Re: [jetty-dev] Missing dependency

[Joakim Erdfelt <joakim@xxxxxxxxxxx>]

Looks like Tomcat Jasper, which Jetty uses, is not compatible with a SecurityManager.

$ jar -tvf ~/.m2/repository/org/apache/tomcat/tomcat-jasper/8.5.5/tomcat-jasper-8.5.5.jar | grep Privileged

  1772 Wed Aug 31 20:51:46 MST 2016 org/apache/jasper/runtime/JspFactoryImpl$PrivilegedGetPageContext.class

  1091 Wed Aug 31 20:51:46 MST 2016 org/apache/jasper/runtime/JspFactoryImpl$PrivilegedReleasePageContext.class

$ jar -tvf ~/.m2/repository/org/mortbay/jasper/apache-jsp/8.5.5/apache-jsp-8.5.5.jar | grep Privileged

  1772 Thu Oct 27 16:03:32 MST 2016 org/apache/jasper/runtime/JspFactoryImpl$PrivilegedGetPageContext.class

  1091 Thu Oct 27 16:03:32 MST 2016 org/apache/jasper/runtime/JspFactoryImpl$PrivilegedReleasePageContext.class

   772 Thu Oct 27 16:03:32 MST 2016 org/apache/tomcat/util/security/PrivilegedGetTccl.class

   868 Thu Oct 27 16:03:32 MST 2016 org/apache/tomcat/util/security/PrivilegedSetTccl.class

The class it attempts to load (org.apache.jasper.runtime.JspRuntimeLibrary$PrivilegedIntrospectHelper) simply does not exist in the jar files.

Filed an issue about this at https://github.com/eclipse/jetty.project/issues/1205

Not sure if there's anything that Jetty can do to fix this.

Joakim Erdfelt / joakim@xxxxxxxxxxx

On Thu, Dec 29, 2016 at 12:33 PM, Thomas Lußnig <jetty@xxxxxxxxx> wrote:

Hi,

there is an second class with the same issue.
Would be great if this gets fixed.

Gruß Thomas

package org.apache.jasper.servlet
public class JasperInitializer
 static {
 factory.getClass().getClassLoader().loadClass( basePackage + "runtime.JspRuntimeLibrary$PrivilegedIntrospectHelper");

Am 29.12.2016 um 17:15 schrieb Thomas Lußnig:

Hi,

in the version jetty-distribution-9.4.0.v20161208 is an check that is only activated if an security manager is installed.
The check search for an class that is "not longer" in the jetty distribution. And so cause an error.

The Error is in the jar file "org.mortbay.jasper.apache-jsp-8.5.5.jar"

package org.apache.jasper.security;
public final class SecurityClassLoad
public static void securityClassLoad(ClassLoader loader)
 loader.loadClass("org.apache.jasper.runtime.JspRuntimeLibrary$PrivilegedIntrospectHelper");

Gruß Thomas Lußnig

_______________________________________________
jetty-dev mailing list
jetty-dev@xxxxxxxxxxx
To change your delivery options, retrieve your password, or unsubscribe from this list, visit
https://dev.eclipse.org/mailman/listinfo/jetty-dev