[jira] [Work logged] (CXF-8009) CXF should not use ClassUtils for cglib checks

["ASF GitHub Bot (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CXF-8009?focusedWorklogId=221050&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-221050 ]

ASF GitHub Bot logged work on CXF-8009:
---------------------------------------

                Author: ASF GitHub Bot
            Created on: 01/Apr/19 01:49
            Start Date: 01/Apr/19 01:49
    Worklog Time Spent: 10m 
      Work Description: reta commented on pull request #529: CXF-8009: CXF should not rely on ClassUtils for CGLIB proxy checks
URL: https://github.com/apache/cxf/pull/529
 
 
   This is a tricky one. So the `ClassUtils.isCglibProxyClass`, which is used by `SpringAopClassHelper`, does check if the class name has `$$` to disambiguate CGLIB proxies from regular classes. The typical examples of CGLIB proxy class names are:
   ```
   SpringProxy$$EnhancerBySpringCGLIB$$d8e73a30
   Function$$EnhancerByCGLIB$$53576dae
   ```
   However, the classes generated for lambda expressions do contain `$$` as well, tricking `SpringAopClassHelper` to believe it is a CGLIB proxy, here is an example:
   ```
   org.apache.cxf.common.util.ClassHelperTest$$Lambda$10/846254484@32b260fa
   ```
   It turned out to be difficult to come up with efficient and bullet-proof check (based on class name only) to determine if it is CGLIB generated proxy or not. The cheapest but not 100% reliable way seems to be to check the presence of the `CGLIB` in the class name (this PR).
   
   Alternatively, using the reflection it is possible to achieve more reliable outcomes by inspecting the class, looking for CGLIB generated methods / fields (`CGLIB$BIND_CALLBACKS`). I am not sure it is worth it actually.
   
   @dkulp @coheigea what do you think, guys?
   
   
   
 
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


Issue Time Tracking
-------------------

            Worklog Id:     (was: 221050)
            Time Spent: 10m
    Remaining Estimate: 0h

> CXF should not use ClassUtils for cglib checks
> ----------------------------------------------
>
>                 Key: CXF-8009
>                 URL: https://issues.apache.org/jira/browse/CXF-8009
>             Project: CXF
>          Issue Type: Bug
>          Components: JAX-RS
>    Affects Versions: 2.7.18
>            Reporter: Attila Király
>            Assignee: Andriy Redko
>            Priority: Major
>          Time Spent: 10m
>  Remaining Estimate: 0h
>
> When using lambda to implement a jax-rs {{StreamingOutput}} we get a no message body writer found error.
> However if we use an anonymous class instead of the lambda then it works.
> This happens because CXF uses the spring method {{ClassUtils.isCglibProxyClass()}} for detecting cglib classes. However that method is not strict enough and incorrectly marks every lambda class as cglib as well. This causes CXF to get the superclass which will always be {{Object.class}} for which there is no message body writer.
> According to the [feedback received|https://github.com/spring-projects/spring-framework/issues/22706] on the spring project instead of {{ClassUtils.isCglibProxyClass()}} (which got deprecated) people should use other methods, for example {{AopUtils.isCglibProxy()}} which is more strict.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)