ESAPI 2.1.0.1中accessController方法调用失败，求解决方案

开发环境为Jdk 1.8、Eclipse 2018-12，使用esapi-2.1.0.1.jar时，ESAPI的encoder方法（示例中方法A）可正常运行，但调用accessController方法（示例中方法B）时失败。

代码示例 #

package com;

import org.owasp.esapi.ESAPI;

public class MainEntryPoint {

    public static void main(String[] args) {
        // TODO Auto-generated method stub

        System.out.println("A");
        System.out.println(ESAPI.encoder().encodeForHTML("<li>ABC some html here"));
        System.out.println("A end");
        
        System.out.println("B");
        System.out.println(ESAPI.accessController().toString());
        System.out.println("B end");
    }

}

控制台输出 #

A
System property [org.owasp.esapi.opsteam] is not set
System property [org.owasp.esapi.devteam] is not set
Attempting to load ESAPI.properties via file I/O.
Attempting to load ESAPI.properties as resource file via file I/O.
Found in 'org.owasp.esapi.resources' directory: C:\Users\Ansticelee\.esapi\2101\ESAPI.properties
Loaded 'ESAPI.properties' properties file
SecurityConfiguration for Validator.ConfigurationFile.MultiValued not found in ESAPI.properties. Using default: false
Attempting to load validation.properties via file I/O.
Attempting to load validation.properties as resource file via file I/O.
Found in 'org.owasp.esapi.resources' directory: C:\Users\Ansticelee\.esapi\2101\validation.properties
Loaded 'validation.properties' properties file
<li>ABC some html here
A end
B
Exception in thread "main" org.owasp.esapi.errors.ConfigurationException: java.lang.reflect.InvocationTargetException AccessController class (org.owasp.esapi.reference.DefaultAccessController) CTOR threw exception.
    at org.owasp.esapi.util.ObjFactory.make(ObjFactory.java:129)
    at org.owasp.esapi.ESAPI.accessController(ESAPI.java:85)
    at com.MainEntryPoint.main(MainEntryPoint.java:20)
Caused by: java.lang.reflect.InvocationTargetException
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:498)
    at org.owasp.esapi.util.ObjFactory.make(ObjFactory.java:86)
    ... 2 more
Caused by: java.lang.NoClassDefFoundError: org/apache/commons/configuration/ConfigurationException
    at org.owasp.esapi.reference.DefaultAccessController.<init>(DefaultAccessController.java:32)
    at org.owasp.esapi.reference.DefaultAccessController.getInstance(DefaultAccessController.java:22)
    ... 7 more
Caused by: java.lang.ClassNotFoundException: org.apache.commons.configuration.ConfigurationException
    at java.net.URLClassLoader.findClass(URLClassLoader.java:387)
    at java.lang.ClassLoader.loadClass(ClassLoader.java:418)
    at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:352)
    at java.lang.ClassLoader.loadClass(ClassLoader.java:351)
    ... 9 more

操作步骤 #

• 在Eclipse中创建Dynamic Web Project；
• 将esapi-2.1.0.1.jar和log4j-1.2.12.jar放入WebContent/WEB-INF/lib目录；
• 将ESAPI.properties和validation.properties放入C:\Users\Ansticelee.esapi\2101目录；
• 设置VM参数：-Dorg.owasp.esapi.resources="C:\Users\Ansticelee\.esapi\2101"；
• 右键MainEntryPoint.java选择“Run As > Java Application”运行。

解决方案 #

从控制台报错信息可以看出，问题根源是缺少Apache Commons Configuration依赖库。NoClassDefFoundError: org/apache/commons/configuration/ConfigurationException表明JVM无法找到这个类，而ESAPI的DefaultAccessController初始化时必须依赖该库。

解决步骤：

1. 下载与ESAPI 2.1.0.1兼容的commons-configuration-1.8.jar版本；
2. 将该jar包放入项目的WebContent/WEB-INF/lib目录；
3. 重新运行MainEntryPoint程序即可。

内容的提问来源于stack exchange，提问作者Anstice Li