IntelliJ调试Find-Sec-Bugs的HttpParameterPollutionDetectorTest报错求助

问题描述 #

我是Find-Sec-Bugs（FSB）新手，想在IntelliJ里调试HttpParameterPollutionDetectorTest的detectHttpParameterPollution方法追踪分析步骤。已经通过Maven成功运行所有测试，但在IntelliJ中运行/调试该方法时出现错误：

/usr/lib/jvm/java-1.11.0-openjdk-amd64/bin/java -ea -Didea.test.cyclic.buffer.size=41943040 -javaagent:/opt/idea-IU-222.3345.118/lib/idea_rt.jar=42285:/opt/idea-IU-222.3345.118/bin -Dfile.encoding=UTF-8 -classpath /opt/idea-IU-222.3345.118/lib/idea_rt.jar:/opt/idea-IU-222.3345.118/plugins/testng/lib/testng-rt.jar:/home/tester/work/find-sec-bugs-v1.12/out/test/test:/home/tester/work/find-sec-bugs-v1.12/out/production/test:/home/tester/work/find-sec-bugs-v1.12/findsecbugs-samples-java/target/test-classes:/home/tester/work/find-sec-bugs-v1.12/findsecbugs-samples-deps/target/classes:/home/tester/.m2/repository/commons-codec/commons-codec/1.9/commons-codec-1.9.jar:/home/tester/.m2/repository/commons-io/commons-io/2.11.0/commons-io-2.11.0.jar:/home/tester/.m2/repository/javax/activation/activation/1.1.1/activation-1.1.1.jar:/home/tester/.m2/repository/javax/jws/javax.jws-api/1.1/javax.jws-api-1.1.jar:/home/tester/work/find-sec-bugs-v1.12/out/production/main:/home/tester/.m2/repository/com/github/spotbugs/spotbugs/4.5.3/spotbugs-4.5.3.jar:/home/tester/.m2/repository/org/apache/bcel/bcel/6.5.0/bcel-6.5.0.jar:/home/tester/.m2/repository/com/github/spotbugs/spotbugs-annotations/4.5.3/spotbugs-annotations-4.5.3.jar:/home/tester/.m2/repository/org/ow2/asm/asm-tree/9.2/asm-tree-9.2.jar:/home/tester/work/find-sec-bugs-v1.12/findsecbugs-test-util/target/test-classes:/home/tester/.m2/repository/org/mockito/mockito-core/4.3.1/mockito-core-4.3.1.jar:/home/tester/.m2/repository/net/bytebuddy/byte-buddy/1.12.7/byte-buddy-1.12.7.jar:/home/tester/.m2/repository/net/bytebuddy/byte-buddy-agent/1.12.7/byte-buddy-agent-1.12.7.jar:/home/tester/.m2/repository/org/objenesis/objenesis/3.2/objenesis-3.2.jar:/home/tester/.m2/repository/org/hamcrest/hamcrest-core/2.2/hamcrest-core-2.2.jar:/home/tester/.m2/repository/org/hamcrest/hamcrest/2.2/hamcrest-2.2.jar:/home/tester/.m2/repository/org/testng/testng/7.4.0/testng-7.4.0.jar:/home/tester/.m2/repository/com/beust/jcommander/1.78/jcommander-1.78.jar:/home/tester/.m2/repository/org/webjars/jquery/3.5.1/jquery-3.5.1.jar:/home/tester/.m2/repository/org/slf4j/slf4j-api/1.7.26/slf4j-api-1.7.26.jar:/home/tester/.m2/repository/org/ow2/asm/asm/9.2/asm-9.2.jar:/home/tester/.m2/repository/org/ow2/asm/asm-analysis/9.2/asm-analysis-9.2.jar:/home/tester/.m2/repository/org/ow2/asm/asm-commons/9.2/asm-commons-9.2.jar:/home/tester/.m2/repository/org/ow2/asm/asm-util/9.2/asm-util-9.2.jar:/home/tester/.m2/repository/net/jcip/jcip-annotations/1.0/jcip-annotations-1.0.jar:/home/tester/.m2/repository/org/dom4j/dom4j/2.1.3/dom4j-2.1.3.jar:/home/tester/.m2/repository/org/apache/commons/commons-lang3/3.12.0/commons-lang3-3.12.0.jar:/home/tester/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar:/home/tester/.m2/repository/com/google/code/findbugs/jsr305/3.0.2/jsr305-3.0.2.jar:/home/tester/.m2/repository/com/google/code/gson/gson/2.8.9/gson-2.8.9.jar:/home/tester/.m2/repository/jaxen/jaxen/1.2.0/jaxen-1.2.0.jar:/home/tester/.m2/repository/net/sf/saxon/Saxon-HE/10.6/Saxon-HE-10.6.jar com.intellij.rt.testng.RemoteTestNGStarter -usedefaultlisteners false -socket35251 @w@/var/tmp/idea_working_dirs_testng.tmp -temp /var/tmp/idea_testng.tmp
org.testng.TestNGException: 
An error occurred while instantiating class com.h3xstream.findsecbugs.injection.http.HttpParameterPollutionDetectorTest: class org.slf4j.helpers.SubstituteLogger can not implement org.slf4j.Logger, because it is not an interface (org.slf4j.Logger is in unnamed module of loader 'app')
    at org.testng.internal.InstanceCreator.createInstanceUsingObjectFactory(InstanceCreator.java:123)
    at org.testng.internal.InstanceCreator.createInstance(InstanceCreator.java:79)
    at org.testng.internal.objects.SimpleObjectDispenser.dispense(SimpleObjectDispenser.java:25)
    at org.testng.internal.objects.GuiceBasedObjectDispenser.dispense(GuiceBasedObjectDispenser.java:30)
    at org.testng.internal.ClassImpl.getDefaultInstance(ClassImpl.java:112)
    at org.testng.internal.ClassImpl.getInstances(ClassImpl.java:165)
    at org.testng.TestClass.getInstances(TestClass.java:122)
    at org.testng.TestClass.initTestClassesAndInstances(TestClass.java:102)
    at org.testng.TestClass.init(TestClass.java:94)
    at org.testng.TestClass.<init>(TestClass.java:59)
    at org.testng.TestRunner.initMethods(TestRunner.java:463)
    at org.testng.TestRunner.init(TestRunner.java:339)
    at org.testng.TestRunner.init(TestRunner.java:292)
    at org.testng.TestRunner.<init>(TestRunner.java:183)
    at org.testng.SuiteRunner$DefaultTestRunnerFactory.newTestRunner(SuiteRunner.java:596)
    at org.testng.SuiteRunner.init(SuiteRunner.java:173)
    at org.testng.SuiteRunner.<init>(SuiteRunner.java:107)
    at org.testng.TestNG.createSuiteRunner(TestNG.java:1300)
    at org.testng.TestNG.createSuiteRunners(TestNG.java:1276)
    at org.testng.TestNG.runSuitesLocally(TestNG.java:1125)
    at org.testng.TestNG.runSuites(TestNG.java:1063)
    at org.testng.TestNG.run(TestNG.java:1031)
    at com.intellij.rt.testng.IDEARemoteTestNG.run(IDEARemoteTestNG.java:66)
    at com.intellij.rt.testng.RemoteTestNGStarter.main(RemoteTestNGStarter.java:109)
Caused by: java.lang.IncompatibleClassChangeError: class org.slf4j.helpers.SubstituteLogger can not implement org.slf4j.Logger, because it is not an interface (org.slf4j.Logger is in unnamed module of loader 'app')
    at java.base/java.lang.ClassLoader.defineClass1(Native Method)
    at java.base/java.lang.ClassLoader.defineClass(ClassLoader.java:1017)
    at java.base/java.security.SecureClassLoader.defineClass(SecureClassLoader.java:174)
    at java.base/jdk.internal.loader.BuiltinClassLoader.defineClass(BuiltinClassLoader.java:800)
    at java.base/jdk.internal.loader.BuiltinClassLoader.findClassOnClassPathOrNull(BuiltinClassLoader.java:698)
    at java.base/jdk.internal.loader.BuiltinClassLoader.loadClassOrNull(BuiltinClassLoader.java:621)
    at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:579)
    at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:178)
    at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:522)
    at org.slf4j.LoggerFactory.<clinit>(LoggerFactory.java:86)
    at com.h3xstream.findbugs.test.BaseDetectorTest.<clinit>(BaseDetectorTest.java:40)
    at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
    at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
    at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
    at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:490)
    at org.testng.internal.ObjectFactoryImpl.newInstance(ObjectFactoryImpl.java:23)
    at org.testng.internal.InstanceCreator.instantiateUsingDefaultConstructor(InstanceCreator.java:193)
    at org.testng.internal.InstanceCreator.createInstanceUsingObjectFactory(InstanceCreator.java:113)
    ... 23 more

Process finished with exit code 255

错误原因分析 #

核心错误是java.lang.IncompatibleClassChangeError: class org.slf4j.helpers.SubstituteLogger can not implement org.slf4j.Logger, because it is not an interface，说明类路径中存在不同版本的SLF4J依赖冲突：

• org.slf4j.Logger在某个依赖中是类而非接口，但SubstituteLogger试图实现它，违背了Java继承规则。
• Maven运行测试正常，但IntelliJ调试时类路径加载顺序不同，导致冲突的SLF4J版本被优先加载。

解决步骤 #

• 强制统一SLF4J版本：在项目根pom.xml中添加依赖管理，确保所有模块使用相同版本的SLF4J：

  <dependencyManagement>
      <dependencies>
          <dependency>
              <groupId>org.slf4j</groupId>
              <artifactId>slf4j-api</artifactId>
              <version>1.7.26</version> <!-- 与当前项目依赖的版本保持一致 -->
          </dependency>
      </dependencies>
  </dependencyManagement>
  

• 清理IntelliJ缓存与构建目录：
  1. 执行File -> Invalidate Caches... -> Invalidate and Restart重启IntelliJ。
  2. 删除项目下的out、target目录，重新执行mvn clean install完成构建。
• 调整测试运行配置：
  1. 打开测试类的运行配置，选择Modify options -> Add VM options。
  2. 添加VM参数确保SLF4J相关类优先加载，或直接指定日志桥接器：-Djava.util.logging.manager=org.slf4j.bridge.SLF4JBridgeHandler。
• 排查并排除冲突依赖：执行mvn dependency:tree查看所有依赖中的SLF4J版本，对引入冲突版本的依赖添加排除规则：

  <dependency>
      <groupId>冲突依赖的groupId</groupId>
      <artifactId>冲突依赖的artifactId</artifactId>
      <version>对应版本号</version>
      <exclusions>
          <exclusion>
              <groupId>org.slf4j</groupId>
              <artifactId>slf4j-api</artifactId>
          </exclusion>
      </exclusions>
  </dependency>
  

内容的提问来源于stack exchange，提问作者Lewis Young