org.owasp.esapi.errors.ConfigurationException: java.lang.reflect.InvocationTargetException 调用 ESAPI.encoder() 时出错

Question

执行以下代码时出现以下错误。它之前正在工作，现在突然开始抛出这个异常。

import org.owasp.esapi.ESAPI;
import org.owasp.esapi.Encoder;
import org.owasp.esapi.codecs.Codec;
import org.owasp.esapi.codecs.OracleCodec;
public List<SearchUserBean> getSearchUserResult(SearchUserBean searchUserBean){
Codec ORACLE_CODEC = new OracleCodec();
String WHERE="WHERE be.EMPLOYER_ID   =comp.business_asso ";
        if (searchUserBean.getEmailAddress()!=null && !(searchUserBean.getEmailAddress().isEmpty())) {
            WHERE +="AND upper(be.EMAIL_ID) LIKE '" +ESAPI.encoder().encodeForSQL( ORACLE_CODEC, searchUserBean.getEmailAddress().replace("*", "%").toUpperCase().trim()) +"' ";
        }   
return null;    
}

收到错误。

org.owasp.esapi.errors.ConfigurationException: java.lang.reflect.InvocationTargetException Encoder class (org.owasp.esapi.reference.DefaultEncoder) CTOR threw exception.
at org.owasp.esapi.util.ObjFactory.make(ObjFactory.java:129)
at org.owasp.esapi.ESAPI.encoder(ESAPI.java:99)
at com.beacon.search.dao.impl.SearchUserDaoImpl.getSearchUserResult(SearchUserDaoImpl.java:73)
at com.beacon.search.services.impl.SearchUserServiceImpl.getSearchUserResult(SearchUserServiceImpl.java:68)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:606)
at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:317)
at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:183)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:150)
at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:110)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:204)
at com.sun.proxy.$Proxy294.getSearchUserResult(Unknown Source)
at com.beacon.search.controller.SearchUserController.getSearchUserResult(SearchUserController.java:133)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:606)
at org.springframework.web.method.support.InvocableHandlerMethod.invoke(InvocableHandlerMethod.java:219)
at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:132)
at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:104)
at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandleMethod(RequestMappingHandlerAdapter.java:745)
at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:686)
at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:80)
at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:925)
at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:856)
at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:936)
at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.

Answer 1

@Vidyuth - 我有几个问题。

1. 上次运行时您使用的是什么版本的 ESAPI，现在使用的是什么版本？
2. 在您的 ESAPI.properties 文件中，您将属性“ESAPI.Logger”设置为什么？

我问的一个原因是因为在 ESAPI 2.2.1.0 版本中，一些日志记录被重组，所以如果你来自早期版本并且没有更新 ESAPI.Logger，事情就会中断。以下是 ESAPI 2.2.1.0 的部分发行说明：

    *** IMPORTANT WORKAROUND for 2.2.1.0 ESAPI Logging ***

Lastly, if you try to use the new ESAPI 2.2.1.0 logging, you will notice that you need to change ESAPI.Logger and also possibly provide some other logging properties as well. This is because the logger packages were reorganized to improve maintainability, but we failed to mention it. To use ESAPI logging in ESAPI 2.2.1.0 (and later), you MUST set the ESAPI.Logger property to one of:

    org.owasp.esapi.logging.java.JavaLogFactory     - To use the new default, java.util.logging (JUL)
    org.owasp.esapi.logging.log4j.Log4JLogFactory   - To use the end-of-life Log4J 1.x logger
    org.owasp.esapi.logging.slf4j.Slf4JLogFactory   - To use the new (to release 2.2.0.0) SLF4J logger