我正在使用espai ESAPI对字符串值进行编码,以解决跨站点脚本编写问题,如下所示(代码段)。
String encodedString = ESAPI.encoder().encodeForHTML(value);
异常跟踪
org.owasp.esapi.errors.ConfigurationException: java.lang.reflect.InvocationTargetException Encoder class (org.owasp.esapi.reference.DefaultEncoder) CTOR threw exception.
at org.owasp.esapi.util.ObjFactory.make(ObjFactory.java:129)
at org.owasp.esapi.ESAPI.encoder(ESAPI.java:99)
<bold>Caused by: java.lang.NoClassDefFoundError: org/apache/log4j/spi/LoggerFactory</bold>
at java.lang.Class.forName0(Native Method)
at java.lang.Class.forName(Class.java:190)
at org.owasp.esapi.util.ObjFactory.make(ObjFactory.java:74)
at org.owasp.esapi.ESAPI.logFactory(ESAPI.java:137)
at org.owasp.esapi.ESAPI.getLogger(ESAPI.java:154)
at org.owasp.esapi.reference.DefaultEncoder.<init>(DefaultEncoder.java:75)
at org.owasp.esapi.reference.DefaultEncoder.getInstance(DefaultEncoder.java:59)
... 71 more
Caused by: java.lang.ClassNotFoundException: org.apache.log4j.spi.LoggerFactory
at weblogic.utils.classloaders.GenericClassLoader.findLocalClass(GenericClassLoader.java:297)
at weblogic.utils.classloaders.GenericClassLoader.findClass(GenericClassLoader.java:270)
at weblogic.utils.classloaders.ChangeAwareClassLoader.findClass(ChangeAwareClassLoader.java:64)
at java.lang.ClassLoader.loadClass(ClassLoader.java:425)
at java.lang.ClassLoader.loadClass(ClassLoader.java:358)
Maven存储库pom.xml
<dependency>
<groupId>org.owasp.esapi</groupId>
<artifactId>esapi</artifactId>
<version>${org.owasp.esapi.version}</version>
<exclusions>
<exclusion>
<groupId>commons-collections</groupId>
<artifactId>commons-collections</artifactId>
</exclusion>
<exclusion>
<groupId>xercesImpl</groupId>
<artifactId>xercesImpl</artifactId>
</exclusion>
<exclusion>
<groupId>commons-logging</groupId>
<artifactId>commons-logging</artifactId>
</exclusion>
<exclusion>
<groupId>xml-apis</groupId>
<artifactId>xml-apis</artifactId>
</exclusion>
<exclusion>
<groupId>commons-digester</groupId>
<artifactId>commons-digester</artifactId>
</exclusion>
<exclusion>
<groupId>commons-codec</groupId>
<artifactId>commons-codec</artifactId>
</exclusion>
<exclusion>
<groupId>org.owasp.antisamy</groupId>
<artifactId>antisamy</artifactId>
</exclusion>
<exclusion>
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
</exclusion>
</exclusions>
</dependency>
如果我不排除log4j,那么它将抛出依赖项收敛错误,因为log4j在maven禁止的依赖项中声明,如下所示
<executions>
<execution>
<id>enforce</id>
<configuration>
<rules>
<requireJavaVersion>
<version>${java.version}</version>
</requireJavaVersion>
<requireMavenVersion>
<version>3.0</version>
</requireMavenVersion>
<DependencyConvergence />
<bannedDependencies>
<excludes>
<!-- This should not exist as it will force SLF4J calls to be
delegated to log4j -->
<exclude>org.slf4j:slf4j-log4j12</exclude>
<!-- This should not exist as it will force SLF4J calls to be
delegated to jul -->
<exclude>org.slf4j:slf4j-jdk14</exclude>
<!-- Ensure only the slf4j binding for logback is on the classpath -->
<exclude>log4j:log4j</exclude>
<!-- As recommended from the slf4j guide, exclude commons-logging -->
<exclude>commons-logging:commons-logging</exclude>
</excludes>
</bannedDependencies>
</rules>
</configuration>
<goals>
<goal>enforce</goal>
</goals>
</execution>
</executions>
在这方面的帮助将不胜感激。如果您需要更多详细信息,请告诉我。预先感谢!
ESAPI不支持SLF4J,即使它又支持log4j。通过ESAPI.properties中的ESAPI.logger属性控制的ESAPI日志记录选择是log4j或java.util.logging。如果决定使用log4j(即ESAPI.Logger = org.owasp.esapi.reference.Log4JLogFactory),则需要在类路径中使用log4j.jar和log4j.xml或log4j.properties,具体取决于哪个版本的您正在使用的log4j。或者,可以通过在ESAPI.properties文件中设置ESAPI.Logger = org.owasp.esapi.reference.JavaLogFactory来使用java.util.logging。
[我看到您似乎正在为富国银行(Wells Fargo)这样做。如果您还有其他问题,请在Teamworks中查找“ Kevin W. Wall”,并向我发送电子邮件,因为我是那里的安全代码审查小组的成员以及ESAPI的项目负责人,因此,有了更多的背景信息,我也许可以提出其他可能性。
-kevin
仅更新:已添加对SLF4J的支持,因此,如果您使用的是ESAPI 2.2.0.0版,则可以通过将ESAPI.Logger
属性设置为值org.owasp.esapi.logging.slf4j.Slf4JLogFactory
来使用它。>