Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 851
  • Last Modified:

Classes in tomcat\server\lib folder sometimes are visible to web application

We are using Tomcat 5.5.17 and are using a custom ClassLoader, which we specify using the Loader element per the documentation at http://tomcat.apache.org/tomcat-5.5-doc/config/loader.html.

We place the jar containing our custom ClassLoader in the tomcat\server\lib folder, per the documentation at http://tomcat.apache.org/tomcat-5.5-doc/class-loader-howto.html.  (I forget why we did this originally, but I think we had problems if we put it elsewhere.)  According to this documentation, classes in this jar should be TOTALLY invisible to web applications.  And indeed, for the most part, if we try to reference some class  in this jar, we get a java.lang.NoClassDefFoundError.  What is strange, however, is that sometimes the web-app does seem to find classes in this jar.   Even more strange, it does not seem to be deterministic.  The app will work for a few days, and then it wont.  So I understand why it does not work (class should not be visible), but why does it ever work?

Does anyone have any thoughts on what might be going on?
0
gh5
Asked:
gh5
  • 3
2 Solutions
 
chaitu chaituCommented:
put this jar file  tomcat\common\lib folder,
0
 
Ajay-SinghCommented:
Can you post the code of custom classloader?
0
 
gh5Author Commented:
chaituu, we are doing that as a separate course of action, but that doesn't really address my question.  I am wondering how we ever see the behavior where the class is recognized (i.e. no ClassDefNotFound error) when the jar is in tomcat\server\lib folder
0
 
gh5Author Commented:
Ajay-Singh: Below is a stripped-down version of our custom classloader -- the rest of the code is comments and debug statements.  Obviously, the heart of the work is done in ClassFileLocationFinder.getClassFileLocations().  I have not included that method, but it just uses our configuration information (file locations indicated by system properties set when launching Java) to determine the urls of the jars to include.  The issue (or non-issue I guess) arises when we try to access ClassFileLocationFinder directly from one of our web-app classes -- it seems that the webapp should never be able to see that class, but sometimes it does, and sometimes it doesn't.


package custom.classloader;

import java.net.URL;
import org.apache.catalina.loader.WebappClassLoader;

public abstract class CustomCatalinaWebappClassLoader extends WebappClassLoader{
 
public CustomCatalinaWebappClassLoader(ClassLoader parent) {
  super(parent);
  init();
  }
 
  private void init(){
      URL[] urls = ClassFileLocationFinder.getClassFileLocations();
      for (URL url : urls){
          this.addURL(url);      
          //super.addRepository(url.toExternalForm());
   }
  }
}


0
 
gh5Author Commented:
We have resolved the issue and it turns out that my initial assertion about our server/lib classes being visible to our web app was incorrect -- it was just that our custom classloader was SOMETIMES loading these classes from a different location, and therefore no error was reported in these cases.  The custom classloader was never actually seeing the classes in server/lib -- it was seein a duplicate for those classes defined elsewhere.  The non-determinism came from a configuration mistake with our custom classloader logic.

Even though the issue is resolved, I would like to award some points to chaituu.  The comment about common/lib didn't resolve the issue, but it did lead to some testing that ultimately led us to figure out the problem.  And this led us to redesign the system in a cleaner way so that we don't have jars containing duplicate classes.
 
Putting the jar in common/lib does not work (and is the reason we avoided it in the first place) because our custom class loader has to extend org.apache.catalina.loader.WebappClassLoaded, which is not visible to common/lib.  However, we split the jar into two, putting the custom ClassLoader into sever/lib and the support classes into common/lib.  Our web-app can now access the support classes without getting errors, and the custom ClassLoader works fine.

How do I go about awarding partial points?

0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now