You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@camel.apache.org by albundy <y....@gmail.com> on 2017/06/27 17:07:39 UTC

Classloader error - org.apache.xerces.util.SecurityManager not found

I am getting an error when I bootstrap Camel to a generic HttpServlet using
the CamelServletContextListener. It's a simplstic no-Spring no-Maven set up
with a route defined in an XML file.

The WAR file is deployed to Weblogic app server and I see this error in the
server log when Camel context starts up. Everything seems to work after the
context is started though.

13:16:13.210 [[STANDBY] ExecuteThread: '21' for queue:
'weblogic.kernel.Default (self-tuning)'] TRACE
org.apache.camel.util.ObjectHelper - Loading class:
org.apache.xerces.util.SecurityManager using classloader:
weblogic.utils.classloaders.ChangeAwareClassLoader@10546ac6 finder:
weblogic.utils.classloaders.CodeGenClassFinder@452e887f annotation:
MTXRefWorkflow@RefCamelWorkflow
13:16:13.210 [[STANDBY] ExecuteThread: '21' for queue:
'weblogic.kernel.Default (self-tuning)'] TRACE
org.apache.camel.util.ObjectHelper - Cannot load class:
org.apache.xerces.util.SecurityManager using classloader:
weblogic.utils.classloaders.ChangeAwareClassLoader@10546ac6 finder:
weblogic.utils.classloaders.CodeGenClassFinder@452e887f annotation:
MTXRefWorkflow@RefCamelWorkflow
java.lang.ClassNotFoundException: org.apache.xerces.util.SecurityManager
	at
weblogic.utils.classloaders.GenericClassLoader.findLocalClass(GenericClassLoader.java:1026)
~[com.bea.core.utils.classloaders.jar:12.2.1.2]
	at
weblogic.utils.classloaders.GenericClassLoader.findClass(GenericClassLoader.java:987)
~[com.bea.core.utils.classloaders.jar:12.2.1.2]
	at
weblogic.utils.classloaders.ChangeAwareClassLoader.findClass(ChangeAwareClassLoader.java:83)
~[com.bea.core.utils.classloaders.jar:12.2.1.2]
	at
weblogic.utils.classloaders.GenericClassLoader.doFindClass(GenericClassLoader.java:608)
~[com.bea.core.utils.classloaders.jar:12.2.1.2]
	at
weblogic.utils.classloaders.GenericClassLoader.loadClass(GenericClassLoader.java:540)
~[com.bea.core.utils.classloaders.jar:12.2.1.2]
	at
weblogic.utils.classloaders.GenericClassLoader.loadClass(GenericClassLoader.java:493)
~[com.bea.core.utils.classloaders.jar:12.2.1.2]
	at
weblogic.utils.classloaders.GenericClassLoader.loadClass(GenericClassLoader.java:470)
~[com.bea.core.utils.classloaders.jar:12.2.1.2]
	at
weblogic.utils.classloaders.ChangeAwareClassLoader.loadClass(ChangeAwareClassLoader.java:53)
~[com.bea.core.utils.classloaders.jar:12.2.1.2]
	at org.apache.camel.util.ObjectHelper.doLoadClass(ObjectHelper.java:1182)
[camel-core-2.19.0.jar:2.19.0]
	at org.apache.camel.util.ObjectHelper.loadClass(ObjectHelper.java:1086)
[camel-core-2.19.0.jar:2.19.0]
	at org.apache.camel.util.ObjectHelper.loadClass(ObjectHelper.java:1063)
[camel-core-2.19.0.jar:2.19.0]
	at org.apache.camel.util.ObjectHelper.loadClass(ObjectHelper.java:1051)
[camel-core-2.19.0.jar:2.19.0]
	at
org.apache.camel.converter.jaxp.XmlConverter.createDocumentBuilderFactory(XmlConverter.java:1136)
[camel-core-2.19.0.jar:2.19.0]
	at
org.apache.camel.converter.jaxp.XmlConverter.getDocumentBuilderFactory(XmlConverter.java:1054)
[camel-core-2.19.0.jar:2.19.0]
	at
org.apache.camel.converter.jaxp.XmlConverter.getDocumentBuilderFactory(XmlConverter.java:1111)
[camel-core-2.19.0.jar:2.19.0]
	at
org.apache.camel.converter.jaxp.XmlConverter.toDOMDocument(XmlConverter.java:866)
[camel-core-2.19.0.jar:2.19.0]
	at
org.apache.camel.model.ModelHelper.loadRoutesDefinition(ModelHelper.java:149)
[camel-core-2.19.0.jar:2.19.0]
	...
	
I found a fix for CAMEL-7713 and looks like it always tries to load
org.apache.xerces.util.SecurityManager. 

// setup the SecurityManager by default if it's apache xerces
        try {
            Class<?> smClass =
ObjectHelper.loadClass("org.apache.xerces.util.SecurityManager");
            if (smClass != null) {
                Object sm = smClass.newInstance();
                // Here we just use the default setting of the
SeurityManager
               
factory.setAttribute("http://apache.org/xml/properties/security-manager",
sm);
            }
        } catch (Exception e) {
            LOG.warn("DocumentBuilderFactory doesn't support the attribute
{}, due to {}.",
                     new
Object[]{"http://apache.org/xml/properties/security-manager", e});
        }
        
 I understand that Camel tries to handle classloader issues in the catch and
just warns if the SecurityManager is not found but I assume in this
paricular case, Weblogic classloader handles the error first and spills all
that error trace into the log.
 
 I guess the question is if there is a dendency on Xerces if the project is
configured to read the routes from an XML file? Am I missing something? 
 
 I need to get rid of that error, it does not look good during deployments.
Any help is appreciated.



--
View this message in context: http://camel.465427.n5.nabble.com/Classloader-error-org-apache-xerces-util-SecurityManager-not-found-tp5805263.html
Sent from the Camel - Users mailing list archive at Nabble.com.

Re: Classloader error - org.apache.xerces.util.SecurityManager not found

Posted by Zoran Regvart <zo...@regvart.com>.
Hi Alex,

On Wed, Jun 28, 2017 at 6:53 PM, albundy <y....@gmail.com> wrote:
> One more note regarding this though - ".. tries to setup a security feature
> of Xerces ... and it is only triggered if Xerces is present on the
> classpath". I don't have Xerces in the classpath and I did not see any "if"
> in XmlConverter.createDocumentBuilderFactory() so it seems that it always
> tries to load that SecurityManager class.. or did I miss something again?

ObjectHelper::loadClass delegates to ObjectHelper::doLoadClass[1] that
will return `null` if the class cannot be loaded, so that check: `if
(smClass != null)`[2] will guard in that situation,

zoran

[1] https://github.com/apache/camel/blob/master/camel-core/src/main/java/org/apache/camel/util/ObjectHelper.java#L1211
[2] https://github.com/apache/camel/blob/master/camel-core/src/main/java/org/apache/camel/converter/jaxp/XmlConverter.java#L1137
-- 
Zoran Regvart

Re: Classloader error - org.apache.xerces.util.SecurityManager not found

Posted by albundy <y....@gmail.com>.
OK, thanks for the explanation Zoran, that makes sense and the error
disappeared from the log after switching from TRACE to WARN.

One more note regarding this though - ".. tries to setup a security feature
of Xerces ... and it is only triggered if Xerces is present on the
classpath". I don't have Xerces in the classpath and I did not see any "if"
in XmlConverter.createDocumentBuilderFactory() so it seems that it always
tries to load that SecurityManager class.. or did I miss something again?

Cheers,
Alex



--
View this message in context: http://camel.465427.n5.nabble.com/Classloader-error-org-apache-xerces-util-SecurityManager-not-found-tp5805263p5805325.html
Sent from the Camel - Users mailing list archive at Nabble.com.

Re: Classloader error - org.apache.xerces.util.SecurityManager not found

Posted by Zoran Regvart <zo...@regvart.com>.
Hi Alex,

On Tue, Jun 27, 2017 at 7:07 PM, albundy <y....@gmail.com> wrote:
>  I guess the question is if there is a dendency on Xerces if the project is
> configured to read the routes from an XML file? Am I missing something?

As far as I can tell no, thought Camel javax.xml API is used. That
part of the code tries to setup a security feature of Xerces that
prevents denial of service attacks, for instance infinite recursion
when dealing with entity expansions and the like, and it is only
triggered if Xerces is present on the classpath.

I think the only reason you're seeing those messages in the log files
is that you have your logging set to log TRACE messages.

zoran
-- 
Zoran Regvart