WildFly9.01创建RestTemplate遇ExpiringCache与SecurityManager异常求助

异常场景与触发代码 #

使用WildFly 9.0.1版本，在执行RestTemplate实例化操作时出现异常，触发代码为：

RestTemplate restTemplate = new RestTemplate();

核心异常堆栈 #

Caused by: java.lang.ArrayIndexOutOfBoundsException: 200
    at java.io.ExpiringCache.cleanup(ExpiringCache.java:120)
    at java.io.ExpiringCache.get(ExpiringCache.java:76)
    at java.io.WinNTFileSystem.canonicalize(WinNTFileSystem.java:406)
    at java.io.File.getCanonicalPath(File.java:618)
    at java.io.FilePermission$1.run(FilePermission.java:215)
    at java.io.FilePermission$1.run(FilePermission.java:203)
    at java.security.AccessController.doPrivileged(Native Method)
    at java.io.FilePermission.init(FilePermission.java:203)
    at java.io.FilePermission.<init>(FilePermission.java:277)
    at java.lang.SecurityManager.checkRead(SecurityManager.java:888)
    at java.io.File.exists(File.java:814)
    at org.jboss.modules.FileResourceLoader$4.run(FileResourceLoader.java:194)
    at org.jboss.modules.FileResourceLoader$4.run(FileResourceLoader.java:192)
    at java.security.AccessController.doPrivileged(Native Method)
    at org.jboss.modules.FileResourceLoader.getResource(FileResourceLoader.java:192)
    at org.jboss.modules.ModuleClassLoader.loadResourceLocal(ModuleClassLoader.java:343)
    at org.jboss.modules.ModuleClassLoader$1.loadResourceLocal(ModuleClassLoader.java:95)
    at org.jboss.modules.Module.getResourceAsStream(Module.java:627)
    at org.jboss.modules.ModuleClassLoader.findResourceAsStream(ModuleClassLoader.java:537)
    at org.jboss.modules.ConcurrentClassLoader.getResourceAsStream(ConcurrentClassLoader.java:358)
    at __redirected.__RedirectedUtils.findProviderClassNames(__RedirectedUtils.java:148)
    at __redirected.__RedirectedUtils.loadProvider(__RedirectedUtils.java:103)
    at __redirected.__RedirectedUtils.loadProvider(__RedirectedUtils.java:99)
    at __redirected.__XMLInputFactory.<init>(__XMLInputFactory.java:106)
    at sun.reflect.GeneratedConstructorAccessor6.newInstance(Unknown Source)
    at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
    at java.lang.reflect.Constructor.newInstance(Constructor.java:422)
    at java.lang.Class.newInstance(Class.java:442)
    at javax.xml.stream.FactoryFinder.newInstance(FactoryFinder.java:193)
    .. 45 more

完整异常堆栈 #

2022-08-05 12:06:38,848 ERROR [io.undertow.request] (default task-423) UT005023: Exception handling request to //dashboard: javax.xml.stream.FactoryConfigurationError: Provider __redirected.__XMLInputFactory could not be instantiated: java.lang.ArrayIndexOutOfBoundsException: 200
    at javax.xml.stream.FactoryFinder.newInstance(FactoryFinder.java:205)
    at javax.xml.stream.FactoryFinder.newInstance(FactoryFinder.java:152)
    at javax.xml.stream.FactoryFinder.find(FactoryFinder.java:265)
    at javax.xml.stream.FactoryFinder.find(FactoryFinder.java:227)
    at javax.xml.stream.XMLInputFactory.newInstance(XMLInputFactory.java:154)
    at org.springframework.http.converter.json.Jackson2ObjectMapperBuilder$XmlObjectMapperInitializer.xmlInputFactory(Jackson2ObjectMapperBuilder.java:817)
    at org.springframework.http.converter.json.Jackson2ObjectMapperBuilder$XmlObjectMapperInitializer.create(Jackson2ObjectMapperBuilder.java:807)
    at org.springframework.http.converter.json.Jackson2ObjectMapperBuilder.build(Jackson2ObjectMapperBuilder.java:585)
    at org.springframework.http.converter.xml.MappingJackson2XmlHttpMessageConverter.<init>(MappingJackson2XmlHttpMessageConverter.java:50)
    at org.springframework.web.client.RestTemplate.<init>(RestTemplate.java:167)
    at com.myapp.security.rest.client.SecurityHttpClient.<init>(SecurityHttpClient.java:35)
    at com.myapp.security.rest.client.SecurityHttpClient.<init>(SecurityHttpClient.java:40)
    at com.myapp.security.util.AuthorizationUtil.getUSP(AuthorizationUtil.java:135)
    at com.myapp.security.filter.SecurityFilter.processFilter(SecurityFilter.java:55)
    at com.myapp.security.filter.BaseFilter.doFilter(BaseFilter.java:89)
    at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
    at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:132)
    at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:85)
    at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
    at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
    at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
    at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
    at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
    at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
    at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
    at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
    at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
    at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:58)
    at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:72)
    at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
    at io.undertow.security.handlers.SecurityInitialHandler.handleRequest(SecurityInitialHandler.java:76)
    at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
    at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
    at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
    at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
    at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:282)
    at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:261)
    at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:80)
    at io.undertow.servlet.handlers.ServletInitialHandler$1$1.run(ServletInitialHandler.java:178)
    at java.security.AccessController.doPrivileged(Native Method)
    at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:175)
    at io.undertow.server.Connectors.executeRootHandler(Connectors.java:199)
    at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:774)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
    at java.lang.Thread.run(Thread.java:745)
Caused by: java.lang.ArrayIndexOutOfBoundsException: 200
    at java.io.ExpiringCache.cleanup(ExpiringCache.java:120)
    at java.io.ExpiringCache.get(ExpiringCache.java:76)
    at java.io.WinNTFileSystem.canonicalize(WinNTFileSystem.java:406)
    at java.io.File.getCanonicalPath(File.java:618)
    at java.io.FilePermission$1.run(FilePermission.java:215)
    at java.io.FilePermission$1.run(FilePermission.java:203)
    at java.security.AccessController.doPrivileged(Native Method)
    at java.io.FilePermission.init(FilePermission.java:203)
    at java.io.FilePermission.<init>(FilePermission.java:277)
    at java.lang.SecurityManager.checkRead(SecurityManager.java:888)
    at java.io.File.exists(File.java:814)
    at org.jboss.modules.FileResourceLoader$4.run(FileResourceLoader.java:194)
    at org.jboss.modules.FileResourceLoader$4.run(FileResourceLoader.java:192)
    at java.security.AccessController.doPrivileged(Native Method)
    at org.jboss.modules.FileResourceLoader.getResource(FileResourceLoader.java:192)
    at org.jboss.modules.ModuleClassLoader.loadResourceLocal(ModuleClassLoader.java:343)
    at org.jboss.modules.ModuleClassLoader$1.loadResourceLocal(ModuleClassLoader.java:95)
    at org.jboss.modules.Module.getResourceAsStream(Module.java:627)
    at org.jboss.modules.ModuleClassLoader.findResourceAsStream(ModuleClassLoader.java:537)
    at org.jboss.modules.ConcurrentClassLoader.getResourceAsStream(ConcurrentClassLoader.java:358)
    at __redirected.__RedirectedUtils.findProviderClassNames(__RedirectedUtils.java:148)
    at __redirected.__RedirectedUtils.loadProvider(__RedirectedUtils.java:103)
    at __redirected.__RedirectedUtils.loadProvider(__RedirectedUtils.java:99)
    at __redirected.__XMLInputFactory.<init>(__XMLInputFactory.java:106)
    at sun.reflect.GeneratedConstructorAccessor6.newInstance(Unknown Source)
    at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
    at java.lang.reflect.Constructor.newInstance(Constructor.java:422)
    at java.lang.Class.newInstance(Class.java:442)
    at javax.xml.stream.FactoryFinder.newInstance(FactoryFinder.java:193)
    .. 45 more

排查与规避建议 #

• 升级JDK版本：该异常源于JDK的ExpiringCache类线程安全缺陷，建议升级至JDK 7u80及以上版本，该版本修复了此缓存并发访问问题。
• 配置WildFly模块隔离：在项目中添加jboss-deployment-structure.xml，隔离XML处理相关的容器依赖，避免与应用依赖冲突：

  <jboss-deployment-structure>
      <deployment>
          <exclusions>
              <module name="javax.xml.stream.api"/>
              <module name="com.fasterxml.jackson.jaxrs.jackson-jaxrs-xml-provider"/>
          </exclusions>
      </deployment>
  </jboss-deployment-structure>
  

• 自定义RestTemplate构建：手动初始化RestTemplate时移除默认的XML消息转换器，跳过XML工厂初始化流程：

  RestTemplate restTemplate = new RestTemplate();
  restTemplate.getMessageConverters().removeIf(converter -> converter instanceof MappingJackson2XmlHttpMessageConverter);
  

• 禁用SecurityManager：如果应用无需权限控制，可在WildFly启动参数中添加-Djava.security.manager=off，绕过文件权限检查环节。
• 清理容器临时缓存：删除WildFly的standalone/tmp目录下的缓存文件，避免损坏缓存导致路径解析异常。

内容的提问来源于stack exchange，提问作者Bhanu PS Kushwah