc.impl.Server.startRpc(Server.java:748)
> at com.google.net.rpc.impl.Server.processRequest(Server.java:340)
> at com.google.net.rpc.impl.ServerConnection.messageReceived(ServerConnection.java:422)
> at com.google.net.rpc.impl.RpcConnection.parseMessages(RpcConnection.java:319)
> at com.google.net.rpc.impl.RpcConnection.dataReceived(RpcConnection.java:290)
> at com.google.net.async.Connection.handleReadEvent(Connection.java:419)
> at com.google.net.async.EventDispatcher.processNetworkEvents(EventDispatcher.java:733)
> at com.google.net.async.EventDispatcher.internalLoop(EventDispatcher.java:207)
> at com.google.net.async.EventDispatcher.loop(EventDispatcher.java:101)
> at com.google.net.rpc.RpcService.runUntilServerShutdown(RpcService.java:249)
> at com.google.apphosting.runtime.JavaRuntime$RpcRunnable.run(JavaRuntime.java:373)
> at java.lang.Thread.run(Unknown Source)
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (WW-3114) Work around getSystemClassloader call
for compatibility with GAE
Posted by "Musachy Barroso (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/struts/browse/WW-3114?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=46227#action_46227 ]
Musachy Barroso commented on WW-3114:
-------------------------------------
could this be a GAE problem? Convention uses struts 2 results and normal JSP/Servlet API to dispatch to resources.
> Work around getSystemClassloader call for compatibility with GAE
> ----------------------------------------------------------------
>
> Key: WW-3114
> URL: https://issues.apache.org/struts/browse/WW-3114
> Project: Struts 2
> Issue Type: Bug
> Components: Plugin - Convention
> Affects Versions: 2.1.7
> Reporter: Leonard Broman
> Assignee: Wes Wannemacher
> Fix For: 2.1.7
>
> Attachments: demonstrate-gae-security-hole.war, gae-patch.txt
>
>
> The Google App Engine sandbox does not allow application to access the system classloader using the ClassLoader.getSystemClassLoader() accessor. The convention plugin uses this to exclude urls to scan in PackageBasedActionConfigBuilder.java.
> Due to this, convention plugin is not functioning properly in the GAE sandbox.
> Stacktrace from app engine:
> com.opensymphony.xwork2.util.logging.jdk.JdkLogger error: Unable to scan named packages
> java.security.AccessControlException: access denied (java.lang.RuntimePermission getClassLoader)
> at java.security.AccessControlContext.checkPermission(Unknown Source)
> at java.security.AccessController.checkPermission(Unknown Source)
> at java.lang.SecurityManager.checkPermission(Unknown Source)
> at java.lang.ClassLoader.getSystemClassLoader(Unknown Source)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildUrlSet(PackageBasedActionConfigBuilder.java:324)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.findActions(PackageBasedActionConfigBuilder.java:295)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildActionConfigs(PackageBasedActionConfigBuilder.java:277)
> at org.apache.struts2.convention.ClasspathPackageProvider.loadPackages(ClasspathPackageProvider.java:52)
> at com.opensymphony.xwork2.config.impl.DefaultConfiguration.reloadContainer(DefaultConfiguration.java:200)
> at com.opensymphony.xwork2.config.ConfigurationManager.getConfiguration(ConfigurationManager.java:55)
> at org.apache.struts2.dispatcher.Dispatcher.init_PreloadConfiguration(Dispatcher.java:360)
> at org.apache.struts2.dispatcher.Dispatcher.init(Dispatcher.java:403)
> at org.apache.struts2.dispatcher.FilterDispatcher.init(FilterDispatcher.java:190)
> at org.mortbay.jetty.servlet.FilterHolder.doStart(FilterHolder.java:99)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at org.mortbay.jetty.servlet.ServletHandler.initialize(ServletHandler.java:589)
> at org.mortbay.jetty.servlet.Context.startContext(Context.java:139)
> at org.mortbay.jetty.webapp.WebAppContext.startContext(WebAppContext.java:1218)
> at org.mortbay.jetty.handler.ContextHandler.doStart(ContextHandler.java:500)
> at org.mortbay.jetty.webapp.WebAppContext.doStart(WebAppContext.java:448)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.createHandler(AppVersionHandlerMap.java:190)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.getHandler(AppVersionHandlerMap.java:167)
> at com.google.apphosting.runtime.jetty.JettyServletEngineAdapter.serviceRequest(JettyServletEngineAdapter.java:113)
> at com.google.apphosting.runtime.JavaRuntime.handleRequest(JavaRuntime.java:235)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4547)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4545)
> at com.google.net.rpc.impl.BlockingApplicationHandler.handleRequest(BlockingApplicationHandler.java:24)
> at com.google.net.rpc.impl.RpcUtil.runRpcInApplication(RpcUtil.java:359)
> at com.google.net.rpc.impl.Server$2.run(Server.java:792)
> at com.google.tracing.LocalTraceSpanRunnable.run(LocalTraceSpanRunnable.java:56)
> at com.google.tracing.LocalTraceSpanBuilder.internalContinueSpan(LocalTraceSpanBuilder.java:489)
> at com.google.net.rpc.impl.Server.startRpc(Server.java:748)
> at com.google.net.rpc.impl.Server.processRequest(Server.java:340)
> at com.google.net.rpc.impl.ServerConnection.messageReceived(ServerConnection.java:422)
> at com.google.net.rpc.impl.RpcConnection.parseMessages(RpcConnection.java:319)
> at com.google.net.rpc.impl.RpcConnection.dataReceived(RpcConnection.java:290)
> at com.google.net.async.Connection.handleReadEvent(Connection.java:419)
> at com.google.net.async.EventDispatcher.processNetworkEvents(EventDispatcher.java:733)
> at com.google.net.async.EventDispatcher.internalLoop(EventDispatcher.java:207)
> at com.google.net.async.EventDispatcher.loop(EventDispatcher.java:101)
> at com.google.net.rpc.RpcService.runUntilServerShutdown(RpcService.java:249)
> at com.google.apphosting.runtime.JavaRuntime$RpcRunnable.run(JavaRuntime.java:373)
> at java.lang.Thread.run(Unknown Source)
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (WW-3114) Work around getSystemClassloader call for
compatibility with GAE
Posted by "Kent R. Spillner (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/struts/browse/WW-3114?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Kent R. Spillner updated WW-3114:
---------------------------------
Attachment: demonstrate-gae-security-hole.war
The attached .war file (demonstrate-gae-security-hole.war) exhibits the behavior I previously described (actionless results for index.jsp files are served as raw source with content-type text/plain) when deployed to Google AppEngine.
Download and unzip the .war file locally, then edit WEB-INF/appengine-web.xml and change the application's id to the name of one of your own AppEngine applications. Run appcfg update to upload the application.
You can see the problem I describe by visiting these URLs:
http://<yourapplication>.appspot.com/
http://<yourapplication>.appspot.com/foo
http://<yourapplication>.appspot.com/foo/
Everything works as expected if you visit these URLs:
http://<yourapplication>.appspot.com/index
http://<yourapplication>.appspot.com/bar
http://<yourapplication>.appspot.com/foo/index
http://<yourapplication>.appspot.com/foo/baz
> Work around getSystemClassloader call for compatibility with GAE
> ----------------------------------------------------------------
>
> Key: WW-3114
> URL: https://issues.apache.org/struts/browse/WW-3114
> Project: Struts 2
> Issue Type: Bug
> Components: Plugin - Convention
> Affects Versions: 2.1.7
> Reporter: Leonard Broman
> Assignee: Wes Wannemacher
> Fix For: 2.1.7
>
> Attachments: demonstrate-gae-security-hole.war, gae-patch.txt
>
>
> The Google App Engine sandbox does not allow application to access the system classloader using the ClassLoader.getSystemClassLoader() accessor. The convention plugin uses this to exclude urls to scan in PackageBasedActionConfigBuilder.java.
> Due to this, convention plugin is not functioning properly in the GAE sandbox.
> Stacktrace from app engine:
> com.opensymphony.xwork2.util.logging.jdk.JdkLogger error: Unable to scan named packages
> java.security.AccessControlException: access denied (java.lang.RuntimePermission getClassLoader)
> at java.security.AccessControlContext.checkPermission(Unknown Source)
> at java.security.AccessController.checkPermission(Unknown Source)
> at java.lang.SecurityManager.checkPermission(Unknown Source)
> at java.lang.ClassLoader.getSystemClassLoader(Unknown Source)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildUrlSet(PackageBasedActionConfigBuilder.java:324)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.findActions(PackageBasedActionConfigBuilder.java:295)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildActionConfigs(PackageBasedActionConfigBuilder.java:277)
> at org.apache.struts2.convention.ClasspathPackageProvider.loadPackages(ClasspathPackageProvider.java:52)
> at com.opensymphony.xwork2.config.impl.DefaultConfiguration.reloadContainer(DefaultConfiguration.java:200)
> at com.opensymphony.xwork2.config.ConfigurationManager.getConfiguration(ConfigurationManager.java:55)
> at org.apache.struts2.dispatcher.Dispatcher.init_PreloadConfiguration(Dispatcher.java:360)
> at org.apache.struts2.dispatcher.Dispatcher.init(Dispatcher.java:403)
> at org.apache.struts2.dispatcher.FilterDispatcher.init(FilterDispatcher.java:190)
> at org.mortbay.jetty.servlet.FilterHolder.doStart(FilterHolder.java:99)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at org.mortbay.jetty.servlet.ServletHandler.initialize(ServletHandler.java:589)
> at org.mortbay.jetty.servlet.Context.startContext(Context.java:139)
> at org.mortbay.jetty.webapp.WebAppContext.startContext(WebAppContext.java:1218)
> at org.mortbay.jetty.handler.ContextHandler.doStart(ContextHandler.java:500)
> at org.mortbay.jetty.webapp.WebAppContext.doStart(WebAppContext.java:448)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.createHandler(AppVersionHandlerMap.java:190)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.getHandler(AppVersionHandlerMap.java:167)
> at com.google.apphosting.runtime.jetty.JettyServletEngineAdapter.serviceRequest(JettyServletEngineAdapter.java:113)
> at com.google.apphosting.runtime.JavaRuntime.handleRequest(JavaRuntime.java:235)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4547)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4545)
> at com.google.net.rpc.impl.BlockingApplicationHandler.handleRequest(BlockingApplicationHandler.java:24)
> at com.google.net.rpc.impl.RpcUtil.runRpcInApplication(RpcUtil.java:359)
> at com.google.net.rpc.impl.Server$2.run(Server.java:792)
> at com.google.tracing.LocalTraceSpanRunnable.run(LocalTraceSpanRunnable.java:56)
> at com.google.tracing.LocalTraceSpanBuilder.internalContinueSpan(LocalTraceSpanBuilder.java:489)
> at com.google.net.rpc.impl.Server.startRpc(Server.java:748)
> at com.google.net.rpc.impl.Server.processRequest(Server.java:340)
> at com.google.net.rpc.impl.ServerConnection.messageReceived(ServerConnection.java:422)
> at com.google.net.rpc.impl.RpcConnection.parseMessages(RpcConnection.java:319)
> at com.google.net.rpc.impl.RpcConnection.dataReceived(RpcConnection.java:290)
> at com.google.net.async.Connection.handleReadEvent(Connection.java:419)
> at com.google.net.async.EventDispatcher.processNetworkEvents(EventDispatcher.java:733)
> at com.google.net.async.EventDispatcher.internalLoop(EventDispatcher.java:207)
> at com.google.net.async.EventDispatcher.loop(EventDispatcher.java:101)
> at com.google.net.rpc.RpcService.runUntilServerShutdown(RpcService.java:249)
> at com.google.apphosting.runtime.JavaRuntime$RpcRunnable.run(JavaRuntime.java:373)
> at java.lang.Thread.run(Unknown Source)
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Resolved: (WW-3114) Work around getSystemClassloader call
for compatibility with GAE
Posted by "Wes Wannemacher (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/struts/browse/WW-3114?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Wes Wannemacher resolved WW-3114.
---------------------------------
Resolution: Fixed
Fix Version/s: 2.1.7
Assignee: Wes Wannemacher
Patch applied, thanks Leonard
> Work around getSystemClassloader call for compatibility with GAE
> ----------------------------------------------------------------
>
> Key: WW-3114
> URL: https://issues.apache.org/struts/browse/WW-3114
> Project: Struts 2
> Issue Type: Bug
> Components: Plugin - Convention
> Affects Versions: 2.1.7
> Reporter: Leonard Broman
> Assignee: Wes Wannemacher
> Fix For: 2.1.7
>
> Attachments: gae-patch.txt
>
>
> The Google App Engine sandbox does not allow application to access the system classloader using the ClassLoader.getSystemClassLoader() accessor. The convention plugin uses this to exclude urls to scan in PackageBasedActionConfigBuilder.java.
> Due to this, convention plugin is not functioning properly in the GAE sandbox.
> Stacktrace from app engine:
> com.opensymphony.xwork2.util.logging.jdk.JdkLogger error: Unable to scan named packages
> java.security.AccessControlException: access denied (java.lang.RuntimePermission getClassLoader)
> at java.security.AccessControlContext.checkPermission(Unknown Source)
> at java.security.AccessController.checkPermission(Unknown Source)
> at java.lang.SecurityManager.checkPermission(Unknown Source)
> at java.lang.ClassLoader.getSystemClassLoader(Unknown Source)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildUrlSet(PackageBasedActionConfigBuilder.java:324)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.findActions(PackageBasedActionConfigBuilder.java:295)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildActionConfigs(PackageBasedActionConfigBuilder.java:277)
> at org.apache.struts2.convention.ClasspathPackageProvider.loadPackages(ClasspathPackageProvider.java:52)
> at com.opensymphony.xwork2.config.impl.DefaultConfiguration.reloadContainer(DefaultConfiguration.java:200)
> at com.opensymphony.xwork2.config.ConfigurationManager.getConfiguration(ConfigurationManager.java:55)
> at org.apache.struts2.dispatcher.Dispatcher.init_PreloadConfiguration(Dispatcher.java:360)
> at org.apache.struts2.dispatcher.Dispatcher.init(Dispatcher.java:403)
> at org.apache.struts2.dispatcher.FilterDispatcher.init(FilterDispatcher.java:190)
> at org.mortbay.jetty.servlet.FilterHolder.doStart(FilterHolder.java:99)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at org.mortbay.jetty.servlet.ServletHandler.initialize(ServletHandler.java:589)
> at org.mortbay.jetty.servlet.Context.startContext(Context.java:139)
> at org.mortbay.jetty.webapp.WebAppContext.startContext(WebAppContext.java:1218)
> at org.mortbay.jetty.handler.ContextHandler.doStart(ContextHandler.java:500)
> at org.mortbay.jetty.webapp.WebAppContext.doStart(WebAppContext.java:448)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.createHandler(AppVersionHandlerMap.java:190)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.getHandler(AppVersionHandlerMap.java:167)
> at com.google.apphosting.runtime.jetty.JettyServletEngineAdapter.serviceRequest(JettyServletEngineAdapter.java:113)
> at com.google.apphosting.runtime.JavaRuntime.handleRequest(JavaRuntime.java:235)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4547)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4545)
> at com.google.net.rpc.impl.BlockingApplicationHandler.handleRequest(BlockingApplicationHandler.java:24)
> at com.google.net.rpc.impl.RpcUtil.runRpcInApplication(RpcUtil.java:359)
> at com.google.net.rpc.impl.Server$2.run(Server.java:792)
> at com.google.tracing.LocalTraceSpanRunnable.run(LocalTraceSpanRunnable.java:56)
> at com.google.tracing.LocalTraceSpanBuilder.internalContinueSpan(LocalTraceSpanBuilder.java:489)
> at com.google.net.rpc.impl.Server.startRpc(Server.java:748)
> at com.google.net.rpc.impl.Server.processRequest(Server.java:340)
> at com.google.net.rpc.impl.ServerConnection.messageReceived(ServerConnection.java:422)
> at com.google.net.rpc.impl.RpcConnection.parseMessages(RpcConnection.java:319)
> at com.google.net.rpc.impl.RpcConnection.dataReceived(RpcConnection.java:290)
> at com.google.net.async.Connection.handleReadEvent(Connection.java:419)
> at com.google.net.async.EventDispatcher.processNetworkEvents(EventDispatcher.java:733)
> at com.google.net.async.EventDispatcher.internalLoop(EventDispatcher.java:207)
> at com.google.net.async.EventDispatcher.loop(EventDispatcher.java:101)
> at com.google.net.rpc.RpcService.runUntilServerShutdown(RpcService.java:249)
> at com.google.apphosting.runtime.JavaRuntime$RpcRunnable.run(JavaRuntime.java:373)
> at java.lang.Thread.run(Unknown Source)
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (WW-3114) Work around getSystemClassloader call
for compatibility with GAE
Posted by "Kent R. Spillner (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/struts/browse/WW-3114?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=46290#action_46290 ]
Kent R. Spillner commented on WW-3114:
--------------------------------------
Hi, Musachy-
Thanks again for your suggestions; I apologize for taking so long to get back to you!
Renaming index.jsp to index.ftl works correctly. Awesome! Now, at least, I have a work-around. :D
Below are the full trace logs available from the AppEngine dashboard for two separate requests: /foo/ which successfully renders WEB-INF/content/foo/index.ftl, and / which incorrectly renders WEB-INF/content/index.jsp. Unfortunately, I believe this is all of the logging information available from AppEngine.
There are no errors reported in either, and the two look very similar. The only thing that looks odd to me is the double slash in the lookup path.
#########################################################
#
# Request for /foo/ which correctly renders WEB-INF/content/foo/index.ftl
#
05-29 02:47PM 02.262 /foo/ 200 79ms 124cpu_ms 0kb 6.latest.ozgeandkent.appspot.com Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.10) Gecko/2009042315 Firefox/3.0.10,gzip(gfe)
75.27.59.135 - - [29/May/2009:14:47:02 -0700] "GET /foo/ HTTP/1.1" 200 228 - "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.10) Gecko/2009042315 Firefox/3.0.10,gzip(gfe)" "6.latest.ozgeandkent.appspot.com"
D 05-29 02:47PM 02.302
com.opensymphony.xwork2.util.logging.commons.CommonsLogger trace: Checking for [/WEB-INF/content/foo//index.jspx]
D 05-29 02:47PM 02.304
com.opensymphony.xwork2.util.logging.commons.CommonsLogger trace: Checking for [/WEB-INF/content/foo//index.vm]
D 05-29 02:47PM 02.304
com.opensymphony.xwork2.util.logging.commons.CommonsLogger trace: Checking for [/WEB-INF/content/foo//index.jsp]
D 05-29 02:47PM 02.305
com.opensymphony.xwork2.util.logging.commons.CommonsLogger trace: Checking for [/WEB-INF/content/foo//index.ftl]
#########################################################
#
# Request for / which incorrectly renders WEB-INF/content/index.jsp
#
05-29 02:44PM 17.933 / 200 56ms 92cpu_ms 0kb *REDACTED*.appspot.com Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.10) Gecko/2009042315 Firefox/3.0.10,gzip(gfe)
xxx.xxx.xxx.xxx - - [29/May/2009:14:44:17 -0700] "GET / HTTP/1.1" 200 302 - "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.10) Gecko/2009042315 Firefox/3.0.10,gzip(gfe)" "*REDACTED*.appspot.com"
D 05-29 02:44PM 17.964
com.opensymphony.xwork2.util.logging.commons.CommonsLogger trace: Checking for [/WEB-INF/content//index.jspx]
D 05-29 02:44PM 17.966
com.opensymphony.xwork2.util.logging.commons.CommonsLogger trace: Checking for [/WEB-INF/content//index.vm]
D 05-29 02:44PM 17.969
com.opensymphony.xwork2.util.logging.commons.CommonsLogger trace: Checking for [/WEB-INF/content//index.jsp]
> Work around getSystemClassloader call for compatibility with GAE
> ----------------------------------------------------------------
>
> Key: WW-3114
> URL: https://issues.apache.org/struts/browse/WW-3114
> Project: Struts 2
> Issue Type: Bug
> Components: Plugin - Convention
> Affects Versions: 2.1.7
> Reporter: Leonard Broman
> Assignee: Wes Wannemacher
> Fix For: 2.1.7
>
> Attachments: demonstrate-gae-security-hole.war, gae-patch.txt
>
>
> The Google App Engine sandbox does not allow application to access the system classloader using the ClassLoader.getSystemClassLoader() accessor. The convention plugin uses this to exclude urls to scan in PackageBasedActionConfigBuilder.java.
> Due to this, convention plugin is not functioning properly in the GAE sandbox.
> Stacktrace from app engine:
> com.opensymphony.xwork2.util.logging.jdk.JdkLogger error: Unable to scan named packages
> java.security.AccessControlException: access denied (java.lang.RuntimePermission getClassLoader)
> at java.security.AccessControlContext.checkPermission(Unknown Source)
> at java.security.AccessController.checkPermission(Unknown Source)
> at java.lang.SecurityManager.checkPermission(Unknown Source)
> at java.lang.ClassLoader.getSystemClassLoader(Unknown Source)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildUrlSet(PackageBasedActionConfigBuilder.java:324)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.findActions(PackageBasedActionConfigBuilder.java:295)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildActionConfigs(PackageBasedActionConfigBuilder.java:277)
> at org.apache.struts2.convention.ClasspathPackageProvider.loadPackages(ClasspathPackageProvider.java:52)
> at com.opensymphony.xwork2.config.impl.DefaultConfiguration.reloadContainer(DefaultConfiguration.java:200)
> at com.opensymphony.xwork2.config.ConfigurationManager.getConfiguration(ConfigurationManager.java:55)
> at org.apache.struts2.dispatcher.Dispatcher.init_PreloadConfiguration(Dispatcher.java:360)
> at org.apache.struts2.dispatcher.Dispatcher.init(Dispatcher.java:403)
> at org.apache.struts2.dispatcher.FilterDispatcher.init(FilterDispatcher.java:190)
> at org.mortbay.jetty.servlet.FilterHolder.doStart(FilterHolder.java:99)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at org.mortbay.jetty.servlet.ServletHandler.initialize(ServletHandler.java:589)
> at org.mortbay.jetty.servlet.Context.startContext(Context.java:139)
> at org.mortbay.jetty.webapp.WebAppContext.startContext(WebAppContext.java:1218)
> at org.mortbay.jetty.handler.ContextHandler.doStart(ContextHandler.java:500)
> at org.mortbay.jetty.webapp.WebAppContext.doStart(WebAppContext.java:448)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.createHandler(AppVersionHandlerMap.java:190)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.getHandler(AppVersionHandlerMap.java:167)
> at com.google.apphosting.runtime.jetty.JettyServletEngineAdapter.serviceRequest(JettyServletEngineAdapter.java:113)
> at com.google.apphosting.runtime.JavaRuntime.handleRequest(JavaRuntime.java:235)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4547)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4545)
> at com.google.net.rpc.impl.BlockingApplicationHandler.handleRequest(BlockingApplicationHandler.java:24)
> at com.google.net.rpc.impl.RpcUtil.runRpcInApplication(RpcUtil.java:359)
> at com.google.net.rpc.impl.Server$2.run(Server.java:792)
> at com.google.tracing.LocalTraceSpanRunnable.run(LocalTraceSpanRunnable.java:56)
> at com.google.tracing.LocalTraceSpanBuilder.internalContinueSpan(LocalTraceSpanBuilder.java:489)
> at com.google.net.rpc.impl.Server.startRpc(Server.java:748)
> at com.google.net.rpc.impl.Server.processRequest(Server.java:340)
> at com.google.net.rpc.impl.ServerConnection.messageReceived(ServerConnection.java:422)
> at com.google.net.rpc.impl.RpcConnection.parseMessages(RpcConnection.java:319)
> at com.google.net.rpc.impl.RpcConnection.dataReceived(RpcConnection.java:290)
> at com.google.net.async.Connection.handleReadEvent(Connection.java:419)
> at com.google.net.async.EventDispatcher.processNetworkEvents(EventDispatcher.java:733)
> at com.google.net.async.EventDispatcher.internalLoop(EventDispatcher.java:207)
> at com.google.net.async.EventDispatcher.loop(EventDispatcher.java:101)
> at com.google.net.rpc.RpcService.runUntilServerShutdown(RpcService.java:249)
> at com.google.apphosting.runtime.JavaRuntime$RpcRunnable.run(JavaRuntime.java:373)
> at java.lang.Thread.run(Unknown Source)
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (WW-3114) Work around getSystemClassloader call
for compatibility with GAE
Posted by "Kent R. Spillner (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/struts/browse/WW-3114?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=46229#action_46229 ]
Kent R. Spillner commented on WW-3114:
--------------------------------------
Hi, Musachy-
Thanks for the feedback!
Like I said, I don't know if it's a Struts 2 bug, or a Google AppEngine bug. Either way, you can't attach a debugger to apps running on AppEngine. :(
I've reported the issue to Google, as well: http://code.google.com/p/googleappengine/issues/detail?id=1580
Best,
Kent
> Work around getSystemClassloader call for compatibility with GAE
> ----------------------------------------------------------------
>
> Key: WW-3114
> URL: https://issues.apache.org/struts/browse/WW-3114
> Project: Struts 2
> Issue Type: Bug
> Components: Plugin - Convention
> Affects Versions: 2.1.7
> Reporter: Leonard Broman
> Assignee: Wes Wannemacher
> Fix For: 2.1.7
>
> Attachments: demonstrate-gae-security-hole.war, gae-patch.txt
>
>
> The Google App Engine sandbox does not allow application to access the system classloader using the ClassLoader.getSystemClassLoader() accessor. The convention plugin uses this to exclude urls to scan in PackageBasedActionConfigBuilder.java.
> Due to this, convention plugin is not functioning properly in the GAE sandbox.
> Stacktrace from app engine:
> com.opensymphony.xwork2.util.logging.jdk.JdkLogger error: Unable to scan named packages
> java.security.AccessControlException: access denied (java.lang.RuntimePermission getClassLoader)
> at java.security.AccessControlContext.checkPermission(Unknown Source)
> at java.security.AccessController.checkPermission(Unknown Source)
> at java.lang.SecurityManager.checkPermission(Unknown Source)
> at java.lang.ClassLoader.getSystemClassLoader(Unknown Source)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildUrlSet(PackageBasedActionConfigBuilder.java:324)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.findActions(PackageBasedActionConfigBuilder.java:295)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildActionConfigs(PackageBasedActionConfigBuilder.java:277)
> at org.apache.struts2.convention.ClasspathPackageProvider.loadPackages(ClasspathPackageProvider.java:52)
> at com.opensymphony.xwork2.config.impl.DefaultConfiguration.reloadContainer(DefaultConfiguration.java:200)
> at com.opensymphony.xwork2.config.ConfigurationManager.getConfiguration(ConfigurationManager.java:55)
> at org.apache.struts2.dispatcher.Dispatcher.init_PreloadConfiguration(Dispatcher.java:360)
> at org.apache.struts2.dispatcher.Dispatcher.init(Dispatcher.java:403)
> at org.apache.struts2.dispatcher.FilterDispatcher.init(FilterDispatcher.java:190)
> at org.mortbay.jetty.servlet.FilterHolder.doStart(FilterHolder.java:99)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at org.mortbay.jetty.servlet.ServletHandler.initialize(ServletHandler.java:589)
> at org.mortbay.jetty.servlet.Context.startContext(Context.java:139)
> at org.mortbay.jetty.webapp.WebAppContext.startContext(WebAppContext.java:1218)
> at org.mortbay.jetty.handler.ContextHandler.doStart(ContextHandler.java:500)
> at org.mortbay.jetty.webapp.WebAppContext.doStart(WebAppContext.java:448)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.createHandler(AppVersionHandlerMap.java:190)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.getHandler(AppVersionHandlerMap.java:167)
> at com.google.apphosting.runtime.jetty.JettyServletEngineAdapter.serviceRequest(JettyServletEngineAdapter.java:113)
> at com.google.apphosting.runtime.JavaRuntime.handleRequest(JavaRuntime.java:235)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4547)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4545)
> at com.google.net.rpc.impl.BlockingApplicationHandler.handleRequest(BlockingApplicationHandler.java:24)
> at com.google.net.rpc.impl.RpcUtil.runRpcInApplication(RpcUtil.java:359)
> at com.google.net.rpc.impl.Server$2.run(Server.java:792)
> at com.google.tracing.LocalTraceSpanRunnable.run(LocalTraceSpanRunnable.java:56)
> at com.google.tracing.LocalTraceSpanBuilder.internalContinueSpan(LocalTraceSpanBuilder.java:489)
> at com.google.net.rpc.impl.Server.startRpc(Server.java:748)
> at com.google.net.rpc.impl.Server.processRequest(Server.java:340)
> at com.google.net.rpc.impl.ServerConnection.messageReceived(ServerConnection.java:422)
> at com.google.net.rpc.impl.RpcConnection.parseMessages(RpcConnection.java:319)
> at com.google.net.rpc.impl.RpcConnection.dataReceived(RpcConnection.java:290)
> at com.google.net.async.Connection.handleReadEvent(Connection.java:419)
> at com.google.net.async.EventDispatcher.processNetworkEvents(EventDispatcher.java:733)
> at com.google.net.async.EventDispatcher.internalLoop(EventDispatcher.java:207)
> at com.google.net.async.EventDispatcher.loop(EventDispatcher.java:101)
> at com.google.net.rpc.RpcService.runUntilServerShutdown(RpcService.java:249)
> at com.google.apphosting.runtime.JavaRuntime$RpcRunnable.run(JavaRuntime.java:373)
> at java.lang.Thread.run(Unknown Source)
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (WW-3114) Work around getSystemClassloader call
for compatibility with GAE
Posted by "Leonard Broman (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/struts/browse/WW-3114?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=46224#action_46224 ]
Leonard Broman commented on WW-3114:
------------------------------------
As far as I know, it shouldn't. The patch only removes exclusion of system jars and java_home jars and shouldn't affect what you have found.
However, if it serves raw content from WEB-INF, that is a critical security issue!
> Work around getSystemClassloader call for compatibility with GAE
> ----------------------------------------------------------------
>
> Key: WW-3114
> URL: https://issues.apache.org/struts/browse/WW-3114
> Project: Struts 2
> Issue Type: Bug
> Components: Plugin - Convention
> Affects Versions: 2.1.7
> Reporter: Leonard Broman
> Assignee: Wes Wannemacher
> Fix For: 2.1.7
>
> Attachments: gae-patch.txt
>
>
> The Google App Engine sandbox does not allow application to access the system classloader using the ClassLoader.getSystemClassLoader() accessor. The convention plugin uses this to exclude urls to scan in PackageBasedActionConfigBuilder.java.
> Due to this, convention plugin is not functioning properly in the GAE sandbox.
> Stacktrace from app engine:
> com.opensymphony.xwork2.util.logging.jdk.JdkLogger error: Unable to scan named packages
> java.security.AccessControlException: access denied (java.lang.RuntimePermission getClassLoader)
> at java.security.AccessControlContext.checkPermission(Unknown Source)
> at java.security.AccessController.checkPermission(Unknown Source)
> at java.lang.SecurityManager.checkPermission(Unknown Source)
> at java.lang.ClassLoader.getSystemClassLoader(Unknown Source)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildUrlSet(PackageBasedActionConfigBuilder.java:324)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.findActions(PackageBasedActionConfigBuilder.java:295)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildActionConfigs(PackageBasedActionConfigBuilder.java:277)
> at org.apache.struts2.convention.ClasspathPackageProvider.loadPackages(ClasspathPackageProvider.java:52)
> at com.opensymphony.xwork2.config.impl.DefaultConfiguration.reloadContainer(DefaultConfiguration.java:200)
> at com.opensymphony.xwork2.config.ConfigurationManager.getConfiguration(ConfigurationManager.java:55)
> at org.apache.struts2.dispatcher.Dispatcher.init_PreloadConfiguration(Dispatcher.java:360)
> at org.apache.struts2.dispatcher.Dispatcher.init(Dispatcher.java:403)
> at org.apache.struts2.dispatcher.FilterDispatcher.init(FilterDispatcher.java:190)
> at org.mortbay.jetty.servlet.FilterHolder.doStart(FilterHolder.java:99)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at org.mortbay.jetty.servlet.ServletHandler.initialize(ServletHandler.java:589)
> at org.mortbay.jetty.servlet.Context.startContext(Context.java:139)
> at org.mortbay.jetty.webapp.WebAppContext.startContext(WebAppContext.java:1218)
> at org.mortbay.jetty.handler.ContextHandler.doStart(ContextHandler.java:500)
> at org.mortbay.jetty.webapp.WebAppContext.doStart(WebAppContext.java:448)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.createHandler(AppVersionHandlerMap.java:190)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.getHandler(AppVersionHandlerMap.java:167)
> at com.google.apphosting.runtime.jetty.JettyServletEngineAdapter.serviceRequest(JettyServletEngineAdapter.java:113)
> at com.google.apphosting.runtime.JavaRuntime.handleRequest(JavaRuntime.java:235)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4547)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4545)
> at com.google.net.rpc.impl.BlockingApplicationHandler.handleRequest(BlockingApplicationHandler.java:24)
> at com.google.net.rpc.impl.RpcUtil.runRpcInApplication(RpcUtil.java:359)
> at com.google.net.rpc.impl.Server$2.run(Server.java:792)
> at com.google.tracing.LocalTraceSpanRunnable.run(LocalTraceSpanRunnable.java:56)
> at com.google.tracing.LocalTraceSpanBuilder.internalContinueSpan(LocalTraceSpanBuilder.java:489)
> at com.google.net.rpc.impl.Server.startRpc(Server.java:748)
> at com.google.net.rpc.impl.Server.processRequest(Server.java:340)
> at com.google.net.rpc.impl.ServerConnection.messageReceived(ServerConnection.java:422)
> at com.google.net.rpc.impl.RpcConnection.parseMessages(RpcConnection.java:319)
> at com.google.net.rpc.impl.RpcConnection.dataReceived(RpcConnection.java:290)
> at com.google.net.async.Connection.handleReadEvent(Connection.java:419)
> at com.google.net.async.EventDispatcher.processNetworkEvents(EventDispatcher.java:733)
> at com.google.net.async.EventDispatcher.internalLoop(EventDispatcher.java:207)
> at com.google.net.async.EventDispatcher.loop(EventDispatcher.java:101)
> at com.google.net.rpc.RpcService.runUntilServerShutdown(RpcService.java:249)
> at com.google.apphosting.runtime.JavaRuntime$RpcRunnable.run(JavaRuntime.java:373)
> at java.lang.Thread.run(Unknown Source)
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (WW-3114) Work around getSystemClassloader call for
compatibility with GAE
Posted by "Leonard Broman (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/struts/browse/WW-3114?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Leonard Broman updated WW-3114:
-------------------------------
Attachment: gae-patch.txt
I've attached a patch which works around the problem. Whilst testing I found the next issue concerning the GAE sandbox limitations affecting the convention-plugin, it is also included.
This is tested in GAE and works for me. However, the solution is not nice and perhaps there is a way to detect the sandbox and avoid the try-catching business. I also cannot determine if it may cause unwanted urls to remain in the urlSet.
> Work around getSystemClassloader call for compatibility with GAE
> ----------------------------------------------------------------
>
> Key: WW-3114
> URL: https://issues.apache.org/struts/browse/WW-3114
> Project: Struts 2
> Issue Type: Improvement
> Components: Plugin - Convention
> Affects Versions: 2.1.7
> Reporter: Leonard Broman
> Attachments: gae-patch.txt
>
>
> The Google App Engine sandbox does not allow application to access the system classloader using the ClassLoader.getSystemClassLoader() accessor. The convention plugin uses this to exclude urls to scan in PackageBasedActionConfigBuilder.java.
> Due to this, convention plugin is not functioning properly in the GAE sandbox.
> Stacktrace from app engine:
> com.opensymphony.xwork2.util.logging.jdk.JdkLogger error: Unable to scan named packages
> java.security.AccessControlException: access denied (java.lang.RuntimePermission getClassLoader)
> at java.security.AccessControlContext.checkPermission(Unknown Source)
> at java.security.AccessController.checkPermission(Unknown Source)
> at java.lang.SecurityManager.checkPermission(Unknown Source)
> at java.lang.ClassLoader.getSystemClassLoader(Unknown Source)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildUrlSet(PackageBasedActionConfigBuilder.java:324)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.findActions(PackageBasedActionConfigBuilder.java:295)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildActionConfigs(PackageBasedActionConfigBuilder.java:277)
> at org.apache.struts2.convention.ClasspathPackageProvider.loadPackages(ClasspathPackageProvider.java:52)
> at com.opensymphony.xwork2.config.impl.DefaultConfiguration.reloadContainer(DefaultConfiguration.java:200)
> at com.opensymphony.xwork2.config.ConfigurationManager.getConfiguration(ConfigurationManager.java:55)
> at org.apache.struts2.dispatcher.Dispatcher.init_PreloadConfiguration(Dispatcher.java:360)
> at org.apache.struts2.dispatcher.Dispatcher.init(Dispatcher.java:403)
> at org.apache.struts2.dispatcher.FilterDispatcher.init(FilterDispatcher.java:190)
> at org.mortbay.jetty.servlet.FilterHolder.doStart(FilterHolder.java:99)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at org.mortbay.jetty.servlet.ServletHandler.initialize(ServletHandler.java:589)
> at org.mortbay.jetty.servlet.Context.startContext(Context.java:139)
> at org.mortbay.jetty.webapp.WebAppContext.startContext(WebAppContext.java:1218)
> at org.mortbay.jetty.handler.ContextHandler.doStart(ContextHandler.java:500)
> at org.mortbay.jetty.webapp.WebAppContext.doStart(WebAppContext.java:448)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.createHandler(AppVersionHandlerMap.java:190)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.getHandler(AppVersionHandlerMap.java:167)
> at com.google.apphosting.runtime.jetty.JettyServletEngineAdapter.serviceRequest(JettyServletEngineAdapter.java:113)
> at com.google.apphosting.runtime.JavaRuntime.handleRequest(JavaRuntime.java:235)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4547)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4545)
> at com.google.net.rpc.impl.BlockingApplicationHandler.handleRequest(BlockingApplicationHandler.java:24)
> at com.google.net.rpc.impl.RpcUtil.runRpcInApplication(RpcUtil.java:359)
> at com.google.net.rpc.impl.Server$2.run(Server.java:792)
> at com.google.tracing.LocalTraceSpanRunnable.run(LocalTraceSpanRunnable.java:56)
> at com.google.tracing.LocalTraceSpanBuilder.internalContinueSpan(LocalTraceSpanBuilder.java:489)
> at com.google.net.rpc.impl.Server.startRpc(Server.java:748)
> at com.google.net.rpc.impl.Server.processRequest(Server.java:340)
> at com.google.net.rpc.impl.ServerConnection.messageReceived(ServerConnection.java:422)
> at com.google.net.rpc.impl.RpcConnection.parseMessages(RpcConnection.java:319)
> at com.google.net.rpc.impl.RpcConnection.dataReceived(RpcConnection.java:290)
> at com.google.net.async.Connection.handleReadEvent(Connection.java:419)
> at com.google.net.async.EventDispatcher.processNetworkEvents(EventDispatcher.java:733)
> at com.google.net.async.EventDispatcher.internalLoop(EventDispatcher.java:207)
> at com.google.net.async.EventDispatcher.loop(EventDispatcher.java:101)
> at com.google.net.rpc.RpcService.runUntilServerShutdown(RpcService.java:249)
> at com.google.apphosting.runtime.JavaRuntime$RpcRunnable.run(JavaRuntime.java:373)
> at java.lang.Thread.run(Unknown Source)
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (WW-3114) Work around getSystemClassloader call
for compatibility with GAE
Posted by "Musachy Barroso (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/struts/browse/WW-3114?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=46228#action_46228 ]
Musachy Barroso commented on WW-3114:
-------------------------------------
Could you debug your app and set breakpoints in ConventionUnknownHandler, that's the class that handles the index files, maybe you will find the problem there.
> Work around getSystemClassloader call for compatibility with GAE
> ----------------------------------------------------------------
>
> Key: WW-3114
> URL: https://issues.apache.org/struts/browse/WW-3114
> Project: Struts 2
> Issue Type: Bug
> Components: Plugin - Convention
> Affects Versions: 2.1.7
> Reporter: Leonard Broman
> Assignee: Wes Wannemacher
> Fix For: 2.1.7
>
> Attachments: demonstrate-gae-security-hole.war, gae-patch.txt
>
>
> The Google App Engine sandbox does not allow application to access the system classloader using the ClassLoader.getSystemClassLoader() accessor. The convention plugin uses this to exclude urls to scan in PackageBasedActionConfigBuilder.java.
> Due to this, convention plugin is not functioning properly in the GAE sandbox.
> Stacktrace from app engine:
> com.opensymphony.xwork2.util.logging.jdk.JdkLogger error: Unable to scan named packages
> java.security.AccessControlException: access denied (java.lang.RuntimePermission getClassLoader)
> at java.security.AccessControlContext.checkPermission(Unknown Source)
> at java.security.AccessController.checkPermission(Unknown Source)
> at java.lang.SecurityManager.checkPermission(Unknown Source)
> at java.lang.ClassLoader.getSystemClassLoader(Unknown Source)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildUrlSet(PackageBasedActionConfigBuilder.java:324)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.findActions(PackageBasedActionConfigBuilder.java:295)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildActionConfigs(PackageBasedActionConfigBuilder.java:277)
> at org.apache.struts2.convention.ClasspathPackageProvider.loadPackages(ClasspathPackageProvider.java:52)
> at com.opensymphony.xwork2.config.impl.DefaultConfiguration.reloadContainer(DefaultConfiguration.java:200)
> at com.opensymphony.xwork2.config.ConfigurationManager.getConfiguration(ConfigurationManager.java:55)
> at org.apache.struts2.dispatcher.Dispatcher.init_PreloadConfiguration(Dispatcher.java:360)
> at org.apache.struts2.dispatcher.Dispatcher.init(Dispatcher.java:403)
> at org.apache.struts2.dispatcher.FilterDispatcher.init(FilterDispatcher.java:190)
> at org.mortbay.jetty.servlet.FilterHolder.doStart(FilterHolder.java:99)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at org.mortbay.jetty.servlet.ServletHandler.initialize(ServletHandler.java:589)
> at org.mortbay.jetty.servlet.Context.startContext(Context.java:139)
> at org.mortbay.jetty.webapp.WebAppContext.startContext(WebAppContext.java:1218)
> at org.mortbay.jetty.handler.ContextHandler.doStart(ContextHandler.java:500)
> at org.mortbay.jetty.webapp.WebAppContext.doStart(WebAppContext.java:448)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.createHandler(AppVersionHandlerMap.java:190)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.getHandler(AppVersionHandlerMap.java:167)
> at com.google.apphosting.runtime.jetty.JettyServletEngineAdapter.serviceRequest(JettyServletEngineAdapter.java:113)
> at com.google.apphosting.runtime.JavaRuntime.handleRequest(JavaRuntime.java:235)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4547)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4545)
> at com.google.net.rpc.impl.BlockingApplicationHandler.handleRequest(BlockingApplicationHandler.java:24)
> at com.google.net.rpc.impl.RpcUtil.runRpcInApplication(RpcUtil.java:359)
> at com.google.net.rpc.impl.Server$2.run(Server.java:792)
> at com.google.tracing.LocalTraceSpanRunnable.run(LocalTraceSpanRunnable.java:56)
> at com.google.tracing.LocalTraceSpanBuilder.internalContinueSpan(LocalTraceSpanBuilder.java:489)
> at com.google.net.rpc.impl.Server.startRpc(Server.java:748)
> at com.google.net.rpc.impl.Server.processRequest(Server.java:340)
> at com.google.net.rpc.impl.ServerConnection.messageReceived(ServerConnection.java:422)
> at com.google.net.rpc.impl.RpcConnection.parseMessages(RpcConnection.java:319)
> at com.google.net.rpc.impl.RpcConnection.dataReceived(RpcConnection.java:290)
> at com.google.net.async.Connection.handleReadEvent(Connection.java:419)
> at com.google.net.async.EventDispatcher.processNetworkEvents(EventDispatcher.java:733)
> at com.google.net.async.EventDispatcher.internalLoop(EventDispatcher.java:207)
> at com.google.net.async.EventDispatcher.loop(EventDispatcher.java:101)
> at com.google.net.rpc.RpcService.runUntilServerShutdown(RpcService.java:249)
> at com.google.apphosting.runtime.JavaRuntime$RpcRunnable.run(JavaRuntime.java:373)
> at java.lang.Thread.run(Unknown Source)
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (WW-3114) Work around getSystemClassloader call
for compatibility with GAE
Posted by "Musachy Barroso (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/struts/browse/WW-3114?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=46291#action_46291 ]
Musachy Barroso commented on WW-3114:
-------------------------------------
hum..it seems like convention is doing what is expected, and in the last case it is just finding the index.jsp and passing it along. I am quite confident that it is a GAE problem, but ti is hard to tell.
> Work around getSystemClassloader call for compatibility with GAE
> ----------------------------------------------------------------
>
> Key: WW-3114
> URL: https://issues.apache.org/struts/browse/WW-3114
> Project: Struts 2
> Issue Type: Bug
> Components: Plugin - Convention
> Affects Versions: 2.1.7
> Reporter: Leonard Broman
> Assignee: Wes Wannemacher
> Fix For: 2.1.7
>
> Attachments: demonstrate-gae-security-hole.war, gae-patch.txt
>
>
> The Google App Engine sandbox does not allow application to access the system classloader using the ClassLoader.getSystemClassLoader() accessor. The convention plugin uses this to exclude urls to scan in PackageBasedActionConfigBuilder.java.
> Due to this, convention plugin is not functioning properly in the GAE sandbox.
> Stacktrace from app engine:
> com.opensymphony.xwork2.util.logging.jdk.JdkLogger error: Unable to scan named packages
> java.security.AccessControlException: access denied (java.lang.RuntimePermission getClassLoader)
> at java.security.AccessControlContext.checkPermission(Unknown Source)
> at java.security.AccessController.checkPermission(Unknown Source)
> at java.lang.SecurityManager.checkPermission(Unknown Source)
> at java.lang.ClassLoader.getSystemClassLoader(Unknown Source)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildUrlSet(PackageBasedActionConfigBuilder.java:324)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.findActions(PackageBasedActionConfigBuilder.java:295)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildActionConfigs(PackageBasedActionConfigBuilder.java:277)
> at org.apache.struts2.convention.ClasspathPackageProvider.loadPackages(ClasspathPackageProvider.java:52)
> at com.opensymphony.xwork2.config.impl.DefaultConfiguration.reloadContainer(DefaultConfiguration.java:200)
> at com.opensymphony.xwork2.config.ConfigurationManager.getConfiguration(ConfigurationManager.java:55)
> at org.apache.struts2.dispatcher.Dispatcher.init_PreloadConfiguration(Dispatcher.java:360)
> at org.apache.struts2.dispatcher.Dispatcher.init(Dispatcher.java:403)
> at org.apache.struts2.dispatcher.FilterDispatcher.init(FilterDispatcher.java:190)
> at org.mortbay.jetty.servlet.FilterHolder.doStart(FilterHolder.java:99)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at org.mortbay.jetty.servlet.ServletHandler.initialize(ServletHandler.java:589)
> at org.mortbay.jetty.servlet.Context.startContext(Context.java:139)
> at org.mortbay.jetty.webapp.WebAppContext.startContext(WebAppContext.java:1218)
> at org.mortbay.jetty.handler.ContextHandler.doStart(ContextHandler.java:500)
> at org.mortbay.jetty.webapp.WebAppContext.doStart(WebAppContext.java:448)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.createHandler(AppVersionHandlerMap.java:190)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.getHandler(AppVersionHandlerMap.java:167)
> at com.google.apphosting.runtime.jetty.JettyServletEngineAdapter.serviceRequest(JettyServletEngineAdapter.java:113)
> at com.google.apphosting.runtime.JavaRuntime.handleRequest(JavaRuntime.java:235)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4547)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4545)
> at com.google.net.rpc.impl.BlockingApplicationHandler.handleRequest(BlockingApplicationHandler.java:24)
> at com.google.net.rpc.impl.RpcUtil.runRpcInApplication(RpcUtil.java:359)
> at com.google.net.rpc.impl.Server$2.run(Server.java:792)
> at com.google.tracing.LocalTraceSpanRunnable.run(LocalTraceSpanRunnable.java:56)
> at com.google.tracing.LocalTraceSpanBuilder.internalContinueSpan(LocalTraceSpanBuilder.java:489)
> at com.google.net.rpc.impl.Server.startRpc(Server.java:748)
> at com.google.net.rpc.impl.Server.processRequest(Server.java:340)
> at com.google.net.rpc.impl.ServerConnection.messageReceived(ServerConnection.java:422)
> at com.google.net.rpc.impl.RpcConnection.parseMessages(RpcConnection.java:319)
> at com.google.net.rpc.impl.RpcConnection.dataReceived(RpcConnection.java:290)
> at com.google.net.async.Connection.handleReadEvent(Connection.java:419)
> at com.google.net.async.EventDispatcher.processNetworkEvents(EventDispatcher.java:733)
> at com.google.net.async.EventDispatcher.internalLoop(EventDispatcher.java:207)
> at com.google.net.async.EventDispatcher.loop(EventDispatcher.java:101)
> at com.google.net.rpc.RpcService.runUntilServerShutdown(RpcService.java:249)
> at com.google.apphosting.runtime.JavaRuntime$RpcRunnable.run(JavaRuntime.java:373)
> at java.lang.Thread.run(Unknown Source)
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (WW-3114) Work around getSystemClassloader call
for compatibility with GAE
Posted by "Kent R. Spillner (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/struts/browse/WW-3114?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=46223#action_46223 ]
Kent R. Spillner commented on WW-3114:
--------------------------------------
Would this patch affect default actionless results for directories?
For example, assuming the following two .jsp files without any corresponding Action:
WEB-INF/content/index.jsp
WEB-INF/content/foo/index.jsp
The Convention plugin should create actionless results identified by the URLs:
http://id.appspot.com/
http://id.appspot.com/foo
http://id.appspot.com/foo/
... that render the corresponding .jsp file in response to requests to those URLs. But when deployed to Google AppEngine, the response to requests to those URLs is the raw source of the .jsp files served with content-type plain/text.
Everything works fine for the case where the .jsp file is not named index.jsp (i.e. with .jsp file WEB-INF/content/bar.jsp without any corresponding Action, requests to the URL http://id.appspot.com/bar correctly render the .jsp file, and the result is served with content-type text/html).
> Work around getSystemClassloader call for compatibility with GAE
> ----------------------------------------------------------------
>
> Key: WW-3114
> URL: https://issues.apache.org/struts/browse/WW-3114
> Project: Struts 2
> Issue Type: Bug
> Components: Plugin - Convention
> Affects Versions: 2.1.7
> Reporter: Leonard Broman
> Assignee: Wes Wannemacher
> Fix For: 2.1.7
>
> Attachments: gae-patch.txt
>
>
> The Google App Engine sandbox does not allow application to access the system classloader using the ClassLoader.getSystemClassLoader() accessor. The convention plugin uses this to exclude urls to scan in PackageBasedActionConfigBuilder.java.
> Due to this, convention plugin is not functioning properly in the GAE sandbox.
> Stacktrace from app engine:
> com.opensymphony.xwork2.util.logging.jdk.JdkLogger error: Unable to scan named packages
> java.security.AccessControlException: access denied (java.lang.RuntimePermission getClassLoader)
> at java.security.AccessControlContext.checkPermission(Unknown Source)
> at java.security.AccessController.checkPermission(Unknown Source)
> at java.lang.SecurityManager.checkPermission(Unknown Source)
> at java.lang.ClassLoader.getSystemClassLoader(Unknown Source)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildUrlSet(PackageBasedActionConfigBuilder.java:324)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.findActions(PackageBasedActionConfigBuilder.java:295)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildActionConfigs(PackageBasedActionConfigBuilder.java:277)
> at org.apache.struts2.convention.ClasspathPackageProvider.loadPackages(ClasspathPackageProvider.java:52)
> at com.opensymphony.xwork2.config.impl.DefaultConfiguration.reloadContainer(DefaultConfiguration.java:200)
> at com.opensymphony.xwork2.config.ConfigurationManager.getConfiguration(ConfigurationManager.java:55)
> at org.apache.struts2.dispatcher.Dispatcher.init_PreloadConfiguration(Dispatcher.java:360)
> at org.apache.struts2.dispatcher.Dispatcher.init(Dispatcher.java:403)
> at org.apache.struts2.dispatcher.FilterDispatcher.init(FilterDispatcher.java:190)
> at org.mortbay.jetty.servlet.FilterHolder.doStart(FilterHolder.java:99)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at org.mortbay.jetty.servlet.ServletHandler.initialize(ServletHandler.java:589)
> at org.mortbay.jetty.servlet.Context.startContext(Context.java:139)
> at org.mortbay.jetty.webapp.WebAppContext.startContext(WebAppContext.java:1218)
> at org.mortbay.jetty.handler.ContextHandler.doStart(ContextHandler.java:500)
> at org.mortbay.jetty.webapp.WebAppContext.doStart(WebAppContext.java:448)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.createHandler(AppVersionHandlerMap.java:190)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.getHandler(AppVersionHandlerMap.java:167)
> at com.google.apphosting.runtime.jetty.JettyServletEngineAdapter.serviceRequest(JettyServletEngineAdapter.java:113)
> at com.google.apphosting.runtime.JavaRuntime.handleRequest(JavaRuntime.java:235)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4547)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4545)
> at com.google.net.rpc.impl.BlockingApplicationHandler.handleRequest(BlockingApplicationHandler.java:24)
> at com.google.net.rpc.impl.RpcUtil.runRpcInApplication(RpcUtil.java:359)
> at com.google.net.rpc.impl.Server$2.run(Server.java:792)
> at com.google.tracing.LocalTraceSpanRunnable.run(LocalTraceSpanRunnable.java:56)
> at com.google.tracing.LocalTraceSpanBuilder.internalContinueSpan(LocalTraceSpanBuilder.java:489)
> at com.google.net.rpc.impl.Server.startRpc(Server.java:748)
> at com.google.net.rpc.impl.Server.processRequest(Server.java:340)
> at com.google.net.rpc.impl.ServerConnection.messageReceived(ServerConnection.java:422)
> at com.google.net.rpc.impl.RpcConnection.parseMessages(RpcConnection.java:319)
> at com.google.net.rpc.impl.RpcConnection.dataReceived(RpcConnection.java:290)
> at com.google.net.async.Connection.handleReadEvent(Connection.java:419)
> at com.google.net.async.EventDispatcher.processNetworkEvents(EventDispatcher.java:733)
> at com.google.net.async.EventDispatcher.internalLoop(EventDispatcher.java:207)
> at com.google.net.async.EventDispatcher.loop(EventDispatcher.java:101)
> at com.google.net.rpc.RpcService.runUntilServerShutdown(RpcService.java:249)
> at com.google.apphosting.runtime.JavaRuntime$RpcRunnable.run(JavaRuntime.java:373)
> at java.lang.Thread.run(Unknown Source)
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (WW-3114) Work around getSystemClassloader call
for compatibility with GAE
Posted by "Kent R. Spillner (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/struts/browse/WW-3114?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=46236#action_46236 ]
Kent R. Spillner commented on WW-3114:
--------------------------------------
Hi, Musachy-
It does work locally, but I don't put much stock in that because the local dev_server is very flaky; plenty of other things don't work as expected locally, but run just fine when you deploy to AppEngine. Ah, the joys of targeting beta platforms. :)
I know it "feels" like an AppEngine bug, but then how does AppEngine know to map the contents of WEB-INF/content/index.jsp to requests for /? Isn't the Convention plugin the only component that knows how to map .jsp files in WEB-INF/content/ to request URLs? And if AppEngine is somehow bypassing all of Struts2 to serve the raw source of that .jsp file as plain/text, why does the problem go away when I provide a struts.xml file that explicitly configures an action named "" -- with explicit code behind that action -- in the root package?
Anyways, I appreciate you're looking into it!
Best,
Kent
> Work around getSystemClassloader call for compatibility with GAE
> ----------------------------------------------------------------
>
> Key: WW-3114
> URL: https://issues.apache.org/struts/browse/WW-3114
> Project: Struts 2
> Issue Type: Bug
> Components: Plugin - Convention
> Affects Versions: 2.1.7
> Reporter: Leonard Broman
> Assignee: Wes Wannemacher
> Fix For: 2.1.7
>
> Attachments: demonstrate-gae-security-hole.war, gae-patch.txt
>
>
> The Google App Engine sandbox does not allow application to access the system classloader using the ClassLoader.getSystemClassLoader() accessor. The convention plugin uses this to exclude urls to scan in PackageBasedActionConfigBuilder.java.
> Due to this, convention plugin is not functioning properly in the GAE sandbox.
> Stacktrace from app engine:
> com.opensymphony.xwork2.util.logging.jdk.JdkLogger error: Unable to scan named packages
> java.security.AccessControlException: access denied (java.lang.RuntimePermission getClassLoader)
> at java.security.AccessControlContext.checkPermission(Unknown Source)
> at java.security.AccessController.checkPermission(Unknown Source)
> at java.lang.SecurityManager.checkPermission(Unknown Source)
> at java.lang.ClassLoader.getSystemClassLoader(Unknown Source)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildUrlSet(PackageBasedActionConfigBuilder.java:324)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.findActions(PackageBasedActionConfigBuilder.java:295)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildActionConfigs(PackageBasedActionConfigBuilder.java:277)
> at org.apache.struts2.convention.ClasspathPackageProvider.loadPackages(ClasspathPackageProvider.java:52)
> at com.opensymphony.xwork2.config.impl.DefaultConfiguration.reloadContainer(DefaultConfiguration.java:200)
> at com.opensymphony.xwork2.config.ConfigurationManager.getConfiguration(ConfigurationManager.java:55)
> at org.apache.struts2.dispatcher.Dispatcher.init_PreloadConfiguration(Dispatcher.java:360)
> at org.apache.struts2.dispatcher.Dispatcher.init(Dispatcher.java:403)
> at org.apache.struts2.dispatcher.FilterDispatcher.init(FilterDispatcher.java:190)
> at org.mortbay.jetty.servlet.FilterHolder.doStart(FilterHolder.java:99)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at org.mortbay.jetty.servlet.ServletHandler.initialize(ServletHandler.java:589)
> at org.mortbay.jetty.servlet.Context.startContext(Context.java:139)
> at org.mortbay.jetty.webapp.WebAppContext.startContext(WebAppContext.java:1218)
> at org.mortbay.jetty.handler.ContextHandler.doStart(ContextHandler.java:500)
> at org.mortbay.jetty.webapp.WebAppContext.doStart(WebAppContext.java:448)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.createHandler(AppVersionHandlerMap.java:190)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.getHandler(AppVersionHandlerMap.java:167)
> at com.google.apphosting.runtime.jetty.JettyServletEngineAdapter.serviceRequest(JettyServletEngineAdapter.java:113)
> at com.google.apphosting.runtime.JavaRuntime.handleRequest(JavaRuntime.java:235)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4547)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4545)
> at com.google.net.rpc.impl.BlockingApplicationHandler.handleRequest(BlockingApplicationHandler.java:24)
> at com.google.net.rpc.impl.RpcUtil.runRpcInApplication(RpcUtil.java:359)
> at com.google.net.rpc.impl.Server$2.run(Server.java:792)
> at com.google.tracing.LocalTraceSpanRunnable.run(LocalTraceSpanRunnable.java:56)
> at com.google.tracing.LocalTraceSpanBuilder.internalContinueSpan(LocalTraceSpanBuilder.java:489)
> at com.google.net.rpc.impl.Server.startRpc(Server.java:748)
> at com.google.net.rpc.impl.Server.processRequest(Server.java:340)
> at com.google.net.rpc.impl.ServerConnection.messageReceived(ServerConnection.java:422)
> at com.google.net.rpc.impl.RpcConnection.parseMessages(RpcConnection.java:319)
> at com.google.net.rpc.impl.RpcConnection.dataReceived(RpcConnection.java:290)
> at com.google.net.async.Connection.handleReadEvent(Connection.java:419)
> at com.google.net.async.EventDispatcher.processNetworkEvents(EventDispatcher.java:733)
> at com.google.net.async.EventDispatcher.internalLoop(EventDispatcher.java:207)
> at com.google.net.async.EventDispatcher.loop(EventDispatcher.java:101)
> at com.google.net.rpc.RpcService.runUntilServerShutdown(RpcService.java:249)
> at com.google.apphosting.runtime.JavaRuntime$RpcRunnable.run(JavaRuntime.java:373)
> at java.lang.Thread.run(Unknown Source)
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (WW-3114) Work around getSystemClassloader call
for compatibility with GAE
Posted by "Musachy Barroso (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/struts/browse/WW-3114?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=46237#action_46237 ]
Musachy Barroso commented on WW-3114:
-------------------------------------
I totally agree with you Kent. Convention will not only pickup index.jsp, but the other supported extensions also (like ftl, vm), a quick test would be to rename index.jsp to index.ftl. If the file doesn't get served, then we know it is GAE the one messing this up. If it does, then we still don't know for sure, but we are getting closer :)
> Work around getSystemClassloader call for compatibility with GAE
> ----------------------------------------------------------------
>
> Key: WW-3114
> URL: https://issues.apache.org/struts/browse/WW-3114
> Project: Struts 2
> Issue Type: Bug
> Components: Plugin - Convention
> Affects Versions: 2.1.7
> Reporter: Leonard Broman
> Assignee: Wes Wannemacher
> Fix For: 2.1.7
>
> Attachments: demonstrate-gae-security-hole.war, gae-patch.txt
>
>
> The Google App Engine sandbox does not allow application to access the system classloader using the ClassLoader.getSystemClassLoader() accessor. The convention plugin uses this to exclude urls to scan in PackageBasedActionConfigBuilder.java.
> Due to this, convention plugin is not functioning properly in the GAE sandbox.
> Stacktrace from app engine:
> com.opensymphony.xwork2.util.logging.jdk.JdkLogger error: Unable to scan named packages
> java.security.AccessControlException: access denied (java.lang.RuntimePermission getClassLoader)
> at java.security.AccessControlContext.checkPermission(Unknown Source)
> at java.security.AccessController.checkPermission(Unknown Source)
> at java.lang.SecurityManager.checkPermission(Unknown Source)
> at java.lang.ClassLoader.getSystemClassLoader(Unknown Source)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildUrlSet(PackageBasedActionConfigBuilder.java:324)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.findActions(PackageBasedActionConfigBuilder.java:295)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildActionConfigs(PackageBasedActionConfigBuilder.java:277)
> at org.apache.struts2.convention.ClasspathPackageProvider.loadPackages(ClasspathPackageProvider.java:52)
> at com.opensymphony.xwork2.config.impl.DefaultConfiguration.reloadContainer(DefaultConfiguration.java:200)
> at com.opensymphony.xwork2.config.ConfigurationManager.getConfiguration(ConfigurationManager.java:55)
> at org.apache.struts2.dispatcher.Dispatcher.init_PreloadConfiguration(Dispatcher.java:360)
> at org.apache.struts2.dispatcher.Dispatcher.init(Dispatcher.java:403)
> at org.apache.struts2.dispatcher.FilterDispatcher.init(FilterDispatcher.java:190)
> at org.mortbay.jetty.servlet.FilterHolder.doStart(FilterHolder.java:99)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at org.mortbay.jetty.servlet.ServletHandler.initialize(ServletHandler.java:589)
> at org.mortbay.jetty.servlet.Context.startContext(Context.java:139)
> at org.mortbay.jetty.webapp.WebAppContext.startContext(WebAppContext.java:1218)
> at org.mortbay.jetty.handler.ContextHandler.doStart(ContextHandler.java:500)
> at org.mortbay.jetty.webapp.WebAppContext.doStart(WebAppContext.java:448)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.createHandler(AppVersionHandlerMap.java:190)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.getHandler(AppVersionHandlerMap.java:167)
> at com.google.apphosting.runtime.jetty.JettyServletEngineAdapter.serviceRequest(JettyServletEngineAdapter.java:113)
> at com.google.apphosting.runtime.JavaRuntime.handleRequest(JavaRuntime.java:235)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4547)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4545)
> at com.google.net.rpc.impl.BlockingApplicationHandler.handleRequest(BlockingApplicationHandler.java:24)
> at com.google.net.rpc.impl.RpcUtil.runRpcInApplication(RpcUtil.java:359)
> at com.google.net.rpc.impl.Server$2.run(Server.java:792)
> at com.google.tracing.LocalTraceSpanRunnable.run(LocalTraceSpanRunnable.java:56)
> at com.google.tracing.LocalTraceSpanBuilder.internalContinueSpan(LocalTraceSpanBuilder.java:489)
> at com.google.net.rpc.impl.Server.startRpc(Server.java:748)
> at com.google.net.rpc.impl.Server.processRequest(Server.java:340)
> at com.google.net.rpc.impl.ServerConnection.messageReceived(ServerConnection.java:422)
> at com.google.net.rpc.impl.RpcConnection.parseMessages(RpcConnection.java:319)
> at com.google.net.rpc.impl.RpcConnection.dataReceived(RpcConnection.java:290)
> at com.google.net.async.Connection.handleReadEvent(Connection.java:419)
> at com.google.net.async.EventDispatcher.processNetworkEvents(EventDispatcher.java:733)
> at com.google.net.async.EventDispatcher.internalLoop(EventDispatcher.java:207)
> at com.google.net.async.EventDispatcher.loop(EventDispatcher.java:101)
> at com.google.net.rpc.RpcService.runUntilServerShutdown(RpcService.java:249)
> at com.google.apphosting.runtime.JavaRuntime$RpcRunnable.run(JavaRuntime.java:373)
> at java.lang.Thread.run(Unknown Source)
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (WW-3114) Work around getSystemClassloader call
for compatibility with GAE
Posted by "Musachy Barroso (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/struts/browse/WW-3114?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=46230#action_46230 ]
Musachy Barroso commented on WW-3114:
-------------------------------------
Does it do the same when you try it locally? There is a way to run the app locally right? Sorry I can't help more, I just played with GAE once for a few minutes :)
> Work around getSystemClassloader call for compatibility with GAE
> ----------------------------------------------------------------
>
> Key: WW-3114
> URL: https://issues.apache.org/struts/browse/WW-3114
> Project: Struts 2
> Issue Type: Bug
> Components: Plugin - Convention
> Affects Versions: 2.1.7
> Reporter: Leonard Broman
> Assignee: Wes Wannemacher
> Fix For: 2.1.7
>
> Attachments: demonstrate-gae-security-hole.war, gae-patch.txt
>
>
> The Google App Engine sandbox does not allow application to access the system classloader using the ClassLoader.getSystemClassLoader() accessor. The convention plugin uses this to exclude urls to scan in PackageBasedActionConfigBuilder.java.
> Due to this, convention plugin is not functioning properly in the GAE sandbox.
> Stacktrace from app engine:
> com.opensymphony.xwork2.util.logging.jdk.JdkLogger error: Unable to scan named packages
> java.security.AccessControlException: access denied (java.lang.RuntimePermission getClassLoader)
> at java.security.AccessControlContext.checkPermission(Unknown Source)
> at java.security.AccessController.checkPermission(Unknown Source)
> at java.lang.SecurityManager.checkPermission(Unknown Source)
> at java.lang.ClassLoader.getSystemClassLoader(Unknown Source)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildUrlSet(PackageBasedActionConfigBuilder.java:324)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.findActions(PackageBasedActionConfigBuilder.java:295)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildActionConfigs(PackageBasedActionConfigBuilder.java:277)
> at org.apache.struts2.convention.ClasspathPackageProvider.loadPackages(ClasspathPackageProvider.java:52)
> at com.opensymphony.xwork2.config.impl.DefaultConfiguration.reloadContainer(DefaultConfiguration.java:200)
> at com.opensymphony.xwork2.config.ConfigurationManager.getConfiguration(ConfigurationManager.java:55)
> at org.apache.struts2.dispatcher.Dispatcher.init_PreloadConfiguration(Dispatcher.java:360)
> at org.apache.struts2.dispatcher.Dispatcher.init(Dispatcher.java:403)
> at org.apache.struts2.dispatcher.FilterDispatcher.init(FilterDispatcher.java:190)
> at org.mortbay.jetty.servlet.FilterHolder.doStart(FilterHolder.java:99)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at org.mortbay.jetty.servlet.ServletHandler.initialize(ServletHandler.java:589)
> at org.mortbay.jetty.servlet.Context.startContext(Context.java:139)
> at org.mortbay.jetty.webapp.WebAppContext.startContext(WebAppContext.java:1218)
> at org.mortbay.jetty.handler.ContextHandler.doStart(ContextHandler.java:500)
> at org.mortbay.jetty.webapp.WebAppContext.doStart(WebAppContext.java:448)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.createHandler(AppVersionHandlerMap.java:190)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.getHandler(AppVersionHandlerMap.java:167)
> at com.google.apphosting.runtime.jetty.JettyServletEngineAdapter.serviceRequest(JettyServletEngineAdapter.java:113)
> at com.google.apphosting.runtime.JavaRuntime.handleRequest(JavaRuntime.java:235)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4547)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4545)
> at com.google.net.rpc.impl.BlockingApplicationHandler.handleRequest(BlockingApplicationHandler.java:24)
> at com.google.net.rpc.impl.RpcUtil.runRpcInApplication(RpcUtil.java:359)
> at com.google.net.rpc.impl.Server$2.run(Server.java:792)
> at com.google.tracing.LocalTraceSpanRunnable.run(LocalTraceSpanRunnable.java:56)
> at com.google.tracing.LocalTraceSpanBuilder.internalContinueSpan(LocalTraceSpanBuilder.java:489)
> at com.google.net.rpc.impl.Server.startRpc(Server.java:748)
> at com.google.net.rpc.impl.Server.processRequest(Server.java:340)
> at com.google.net.rpc.impl.ServerConnection.messageReceived(ServerConnection.java:422)
> at com.google.net.rpc.impl.RpcConnection.parseMessages(RpcConnection.java:319)
> at com.google.net.rpc.impl.RpcConnection.dataReceived(RpcConnection.java:290)
> at com.google.net.async.Connection.handleReadEvent(Connection.java:419)
> at com.google.net.async.EventDispatcher.processNetworkEvents(EventDispatcher.java:733)
> at com.google.net.async.EventDispatcher.internalLoop(EventDispatcher.java:207)
> at com.google.net.async.EventDispatcher.loop(EventDispatcher.java:101)
> at com.google.net.rpc.RpcService.runUntilServerShutdown(RpcService.java:249)
> at com.google.apphosting.runtime.JavaRuntime$RpcRunnable.run(JavaRuntime.java:373)
> at java.lang.Thread.run(Unknown Source)
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (WW-3114) Work around getSystemClassloader call
for compatibility with GAE
Posted by "Musachy Barroso (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/struts/browse/WW-3114?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=46238#action_46238 ]
Musachy Barroso commented on WW-3114:
-------------------------------------
one more thing, the convention plugin can generate very verbose logs, can you try setting the log level to TRACE for org.apache.struts2.convention and posting here? We will know for sure if it is convention or not (why didnt I say this before?)
> Work around getSystemClassloader call for compatibility with GAE
> ----------------------------------------------------------------
>
> Key: WW-3114
> URL: https://issues.apache.org/struts/browse/WW-3114
> Project: Struts 2
> Issue Type: Bug
> Components: Plugin - Convention
> Affects Versions: 2.1.7
> Reporter: Leonard Broman
> Assignee: Wes Wannemacher
> Fix For: 2.1.7
>
> Attachments: demonstrate-gae-security-hole.war, gae-patch.txt
>
>
> The Google App Engine sandbox does not allow application to access the system classloader using the ClassLoader.getSystemClassLoader() accessor. The convention plugin uses this to exclude urls to scan in PackageBasedActionConfigBuilder.java.
> Due to this, convention plugin is not functioning properly in the GAE sandbox.
> Stacktrace from app engine:
> com.opensymphony.xwork2.util.logging.jdk.JdkLogger error: Unable to scan named packages
> java.security.AccessControlException: access denied (java.lang.RuntimePermission getClassLoader)
> at java.security.AccessControlContext.checkPermission(Unknown Source)
> at java.security.AccessController.checkPermission(Unknown Source)
> at java.lang.SecurityManager.checkPermission(Unknown Source)
> at java.lang.ClassLoader.getSystemClassLoader(Unknown Source)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildUrlSet(PackageBasedActionConfigBuilder.java:324)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.findActions(PackageBasedActionConfigBuilder.java:295)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildActionConfigs(PackageBasedActionConfigBuilder.java:277)
> at org.apache.struts2.convention.ClasspathPackageProvider.loadPackages(ClasspathPackageProvider.java:52)
> at com.opensymphony.xwork2.config.impl.DefaultConfiguration.reloadContainer(DefaultConfiguration.java:200)
> at com.opensymphony.xwork2.config.ConfigurationManager.getConfiguration(ConfigurationManager.java:55)
> at org.apache.struts2.dispatcher.Dispatcher.init_PreloadConfiguration(Dispatcher.java:360)
> at org.apache.struts2.dispatcher.Dispatcher.init(Dispatcher.java:403)
> at org.apache.struts2.dispatcher.FilterDispatcher.init(FilterDispatcher.java:190)
> at org.mortbay.jetty.servlet.FilterHolder.doStart(FilterHolder.java:99)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at org.mortbay.jetty.servlet.ServletHandler.initialize(ServletHandler.java:589)
> at org.mortbay.jetty.servlet.Context.startContext(Context.java:139)
> at org.mortbay.jetty.webapp.WebAppContext.startContext(WebAppContext.java:1218)
> at org.mortbay.jetty.handler.ContextHandler.doStart(ContextHandler.java:500)
> at org.mortbay.jetty.webapp.WebAppContext.doStart(WebAppContext.java:448)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.createHandler(AppVersionHandlerMap.java:190)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.getHandler(AppVersionHandlerMap.java:167)
> at com.google.apphosting.runtime.jetty.JettyServletEngineAdapter.serviceRequest(JettyServletEngineAdapter.java:113)
> at com.google.apphosting.runtime.JavaRuntime.handleRequest(JavaRuntime.java:235)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4547)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4545)
> at com.google.net.rpc.impl.BlockingApplicationHandler.handleRequest(BlockingApplicationHandler.java:24)
> at com.google.net.rpc.impl.RpcUtil.runRpcInApplication(RpcUtil.java:359)
> at com.google.net.rpc.impl.Server$2.run(Server.java:792)
> at com.google.tracing.LocalTraceSpanRunnable.run(LocalTraceSpanRunnable.java:56)
> at com.google.tracing.LocalTraceSpanBuilder.internalContinueSpan(LocalTraceSpanBuilder.java:489)
> at com.google.net.rpc.impl.Server.startRpc(Server.java:748)
> at com.google.net.rpc.impl.Server.processRequest(Server.java:340)
> at com.google.net.rpc.impl.ServerConnection.messageReceived(ServerConnection.java:422)
> at com.google.net.rpc.impl.RpcConnection.parseMessages(RpcConnection.java:319)
> at com.google.net.rpc.impl.RpcConnection.dataReceived(RpcConnection.java:290)
> at com.google.net.async.Connection.handleReadEvent(Connection.java:419)
> at com.google.net.async.EventDispatcher.processNetworkEvents(EventDispatcher.java:733)
> at com.google.net.async.EventDispatcher.internalLoop(EventDispatcher.java:207)
> at com.google.net.async.EventDispatcher.loop(EventDispatcher.java:101)
> at com.google.net.rpc.RpcService.runUntilServerShutdown(RpcService.java:249)
> at com.google.apphosting.runtime.JavaRuntime$RpcRunnable.run(JavaRuntime.java:373)
> at java.lang.Thread.run(Unknown Source)
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (WW-3114) Work around getSystemClassloader call
for compatibility with GAE
Posted by "Kent R. Spillner (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/struts/browse/WW-3114?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=46226#action_46226 ]
Kent R. Spillner commented on WW-3114:
--------------------------------------
Hi, Leonard-
Thanks for the information!
I'm not sure if it is an issue with the Convention plugin or Google AppEngine itself, but I completely agree with you: it is a pretty glaring security hole.
I'm not sure how big the problem is in scope, either. I have only noticed this behavior with JSPs; I have not tested with other result types. Also, I think it only occurs for default actionless results named "index" that are served in response to request URLs that match the directory structure of the Convention plugin's result path; I have not seen the raw source of other results served as plain/text. Finally, I haven't tested what happens if you provide code behind the action, i.e. create corresponding IndexAction classes.
Best,
Kent
> Work around getSystemClassloader call for compatibility with GAE
> ----------------------------------------------------------------
>
> Key: WW-3114
> URL: https://issues.apache.org/struts/browse/WW-3114
> Project: Struts 2
> Issue Type: Bug
> Components: Plugin - Convention
> Affects Versions: 2.1.7
> Reporter: Leonard Broman
> Assignee: Wes Wannemacher
> Fix For: 2.1.7
>
> Attachments: demonstrate-gae-security-hole.war, gae-patch.txt
>
>
> The Google App Engine sandbox does not allow application to access the system classloader using the ClassLoader.getSystemClassLoader() accessor. The convention plugin uses this to exclude urls to scan in PackageBasedActionConfigBuilder.java.
> Due to this, convention plugin is not functioning properly in the GAE sandbox.
> Stacktrace from app engine:
> com.opensymphony.xwork2.util.logging.jdk.JdkLogger error: Unable to scan named packages
> java.security.AccessControlException: access denied (java.lang.RuntimePermission getClassLoader)
> at java.security.AccessControlContext.checkPermission(Unknown Source)
> at java.security.AccessController.checkPermission(Unknown Source)
> at java.lang.SecurityManager.checkPermission(Unknown Source)
> at java.lang.ClassLoader.getSystemClassLoader(Unknown Source)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildUrlSet(PackageBasedActionConfigBuilder.java:324)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.findActions(PackageBasedActionConfigBuilder.java:295)
> at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildActionConfigs(PackageBasedActionConfigBuilder.java:277)
> at org.apache.struts2.convention.ClasspathPackageProvider.loadPackages(ClasspathPackageProvider.java:52)
> at com.opensymphony.xwork2.config.impl.DefaultConfiguration.reloadContainer(DefaultConfiguration.java:200)
> at com.opensymphony.xwork2.config.ConfigurationManager.getConfiguration(ConfigurationManager.java:55)
> at org.apache.struts2.dispatcher.Dispatcher.init_PreloadConfiguration(Dispatcher.java:360)
> at org.apache.struts2.dispatcher.Dispatcher.init(Dispatcher.java:403)
> at org.apache.struts2.dispatcher.FilterDispatcher.init(FilterDispatcher.java:190)
> at org.mortbay.jetty.servlet.FilterHolder.doStart(FilterHolder.java:99)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at org.mortbay.jetty.servlet.ServletHandler.initialize(ServletHandler.java:589)
> at org.mortbay.jetty.servlet.Context.startContext(Context.java:139)
> at org.mortbay.jetty.webapp.WebAppContext.startContext(WebAppContext.java:1218)
> at org.mortbay.jetty.handler.ContextHandler.doStart(ContextHandler.java:500)
> at org.mortbay.jetty.webapp.WebAppContext.doStart(WebAppContext.java:448)
> at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:40)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.createHandler(AppVersionHandlerMap.java:190)
> at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.getHandler(AppVersionHandlerMap.java:167)
> at com.google.apphosting.runtime.jetty.JettyServletEngineAdapter.serviceRequest(JettyServletEngineAdapter.java:113)
> at com.google.apphosting.runtime.JavaRuntime.handleRequest(JavaRuntime.java:235)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4547)
> at com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4545)
> at com.google.net.rpc.impl.BlockingApplicationHandler.handleRequest(BlockingApplicationHandler.java:24)
> at com.google.net.rpc.impl.RpcUtil.runRpcInApplication(RpcUtil.java:359)
> at com.google.net.rpc.impl.Server$2.run(Server.java:792)
> at com.google.tracing.LocalTraceSpanRunnable.run(LocalTraceSpanRunnable.java:56)
> at com.google.tracing.LocalTraceSpanBuilder.internalContinueSpan(LocalTraceSpanBuilder.java:489)
> at com.google.net.rpc.impl.Server.startRpc(Server.java:748)
> at com.google.net.rpc.impl.Server.processRequest(Server.java:340)
> at com.google.net.rpc.impl.ServerConnection.messageReceived(ServerConnection.java:422)
> at com.google.net.rpc.impl.RpcConnection.parseMessages(RpcConnection.java:319)
> at com.google.net.rpc.impl.RpcConnection.dataReceived(RpcConnection.java:290)
> at com.google.net.async.Connection.handleReadEvent(Connection.java:419)
> at com.google.net.async.EventDispatcher.processNetworkEvents(EventDispatcher.java:733)
> at com.google.net.async.EventDispatcher.internalLoop(EventDispatcher.java:207)
> at com.google.net.async.EventDispatcher.loop(EventDispatcher.java:101)
> at com.google.net.rpc.RpcService.runUntilServerShutdown(RpcService.java:249)
> at com.google.apphosting.runtime.JavaRuntime$RpcRunnable.run(JavaRuntime.java:373)
> at java.lang.Thread.run(Unknown Source)
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.