Uploaded image for project: 'JBoss Enterprise Application Platform 4 and 5'
  1. JBoss Enterprise Application Platform 4 and 5
  2. JBPAPP-4665

signed cglib.jar doesn't work in guice-hello example

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • Major
    • EAP_EWP 5.1.1
    • EAP_EWP 5.1.0_CR1
    • RESTEasy
    • None
    • Hide

      edit guice-hello pom: remove jetty plugin, disable surefire
      mvn install should work then
      take the target/guice-hello-1.2.1.GA_CP02.war and replace libs in WEB-INF/lib with their equivalents from jboss-eap-5.1.0.CR1.zip/jboss-eap-5.1/resteasy/lib
      deploy this war to EAP5.1.0.CR1 production profile
      the deployment should fail

      Show
      edit guice-hello pom: remove jetty plugin, disable surefire mvn install should work then take the target/guice-hello-1.2.1.GA_CP02.war and replace libs in WEB-INF/lib with their equivalents from jboss-eap-5.1.0.CR1.zip/jboss-eap-5.1/resteasy/lib deploy this war to EAP5.1.0.CR1 production profile the deployment should fail
    • Documentation (Ref Guide, User Guide, etc.), Release Notes
    • Hide
      Resteasy-guice applications fail to deploy because of a java.lang.SecurityException. An error message similar to the following is displayed: <screen>java.lang.SecurityException: class "org.jboss.resteasy.examples.guice.hello.DefaultGreeter$$FastClassByGuice$$70fd68d0"'s signer information does not match signer information of other classes in the same package</screen>
      This occurs because the cglib.jar in JBoss Enterprise Application Platform is signed, and the cglib-instrumented proxy uses the cglib.jar signer information instead of the signer information of the application target class.
      Show
      Resteasy-guice applications fail to deploy because of a java.lang.SecurityException. An error message similar to the following is displayed: <screen>java.lang.SecurityException: class "org.jboss.resteasy.examples.guice.hello.DefaultGreeter$$FastClassByGuice$$70fd68d0"'s signer information does not match signer information of other classes in the same package</screen> This occurs because the cglib.jar in JBoss Enterprise Application Platform is signed, and the cglib-instrumented proxy uses the cglib.jar signer information instead of the signer information of the application target class.
    • Documented as Known Issue

    Description

      the bundled signed jar jboss-eap-5.1.0.CR1.zip/jboss-eap-5.1/resteasy/lib/guice.jar
      cannot be used with guice-hello example
      when I deployed the war containing this version of jar to EAP, the deployment fails with error message:

      java.lang.SecurityException: class "org.jboss.resteasy.examples.guice.hello.DefaultGreeter$$FastClassByGuice$$70fd68d0"'s signer information does not match signer information of other classes in the same package

      (see logged-problem.txt for details)

      I don't have any theory for this, I just know that this is the issue of signed guice.jar vs unsigned guice.jar, because I tried to isolate this issue in a standalone smaller testapp (no war)
      It seems as the CGLib generated class "org.jboss.resteasy.examples.guice.hello.DefaultGreeter$$FastClassByGuice$$70fd68d0" is treated as having the same signer as guice.jar (not cglib.jar, because the combination signed cglib.jar and unsigned guice.jar works) and therefore this conflicts with other classes in "org.jboss.resteasy.examples.guice.hello" which are unsigned.

      this would mean that only code with same signer as guice.jar may use this library, which is kinda restraining.

      Attachments

        1. guice-fail.zip
          1.05 MB
        2. logged-problem.txt
          27 kB

        Issue Links

          Activity

            People

              mlinhard Michal Linhard (Inactive)
              mlinhard Michal Linhard (Inactive)
              Russell Dickenson Russell Dickenson (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: