升级至ESAPI-2.5.0.0

Question

我最近被调到了ESAPi-2.5.0.0，这样就不会抱怨log4j了。但是，我得到了以下错误。

org.owasp.esapi.errors.ConfigurationException: java.lang.reflect.InvocationTargetException Encoder class (org.owasp.esapi.reference.DefaultEncoder) CTOR threw exception.
        at org.owasp.esapi.util.ObjFactory.make(ObjFactory.java:129)
        at org.owasp.esapi.ESAPI.encoder(ESAPI.java:101)
        at 

        Caused by:
        java.lang.reflect.InvocationTargetException
            at sun.reflect.GeneratedMethodAccessor104.invoke(Unknown Source)
            at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
            at java.lang.reflect.Method.invoke(Method.java:498)
            at org.owasp.esapi.util.ObjFactory.make(ObjFactory.java:86)
            ... 5 more

            Caused by:
            org.owasp.esapi.errors.ConfigurationException: java.lang.ClassNotFoundException: org.owasp.esapi.reference.Log4JLogFactory LogFactory class (org.owasp.esapi.reference.Log4JLogFactory) must be in class path.
                at org.owasp.esapi.util.ObjFactory.make(ObjFactory.java:108)
                at org.owasp.esapi.ESAPI.logFactory(ESAPI.java:139)
                at org.owasp.esapi.ESAPI.getLogger(ESAPI.java:155)

Below are my ESAPI.prperties: ESAPI.AccessControl=org.owasp.esapi.reference.DefaultAccessController

FileBasedAuthenticator requires users.txt file in .esapi directory

ESAPI.Authenticator=org.owasp.esapi.reference.FileBasedAuthenticator ESAPI.Encoder=org.owasp.esapi.reference.DefaultEncoder ESAPI.Encryptor=org.owasp.esapi.reference.crypto.JavaEncryptor

ESAPI.Executor=org.owasp.esapi.reference.DefaultExecutor ESAPI.HTTPUtilities=org.owasp.esapi.reference.DefaultHTTPUtilities ESAPI.IntrusionDetector=org.owasp.esapi.reference.DefaultIntrusionDetector

Log4JFactory Requires log4j.xml or log4j.properties in classpath - ``http://www.laliluna.de/log4j-tutorial.html

ESAPI.Logger=org.owasp.esapi.reference.JavaLogFactory ESAPI.Randomizer=org.owasp.esapi.reference.DefaultRandomizer ESAPI.Validator=org.owasp.esapi.reference.DefaultValidator

any help would be highly appreciated.

尝试升级到ESAPI-2.5.0.0。

Answer 1

如果我不得不猜测，看起来您的ESAPI.properties文件的ESAPI.Logger属性仍然设置为org.owasp.esapi.reference.Log4JLogFactory。在2.5.0.0版中，从ESAPI中删除了Log4J支持，从而删除了该类。(在我们移除它之前，它已经被废弃了两年多。)该类至少早在2.3.0.0之前就被重命名为org.owasp.esapi.logging.log4j.Log4JLogFactory。

但是，由于您已经注意到已经将其设置为ESAPI.Logger以使用JUL，所以很可能没有选择您认为正在拾取的ESAPI.properties文件，因为异常堆栈跟踪中的最后一个“原因”清楚地显示了org.owasp.esapi.reference.Log4JLogFactory作为赋予ClassNotFoundError的内容。(否则，您将在代码中的某个位置使用该类。)