Error with ESAPI functions / ESAPI.properties could not be loaded by any means

thilohermann · May 20, 2019, 8:28am

On our server we are getting errors when using ESAPI functions such as encodeforHTML (randomly, more or less once a week, restarting the server helps as a workaround)

The error message is: java.lang.reflect.InvocationTargetException SecurityConfiguration class (org.owasp.esapi.reference.DefaultSecurityConfiguration) CTOR threw exception.

I attached a screenshot from the stack trace which indicates that there is a problem loading the standard Lucee ESAPI.properties file

org.owasp.esapi.errors.ConfigurationException: ESAPI.properties could not be loaded by any means. 

Fail. at org.owasp.esapi.reference.DefaultSecurityConfiguration.loadConfiguration(DefaultSecurityConfiguration.java:443) at org.owasp.esapi.reference.DefaultSecurityConfiguration.<init>(DefaultSecurityConfiguration.java:226) at
 org.owasp.esapi.reference.DefaultSecurityConfiguration.<init>(DefaultSecurityConfiguration.java:252) at
 org.owasp.esapi.reference.DefaultSecurityConfiguration.getInstance(DefaultSecurityConfiguration.java:67) ... 58 more Caused by: java.lang.IllegalArgumentException: Failed to load ESAPI.properties as a classloader resource. at 
org.owasp.esapi.reference.DefaultSecurityConfiguration.loadConfigurationFromClasspath(DefaultSecurityConfiguration.java:682) at 
org.owasp.esapi.reference.DefaultSecurityConfiguration.loadConfiguration(DefaultSecurityConfiguration.java:440) ... 61 more

So how can I make sure that ESAPI.properties is always loaded?

Lucee 5.3.1.103 on Ubuntu 18.04 LTS
ESAPI Extension 2.1.0.16 (also tried 2.1.0.17-SNAPSHOT, no difference)

Many thanks

cfmitrah · May 20, 2019, 11:48am

I was tried encodeforhtml(),ESAPIEncode() & ESAPIDecode() in lucee 5.3.1.103 with the ESAPI Extension 2.1.0.16. Both of them works & doesn’t throw any error. I made this check in Windows 10 & my java version is 1.8.0_212 (Oracle Corporation) 64bit. Once i got a issue I’ll post it here.

thilohermann · May 20, 2019, 12:20pm

As I wrote, this happens only from time to time, more or less once a week, my java version is 1.8.0_202 (AdoptOpenJdk) 64bit btw. Thanks for keeping an eye on this

jedihomer · May 20, 2019, 3:47pm

We have that on our servers… I believe it’s because it’s an extension now. In our case, we have a CFC that on init runs

CreateObject("java", "org.owasp.esapi.ESAPI").encoder()

If this runs before an encodeForX() runs, then we get these errors.

Our fix at the moment is that the healthcheck that runs to set the server up, specifically calls encodeForHTML() to output something; this then allows our CFC to init and for other calls to encodeForHTML() to work.

thilohermann · May 22, 2019, 6:44am

Thanks for your reply, which might be helpful because we had some old code similar to yours in some CFCs which maybe got called once a week…

<cfset esapi = CreateObject("java", "org.owasp.esapi.ESAPI")>

Luckily we are able to get rid of this code and will see what happens.

Zac_Spitzer · May 22, 2019, 10:12pm

Please file a bug!

thilohermann · May 23, 2019, 6:28am

Done: https://luceeserver.atlassian.net/browse/LDEV-2293

sgauthier · September 15, 2020, 8:02pm

Had the same issue with fresh install of Windows Server 2019, Lucee 5.3.6.61, ESAPI 2.2.0.0-SNAPSHOT.

To fix I copied ESAPI.properties & validation.properties from a working Coldfusion install into “\lucee\tomcat\lib”

Zac_Spitzer · September 15, 2020, 10:21pm

Hi there,

could you add a comment to the above bug? I have just added your affected versions

Did you use the Lucee installer? are you using IIS?

sgauthier · September 16, 2020, 12:48pm

Yes, used the Lucee Windows Installer & Running IIS 10

Zac_Spitzer · September 16, 2020, 12:53pm

the problem is that extensions are lazy loaded

are you calling

CreateObject("java", "org.owasp.esapi.ESAPI");

the workaround is just to call encodeForHtml("") first

sgauthier · September 16, 2020, 1:07pm

Calling:

encodeForHtml("")

Before:

CreateObject(“java”, “org.owasp.esapi.ESAPI”)

didn’t resolve the issue in my case.

I’ve now added a comment to the bug from above as well. Hope this helps.

Zac_Spitzer · September 16, 2020, 1:35pm

after a restart?

sgauthier · September 16, 2020, 1:44pm

lol, after a many restarts, scratching my head, scouring the internet, Downgrading the ESAPI extension, re-upping the extension.

Determined that if the error stated that it couldn’t read the property files I’d check to see how ACF uses them and where they’re stored and copied them over. Reverted my code to the same state that works in ACF restarted Tomcat and voila success; working assess to the ESAPI encoder methods.