Here is my scenario. I have a working login form that functions correctly. I have attempted to install ESAPI in order to secure the form.
In doing so, now when I try to log in this message is generated in the browser:
java.lang.NoClassDefFoundError: org/owasp/esapi/ESAPI
at com.tunestore.action.LoginAction.execute(LoginAction.java:43)
at org.springframework.web.struts.DelegatingActionProxy.execute(DelegatingActionProxy.java:110)
at org.apache.struts.chain.commands.servlet.ExecuteAction.execute(ExecuteAction.java:58)
at org.apache.struts.chain.commands.AbstractExecuteAction.execute(AbstractExecuteAction.java:67)
at org.apache.struts.chain.commands.ActionCommandBase.execute(ActionCommandBase.java:51)
at org.apache.commons.chain.impl.ChainBase.execute(ChainBase.java:190)
at org.apache.commons.chain.generic.LookupCommand.execute(LookupCommand.java:304)
at org.apache.commons.chain.impl.ChainBase.execute(ChainBase.java:190)
at org.apache.struts.chain.ComposableRequestProcessor.process(ComposableRequestProcessor.java:283)
at org.apache.struts.action.ActionServlet.process(ActionServlet.java:1913)
at org.apache.struts.action.ActionServlet.doPost(ActionServlet.java:462)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:641)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:722)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:306)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
at com.tunestore.servlet.PersistenceFilter.doFilter(PersistenceFilter.java:77)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:244)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:240)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:161)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:164)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:108)
at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:558)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:379)
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:243)
at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:259)
at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:281)
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)
Caused by: java.lang.ClassNotFoundException: org.owasp.esapi.ESAPI
at org.apache.catalina.loader.WebappClassLoader.loadClass(WebappClassLoader.java:1671)
at org.apache.catalina.loader.WebappClassLoader.loadClass(WebappClassLoader.java:1516)
... 31 more
ROOT CAUSE
java.lang.ClassNotFoundException: org.owasp.esapi.ESAPI
at org.apache.catalina.loader.WebappClassLoader.loadClass(WebappClassLoader.java:1671)
at org.apache.catalina.loader.WebappClassLoader.loadClass(WebappClassLoader.java:1516)
at com.tunestore.action.LoginAction.execute(LoginAction.java:43)
at org.springframework.web.struts.DelegatingActionProxy.execute(DelegatingActionProxy.java:110)
at org.apache.struts.chain.commands.servlet.ExecuteAction.execute(ExecuteAction.java:58)
at org.apache.struts.chain.commands.AbstractExecuteAction.execute(AbstractExecuteAction.java:67)
at org.apache.struts.chain.commands.ActionCommandBase.execute(ActionCommandBase.java:51)
at org.apache.commons.chain.impl.ChainBase.execute(ChainBase.java:190)
at org.apache.commons.chain.generic.LookupCommand.execute(LookupCommand.java:304)
at org.apache.commons.chain.impl.ChainBase.execute(ChainBase.java:190)
at org.apache.struts.chain.ComposableRequestProcessor.process(ComposableRequestProcessor.java:283)
at org.apache.struts.action.ActionServlet.process(ActionServlet.java:1913)
at org.apache.struts.action.ActionServlet.doPost(ActionServlet.java:462)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:641)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:722)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:306)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
at com.tunestore.servlet.PersistenceFilter.doFilter(PersistenceFilter.java:77)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:244)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:240)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:161)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:164)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:108)
at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:558)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:379)
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:243)
at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:259)
at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:281)
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)
I am using the Eclipse Java EE IDE Indigo Service Release 1.
I have gone into the project’s Properties and added the esapi-2.0.1.jar file to the libraries.
This is all that should be need but I receive the message above. In an attempt to troubleshoot I’ve done the following:
In addition I have drilled down and manually pointed the Source Attachment and Native Library Location to the src and lib directories that come with the esapi zip file.
I configured the Project to use the JDK because it was created with the JRE as the “Installed JRE”.
by:
- Right click the project’s name.
- Choose “Properties”, “Java Build Path”
- Click the tab “Libraries”.
- Click “Add Libraries”, select “JRE System Library”, Next
- Select the bottom item: Workspace default JRE (jdk1.x.x. etc….)
- (Notice that it is now a JDK and not the JRE!)
- Click “Finish”
- Now remove the JRE libarary so you only have the JDK library.
- ex: JRE System Library [JavaSE-1.6]
- Click “OK”
Next I configured Eclipse to use the JDK and not the JRE by doing the following:
- Window->Preferences->Java->Installed JREs
- Click “Add”, “Standard VM”, “Next”
- For “JRE Home” click “Directory”
- Locate your JDK directory…
- Ex: C:\java\jdk1.6.0_24
- Click “Finish”
- Next check the JDK vs the JRE that is listed.
- Click “Ok”
To make sure that the .properties files were recognized I also added
-Dorg.owasp.esapi.resources="c:\.esapi"
to the Default VM Arguments.
I also added the same esapi-2.0.1.jar file to the JRE system libraries listed here.
And finally I went into my project in Project Explorer and drilled down from Libraries > JRE System Library > esapi-2.0.1.jar > org.owasp.esapi > ESAPI.class > ESAPI and it stated it did now have the source so I browsed to the same src folder where the esapi zip file was extracted.
Through all of these steps the error has stayed the same.
A web app’s classpath is constituted by /WEB-INF/classes, all the jars in /WEB-INF/lib, and the classpath of the web server itself (tomcat in this case). The libraries that you add to the eclipse project’s classpath are not deployed with the app. So if you don’t put them in tomcat’s classpath, they won’t be in the classpath when running the web application.
In this case, you should certainly remove the library from the eclipse build path, and just drop the jar in WEB-INF/lib. Eclipse will have it automatically available for the comoilation, and it will automatically be deployed with the web app and be in its classpath at runtime.