Lucee Bug LDEV-2293

Lucee References

Lucee Dev Forum Error with ESAPI functions / ESAPI.properties could not be loaded by any means
Ludee Bug Report LDEV-2293 Error with ESAPI functions - CTOR threw exception - ESAPI.properties could not be loaded by any means

Application Code Excerpts

Excerpt FormUtil.cfc

component {

processingdirective preserveCase=true;

static {

private classESAPI = CreateObject("java", "org.owasp.esapi.ESAPI");

}

public static string function canonical(required string data) {

var Encoder = static.classESAPI.encoder();

return Encoder.canonicalize(data, false, false);

}

public static struct function getFormData(

required struct formData,

required array names,

boolean require = false,

any default = null

) {

var data = { };

for (var name in names) if (formData.keyExists(name)) {

data[name] = static.canonical(Trim(formData[name]));

} else

if (require) {

data[name] = default;

}

return data;

}

Excerpt Application.cfc

component {

processingdirective preserveCase=true;

public boolean function onRequestStart(string targetPage) {

request["FormUtil"] = new FormUtil();

return true;

}

Template view/_form_login_operator.cfm

processingdirective preserveCase=true;

param name = "layout" default = { };

param name = "layout.Site" default = "home";

param name = "data" default = { };

param name = "local" default = { };

param name = "data.UserName" default = "";

param name = "data.password1" default = "";

param name = "session[layout.Site].form.login" default = { };

local.session = session[layout.Site];

if (local.session.form.login.keyExists("data")) {

data.append(local.session.form.login.data, true);

} else

if (local.session.keyExists("user")) {

local.dataKeys = [

"UserName",

];

local.userData = request.FormUtil.getFormData(local.session.user, local.dataKeys, true, "");

if (local.session.user.find("redirected", false)) {

data.append(local.userData, true);

local.session.user.delete("redirected");

}

request.application.formDebugFill("login-operator", data);

request.FormUtil.encodeForHTMLAttribute(data);

local.session.form.login.token = request.FormUtil.getFormToken();

local.maxPassword = 24;

local.minPassword = 8;

</cfscript><cfoutput>

<div>

<label for="UserName" >Username:</label>

<input id="UserName" name="UserName"

autofocus

type="text" autocomplete="username"

value="#data.UserName#"

required="required">

</div>

<div>

<label for="password1">Password:</label>

<input id="password1" name="password1"

type="password"

minlength="#local.minPassword#"

maxlength="#local.maxPassword#"

autocomplete="current-password"

value="#data.password1#"

required="required">

<a class="help" href="pwreset.cfm" title="Request Password Reset">Lost password?</a>

</div>

</form>

</div>

</cfoutput>

Java Stack Traces

Java Stack Trace 1

lucee.runtime.exp.NativeException: Failed to load ESAPI.properties as a classloader resource.

at org.owasp.esapi.reference.DefaultSecurityConfiguration.loadConfigurationFromClasspath(DefaultSecurityConfiguration.java:866)

at org.owasp.esapi.reference.DefaultSecurityConfiguration.loadConfiguration(DefaultSecurityConfiguration.java:607)

at org.owasp.esapi.reference.DefaultSecurityConfiguration.<init>(DefaultSecurityConfiguration.java:387)

at org.owasp.esapi.reference.DefaultSecurityConfiguration.<init>(DefaultSecurityConfiguration.java:420)

at org.owasp.esapi.reference.DefaultSecurityConfiguration.getInstance(DefaultSecurityConfiguration.java:88)

at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)

at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

at java.base/java.lang.reflect.Method.invoke(Method.java:566)

at org.owasp.esapi.util.ObjFactory.make(ObjFactory.java:86)

at org.owasp.esapi.ESAPI.securityConfiguration(ESAPI.java:185)

at org.owasp.esapi.ESAPI.encoder(ESAPI.java:101)

at lucee.invoc.wrap.v3.org.owasp.esapi.ESAPI.encoder_11mw6cpi3sk2k.apply(Unknown Source)

at lucee.runtime.reflection.pairs.MethodInstance.invoke(MethodInstance.java:64)

at lucee.runtime.java.JavaObject.call(JavaObject.java:264)

at lucee.runtime.java.JavaObject.call(JavaObject.java:282)

at lucee.runtime.util.VariableUtilImpl.callFunctionWithoutNamedValues(VariableUtilImpl.java:796)

at lucee.runtime.PageContextImpl.getFunction(PageContextImpl.java:1992)

at formutil_cfc$cf.udfCall2(/FormUtil.cfc:442)

at formutil_cfc$cf.udfCall(/FormUtil.cfc)

at lucee.runtime.type.UDFImpl.implementation(UDFImpl.java:112)

at lucee.runtime.type.UDFImpl._call(UDFImpl.java:357)

at lucee.runtime.type.UDFImpl.call(UDFImpl.java:224)

at lucee.runtime.StaticScope._call(StaticScope.java:374)

at lucee.runtime.StaticScope.call(StaticScope.java:330)

at lucee.runtime.util.VariableUtilImpl.callFunctionWithoutNamedValues(VariableUtilImpl.java:796)

at lucee.runtime.PageContextImpl.getFunction(PageContextImpl.java:1992)

at formutil_cfc$cf.udfCall3(/FormUtil.cfc:625)

at formutil_cfc$cf.udfCall(/FormUtil.cfc)

at lucee.runtime.type.UDFImpl.implementation(UDFImpl.java:112)

at lucee.runtime.type.UDFImpl._call(UDFImpl.java:357)

at lucee.runtime.type.UDFImpl.call(UDFImpl.java:224)

at lucee.runtime.ComponentImpl._call(ComponentImpl.java:715)

at lucee.runtime.ComponentImpl._call(ComponentImpl.java:588)

at lucee.runtime.ComponentImpl.call(ComponentImpl.java:2033)

at lucee.runtime.util.VariableUtilImpl.callFunctionWithoutNamedValues(VariableUtilImpl.java:796)

at lucee.runtime.PageContextImpl.getFunction(PageContextImpl.java:1992)

at webreg.delektest.view._form_login_operator_cfm$cf.call(/webreg/DelekTest/view/_form_login_operator.cfm:18)

at lucee.runtime.PageContextImpl._doInclude(PageContextImpl.java:1046)

at lucee.runtime.PageContextImpl._doInclude(PageContextImpl.java:940)

at lucee.runtime.PageContextImpl.doInclude(PageContextImpl.java:921)

at webreg.delektest.view._layout_home_body_cfm$cf.call(/webreg/DelekTest/view/_layout_home_body.cfm:52)

at lucee.runtime.PageContextImpl._doInclude(PageContextImpl.java:1046)

at lucee.runtime.PageContextImpl._doInclude(PageContextImpl.java:940)

at lucee.runtime.PageContextImpl.doInclude(PageContextImpl.java:921)

at webreg.delektest.view._layout_home_cfm$cf.call(/webreg/DelekTest/view/_layout_home.cfm:34)

at lucee.runtime.PageContextImpl._doInclude(PageContextImpl.java:1046)

at lucee.runtime.PageContextImpl._doInclude(PageContextImpl.java:940)

at lucee.runtime.PageContextImpl.doInclude(PageContextImpl.java:921)

at webreg.delektest.login_cfm$cf.call(/webreg/DelekTest/login.cfm:33)

at lucee.runtime.PageContextImpl._doInclude(PageContextImpl.java:1046)

at lucee.runtime.PageContextImpl._doInclude(PageContextImpl.java:940)

at lucee.runtime.PageContextImpl.doInclude(PageContextImpl.java:921)

at webreg.delektest.admin.index_cfm$cf.call(/webreg/DelekTest/Admin/index.cfm:13)

at lucee.runtime.PageContextImpl._doInclude(PageContextImpl.java:1046)

at lucee.runtime.PageContextImpl._doInclude(PageContextImpl.java:940)

at lucee.runtime.listener.ModernAppListener._onRequest(ModernAppListener.java:213)

at lucee.runtime.listener.MixedAppListener.onRequest(MixedAppListener.java:41)

at lucee.runtime.PageContextImpl.execute(PageContextImpl.java:2725)

at lucee.runtime.PageContextImpl._execute(PageContextImpl.java:2712)

at lucee.runtime.PageContextImpl.executeCFML(PageContextImpl.java:2683)

at lucee.runtime.engine.Request.exe(Request.java:45)

at lucee.runtime.engine.CFMLEngineImpl._service(CFMLEngineImpl.java:1159)

at lucee.runtime.engine.CFMLEngineImpl.serviceCFML(CFMLEngineImpl.java:1116)

at lucee.loader.engine.CFMLEngineWrapper.serviceCFML(CFMLEngineWrapper.java:97)

at lucee.loader.servlet.CFMLServlet.service(CFMLServlet.java:51)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:733)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:227)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)

at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)

at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202)

at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97)

at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:542)

at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:143)

at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)

at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:687)

at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78)

at org.apache.catalina.valves.RemoteIpValve.invoke(RemoteIpValve.java:764)

at org.apache.catalina.valves.RequestFilterValve.process(RequestFilterValve.java:378)

at net.pino.catalina.valves.RequestPathValve.invoke(RequestPathValve.java:30)

at net.pino.catalina.valves.FilePath404Valve.invoke(FilePath404Valve.java:89)

at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:354)

at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:382)

at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)

at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:888)

at org.apache.tomcat.util.net.AprEndpoint$SocketWithOptionsProcessor.run(AprEndpoint.java:1961)

at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)

at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)

at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)

at java.base/java.lang.Thread.run(Thread.java:829)

Caused by: java.lang.IllegalArgumentException: Failed to load ESAPI.properties as a classloader resource.

... 92 more

Java Stack Trace 2

lucee.runtime.exp.NativeException: ESAPI.properties could not be loaded by any means. Fail.

at org.owasp.esapi.reference.DefaultSecurityConfiguration.loadConfiguration(DefaultSecurityConfiguration.java:610)