Uploaded image for project: 'RESTEasy'
  1. RESTEasy
  2. RESTEASY-3228 Analyze the RESTEasy Test Suite and enable the security manager for testing on WildFly
  3. RESTEASY-3229

The Options should allow for a safe lookup of values

XMLWordPrintable

    • Icon: Sub-task Sub-task
    • Resolution: Done
    • Icon: Major Major
    • 6.2.1.Final
    • None
    • Core
    • None

      In WildFly the following tests are failing with the security manager enabled:

      • org.wildfly.test.integration.observability.opentelemetry.BasicOpenTelemetryTestCase
      • org.wildfly.test.integration.observability.opentelemetry.OpenTelemetryNoCdiTestCase
      • org.wildfly.test.integration.microprofile.opentracing.SimpleRestClientTestCase
      • org.jboss.as.test.manualmode.server.nongraceful.NongracefulStartTestCase
      • org.wildfly.test.manual.observability.opentelemetry.ContextPropagationTestCase

      The failure is:

      11:28:17,566 SEVERE [org.jboss.arquillian.protocol.jmx.JMXTestRunner] (pool-20-thread-1) Failed: org.wildfly.test.integration.observability.opentelemetry.BasicOpenTelemetryTestCase.restClientHasFilterAdded: java.security.AccessControlException: WFSM000001: Permission check failed (permission "("java.lang.RuntimePermission" "getenv.dev.resteasy.exception.mapper")" in code source "(vfs:/content/BasicOpenTelemetryTestCase.war/WEB-INF/classes <no signer certificates>)" of "ModuleClassLoader for Module "deployment.BasicOpenTelemetryTestCase.war" from Service Module Loader")
	at org.wildfly.security.elytron-base@2.0.0.Final//org.wildfly.security.manager.WildFlySecurityManager.checkPermission(WildFlySecurityManager.java:309)
	at org.wildfly.security.elytron-base@2.0.0.Final//org.wildfly.security.manager.WildFlySecurityManager.checkPermission(WildFlySecurityManager.java:201)
	at java.base/java.lang.System.getenv(System.java:999)
	at org.jboss.resteasy.resteasy-core-spi@6.2.0.Final//org.jboss.resteasy.spi.config.DefaultConfiguration$Resolver.apply(DefaultConfiguration.java:120)
	at org.jboss.resteasy.resteasy-core-spi@6.2.0.Final//org.jboss.resteasy.spi.config.DefaultConfiguration$Resolver.apply(DefaultConfiguration.java:109)
	at org.jboss.resteasy.resteasy-core-spi@6.2.0.Final//org.jboss.resteasy.spi.config.DefaultConfiguration.getOptionalValue(DefaultConfiguration.java:64)
	at org.jboss.resteasy.resteasy-core-spi@6.2.0.Final//org.jboss.resteasy.spi.config.Options.getProperty(Options.java:129)
	at org.jboss.resteasy.resteasy-core-spi@6.2.0.Final//org.jboss.resteasy.spi.config.Options.getProperty(Options.java:123)
	at org.jboss.resteasy.resteasy-core-spi@6.2.0.Final//org.jboss.resteasy.spi.config.Options.getValue(Options.java:79)
	at org.jboss.resteasy.resteasy-core@6.2.0.Final//org.jboss.resteasy.core.providerfactory.ResteasyProviderFactoryImpl.<init>(ResteasyProviderFactoryImpl.java:149)
	at org.jboss.resteasy.resteasy-core@6.2.0.Final//org.jboss.resteasy.plugins.providers.RegisterBuiltin$1.<init>(RegisterBuiltin.java:46)
	at org.jboss.resteasy.resteasy-core@6.2.0.Final//org.jboss.resteasy.plugins.providers.RegisterBuiltin.getClientInitializedResteasyProviderFactory(RegisterBuiltin.java:46)
	at org.jboss.resteasy.resteasy-client@6.2.0.Final//org.jboss.resteasy.client.jaxrs.internal.ResteasyClientBuilderImpl.getProviderFactory(ResteasyClientBuilderImpl.java:378)
	at org.jboss.resteasy.resteasy-client@6.2.0.Final//org.jboss.resteasy.client.jaxrs.internal.ResteasyClientBuilderImpl.build(ResteasyClientBuilderImpl.java:396)
	at org.jboss.resteasy.resteasy-client@6.2.0.Final//org.jboss.resteasy.client.jaxrs.internal.ResteasyClientBuilderImpl.build(ResteasyClientBuilderImpl.java:48)
	at jakarta.ws.rs.api@3.1.0//jakarta.ws.rs.client.ClientBuilder.newClient(ClientBuilder.java:86)
	at deployment.BasicOpenTelemetryTestCase.war//org.wildfly.test.integration.observability.opentelemetry.BasicOpenTelemetryTestCase.restClientHasFilterAdded(BasicOpenTelemetryTestCase.java:106)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at deployment.arquillian-service//org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:59)
	at deployment.arquillian-service//org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
	at deployment.arquillian-service//org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:56)
	at deployment.arquillian-service//org.jboss.arquillian.junit.Arquillian$8$1.invokeMethod(Arquillian.java:325)
	at deployment.arquillian-service//org.jboss.arquillian.junit.MethodInvoker$1.invoke(MethodInvoker.java:18)
	at deployment.arquillian-service//org.jboss.arquillian.container.test.impl.execution.LocalTestExecuter.execute(LocalTestExecuter.java:57)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at deployment.arquillian-service//org.jboss.arquillian.core.impl.ObserverImpl.invoke(ObserverImpl.java:86)
	at deployment.arquillian-service//org.jboss.arquillian.core.impl.EventContextImpl.invokeObservers(EventContextImpl.java:103)
	at deployment.arquillian-service//org.jboss.arquillian.core.impl.EventContextImpl.proceed(EventContextImpl.java:90)
	at deployment.arquillian-service//org.jboss.arquillian.core.impl.ManagerImpl.fire(ManagerImpl.java:133)
	at deployment.arquillian-service//org.jboss.arquillian.core.impl.ManagerImpl.fire(ManagerImpl.java:105)
	at deployment.arquillian-service//org.jboss.arquillian.core.impl.EventImpl.fire(EventImpl.java:62)
	at deployment.arquillian-service//org.jboss.arquillian.container.test.impl.execution.ContainerTestExecuter.execute(ContainerTestExecuter.java:36)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at deployment.arquillian-service//org.jboss.arquillian.core.impl.ObserverImpl.invoke(ObserverImpl.java:86)
	at deployment.arquillian-service//org.jboss.arquillian.core.impl.EventContextImpl.invokeObservers(EventContextImpl.java:103)
	at deployment.arquillian-service//org.jboss.arquillian.core.impl.EventContextImpl.proceed(EventContextImpl.java:90)
	at deployment.arquillian-service//org.jboss.arquillian.test.impl.TestContextHandler.createTestContext(TestContextHandler.java:116)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at deployment.arquillian-service//org.jboss.arquillian.core.impl.ObserverImpl.invoke(ObserverImpl.java:86)
	at deployment.arquillian-service//org.jboss.arquillian.core.impl.EventContextImpl.proceed(EventContextImpl.java:95)
	at deployment.arquillian-service//org.jboss.arquillian.test.impl.TestContextHandler.createClassContext(TestContextHandler.java:83)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at deployment.arquillian-service//org.jboss.arquillian.core.impl.ObserverImpl.invoke(ObserverImpl.java:86)
	at deployment.arquillian-service//org.jboss.arquillian.core.impl.EventContextImpl.proceed(EventContextImpl.java:95)
	at deployment.arquillian-service//org.jboss.arquillian.test.impl.TestContextHandler.createSuiteContext(TestContextHandler.java:69)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at deployment.arquillian-service//org.jboss.arquillian.core.impl.ObserverImpl.invoke(ObserverImpl.java:86)
	at deployment.arquillian-service//org.jboss.arquillian.core.impl.EventContextImpl.proceed(EventContextImpl.java:95)
	at deployment.arquillian-service//org.jboss.arquillian.core.impl.ManagerImpl.fire(ManagerImpl.java:133)
	at deployment.arquillian-service//org.jboss.arquillian.test.impl.EventTestRunnerAdaptor.test(EventTestRunnerAdaptor.java:139)
	at deployment.arquillian-service//org.jboss.arquillian.junit.MethodInvoker.invoke(MethodInvoker.java:15)
	at deployment.arquillian-service//org.jboss.arquillian.junit.Arquillian$8.evaluate(Arquillian.java:332)
	at deployment.arquillian-service//org.jboss.arquillian.junit.Arquillian$4.evaluate(Arquillian.java:204)
	at deployment.arquillian-service//org.jboss.arquillian.junit.Arquillian.multiExecute(Arquillian.java:350)
	at deployment.arquillian-service//org.jboss.arquillian.junit.Arquillian.access$200(Arquillian.java:54)
	at deployment.arquillian-service//org.jboss.arquillian.junit.Arquillian$5.evaluate(Arquillian.java:215)
	at deployment.arquillian-service//org.jboss.arquillian.junit.Arquillian$7$1.invoke(Arquillian.java:279)
	at deployment.arquillian-service//org.jboss.arquillian.container.test.impl.execution.BeforeLifecycleEventExecuter.on(BeforeLifecycleEventExecuter.java:34)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at deployment.arquillian-service//org.jboss.arquillian.core.impl.ObserverImpl.invoke(ObserverImpl.java:86)
	at deployment.arquillian-service//org.jboss.arquillian.core.impl.EventContextImpl.invokeObservers(EventContextImpl.java:103)
	at deployment.arquillian-service//org.jboss.arquillian.core.impl.EventContextImpl.proceed(EventContextImpl.java:90)
	at deployment.arquillian-service//org.jboss.arquillian.test.impl.TestContextHandler.createTestContext(TestContextHandler.java:116)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at deployment.arquillian-service//org.jboss.arquillian.core.impl.ObserverImpl.invoke(ObserverImpl.java:86)
	at deployment.arquillian-service//org.jboss.arquillian.core.impl.EventContextImpl.proceed(EventContextImpl.java:95)
	at deployment.arquillian-service//org.jboss.arquillian.test.impl.TestContextHandler.createClassContext(TestContextHandler.java:83)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at deployment.arquillian-service//org.jboss.arquillian.core.impl.ObserverImpl.invoke(ObserverImpl.java:86)
	at deployment.arquillian-service//org.jboss.arquillian.core.impl.EventContextImpl.proceed(EventContextImpl.java:95)
	at deployment.arquillian-service//org.jboss.arquillian.test.impl.TestContextHandler.createSuiteContext(TestContextHandler.java:69)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at deployment.arquillian-service//org.jboss.arquillian.core.impl.ObserverImpl.invoke(ObserverImpl.java:86)
	at deployment.arquillian-service//org.jboss.arquillian.core.impl.EventContextImpl.proceed(EventContextImpl.java:95)
	at deployment.arquillian-service//org.jboss.arquillian.core.impl.ManagerImpl.fire(ManagerImpl.java:133)
	at deployment.arquillian-service//org.jboss.arquillian.core.impl.ManagerImpl.fire(ManagerImpl.java:105)
	at deployment.arquillian-service//org.jboss.arquillian.test.impl.EventTestRunnerAdaptor.fireCustomLifecycle(EventTestRunnerAdaptor.java:159)
	at deployment.arquillian-service//org.jboss.arquillian.junit.Arquillian$7.evaluate(Arquillian.java:273)
	at deployment.arquillian-service//org.junit.runners.BlockJUnit4ClassRunner$1.evaluate(BlockJUnit4ClassRunner.java:100)
	at deployment.arquillian-service//org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:366)
	at deployment.arquillian-service//org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:103)
	at deployment.arquillian-service//org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:63)
	at deployment.arquillian-service//org.junit.runners.ParentRunner$4.run(ParentRunner.java:331)
	at deployment.arquillian-service//org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:79)
	at deployment.arquillian-service//org.junit.runners.ParentRunner.runChildren(ParentRunner.java:329)
	at deployment.arquillian-service//org.junit.runners.ParentRunner.access$100(ParentRunner.java:66)
	at deployment.arquillian-service//org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:293)
	at deployment.arquillian-service//org.jboss.arquillian.junit.Arquillian$2.evaluate(Arquillian.java:166)
	at deployment.arquillian-service//org.jboss.arquillian.junit.Arquillian.multiExecute(Arquillian.java:350)
	at deployment.arquillian-service//org.jboss.arquillian.junit.Arquillian.access$200(Arquillian.java:54)
	at deployment.arquillian-service//org.jboss.arquillian.junit.Arquillian$3.evaluate(Arquillian.java:177)
	at deployment.arquillian-service//org.junit.runners.ParentRunner$3.evaluate(ParentRunner.java:306)
	at deployment.arquillian-service//org.junit.runners.ParentRunner.run(ParentRunner.java:413)
	at deployment.arquillian-service//org.jboss.arquillian.junit.Arquillian.run(Arquillian.java:115)
	at deployment.arquillian-service//org.junit.runner.JUnitCore.run(JUnitCore.java:137)
	at deployment.arquillian-service//org.junit.runner.JUnitCore.run(JUnitCore.java:115)
	at deployment.arquillian-service//org.jboss.arquillian.junit.container.JUnitTestRunner.execute(JUnitTestRunner.java:61)
	at deployment.arquillian-service//org.jboss.arquillian.protocol.jmx.JMXTestRunner.doRunTestMethod(JMXTestRunner.java:153)
	at deployment.arquillian-service//org.jboss.as.arquillian.service.ArquillianService$ExtendedJMXTestRunner.doRunTestMethod(ArquillianService.java:202)
	at deployment.arquillian-service//org.jboss.arquillian.protocol.jmx.JMXTestRunner.runTestMethodInternal(JMXTestRunner.java:137)
	at deployment.arquillian-service//org.jboss.arquillian.protocol.jmx.JMXTestRunner.runTestMethod(JMXTestRunner.java:119)
	at deployment.arquillian-service//org.jboss.as.arquillian.service.ArquillianService$ExtendedJMXTestRunner.runTestMethod(ArquillianService.java:178)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at sun.reflect.misc.Trampoline.invoke(MethodUtil.java:71)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at java.base/sun.reflect.misc.MethodUtil.invoke(MethodUtil.java:260)
	at java.management/com.sun.jmx.mbeanserver.StandardMBeanIntrospector.invokeM2(StandardMBeanIntrospector.java:112)
	at java.management/com.sun.jmx.mbeanserver.StandardMBeanIntrospector.invokeM2(StandardMBeanIntrospector.java:46)
	at java.management/com.sun.jmx.mbeanserver.MBeanIntrospector.invokeM(MBeanIntrospector.java:237)
	at java.management/com.sun.jmx.mbeanserver.PerInterface.invoke(PerInterface.java:138)
	at java.management/com.sun.jmx.mbeanserver.MBeanSupport.invoke(MBeanSupport.java:252)
	at java.management/com.sun.jmx.interceptor.DefaultMBeanServerInterceptor.invoke(DefaultMBeanServerInterceptor.java:809)
	at java.management/com.sun.jmx.mbeanserver.JmxMBeanServer.invoke(JmxMBeanServer.java:801)
	at org.jboss.as.jmx@19.0.0.Beta18//org.jboss.as.jmx.PluggableMBeanServerImpl$TcclMBeanServer.invoke(PluggableMBeanServerImpl.java:1493)
	at org.jboss.as.jmx@19.0.0.Beta18//org.jboss.as.jmx.PluggableMBeanServerImpl.invoke(PluggableMBeanServerImpl.java:726)
	at org.jboss.as.jmx@19.0.0.Beta18//org.jboss.as.jmx.BlockingNotificationMBeanServer.invoke(BlockingNotificationMBeanServer.java:168)
	at org.jboss.as.jmx@19.0.0.Beta18//org.jboss.as.jmx.AuthorizingMBeanServer.invoke(AuthorizingMBeanServer.java:258)
	at org.jboss.remoting-jmx@3.0.4.Final//org.jboss.remotingjmx.protocol.v2.ServerProxy$InvokeHandler.handle(ServerProxy.java:950)
	at org.jboss.remoting-jmx@3.0.4.Final//org.jboss.remotingjmx.protocol.v2.ServerCommon$MessageReciever$1$1.run(ServerCommon.java:153)
	at org.jboss.as.jmx@19.0.0.Beta18//org.jboss.as.jmx.ServerInterceptorFactory$Interceptor$1.run(ServerInterceptorFactory.java:71)
	at org.jboss.as.jmx@19.0.0.Beta18//org.jboss.as.jmx.ServerInterceptorFactory$Interceptor$1.run(ServerInterceptorFactory.java:66)
	at org.wildfly.security.elytron-base@2.0.0.Final//org.wildfly.security.auth.server.SecurityIdentity.runAs(SecurityIdentity.java:328)
	at org.wildfly.security.elytron-base@2.0.0.Final//org.wildfly.security.auth.server.SecurityIdentity.runAs(SecurityIdentity.java:285)
	at org.jboss.as.controller@19.0.0.Beta18//org.jboss.as.controller.AccessAuditContext.doAs(AccessAuditContext.java:254)
	at org.jboss.as.controller@19.0.0.Beta18//org.jboss.as.controller.AccessAuditContext.doAs(AccessAuditContext.java:225)
	at org.jboss.as.jmx@19.0.0.Beta18//org.jboss.as.jmx.ServerInterceptorFactory$Interceptor.handleEvent(ServerInterceptorFactory.java:66)
	at org.jboss.remoting-jmx@3.0.4.Final//org.jboss.remotingjmx.protocol.v2.ServerCommon$MessageReciever$1.run(ServerCommon.java:149)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
	at java.base/java.lang.Thread.run(Thread.java:829)

      This is specifically due to the org.jboss.resteasy.spi.config.DefaultConfiguration looking up of environment variables and system properties. This should likely happen in the Options and not the DefaultConfiguration to ensure the correct protection domain is used. In WildFly this should be the case, but the other cases need to be thought out.

              jperkins-rhn James Perkins
              jperkins-rhn James Perkins
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: