Bug 55357 - Cannot deserialize session when it contains Externalizable objects (using PersistentManager)
Cannot deserialize session when it contains Externalizable objects (using Per...
Status: RESOLVED FIXED
Product: Tomcat 7
Classification: Unclassified
Component: Catalina
7.0.42
PC All
: P2 major (vote)
: ---
Assigned To: Tomcat Developers Mailing List
:
Depends on:
Blocks:
  Show dependency tree
 
Reported: 2013-08-05 15:15 UTC by Maxime Falaize
Modified: 2013-08-15 19:47 UTC (History)
0 users



Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Maxime Falaize 2013-08-05 15:15:18 UTC
I'm using PersistentManager with JDBCStore to store sessions in my database. But in my webapplication, there is an object in my session which is an instance of org.apache.el.MethodExpressionImpl. This class implements the Externalizable interface but in this readExternal method it uses org.apache.el.util.ReflectionUtil.forName(String) which use Thread.currentThread().getContextClassLoader() as its ClassLoader.

It seems to be incorrect because this method return a StandardClassLoader which cannot find my classes in WEB-INF/lib directory of my webapp.

Is it the problem of the MethodExpressionImpl class which use this method or the JDBCStore which does not set the thread contextClassLoader as the WebappClassLoader ?

Here is the stacktrace :

SEVERE: Error processing request
java.lang.IllegalStateException: Erreur lors de la désérialisation de la session 1634C328D27A31CB9FC4D52392FDB05F: {1}
	at org.apache.catalina.session.PersistentManagerBase.swapIn(PersistentManagerBase.java:713)
	at org.apache.catalina.session.PersistentManagerBase.findSession(PersistentManagerBase.java:503)
	at org.apache.catalina.connector.Request.isRequestedSessionIdValid(Request.java:2391)
	at org.apache.catalina.connector.CoyoteAdapter.parseSessionCookiesId(CoyoteAdapter.java:954)
	at org.apache.catalina.connector.CoyoteAdapter.postParseRequest(CoyoteAdapter.java:688)
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:402)
	at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1002)
	at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:585)
	at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:312)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
	at java.lang.Thread.run(Thread.java:722)
Caused by: java.lang.ClassNotFoundException: javax.faces.event.ActionEvent
	at java.net.URLClassLoader$1.run(URLClassLoader.java:366)
	at java.net.URLClassLoader$1.run(URLClassLoader.java:355)
	at java.security.AccessController.doPrivileged(Native Method)
	at java.net.URLClassLoader.findClass(URLClassLoader.java:354)
	at java.lang.ClassLoader.loadClass(ClassLoader.java:423)
	at java.lang.ClassLoader.loadClass(ClassLoader.java:356)
	at java.lang.Class.forName0(Native Method)
	at java.lang.Class.forName(Class.java:266)
	at org.apache.el.util.ReflectionUtil.forName(ReflectionUtil.java:62)
	at org.apache.el.util.ReflectionUtil.toTypeArray(ReflectionUtil.java:88)
	at org.apache.el.MethodExpressionImpl.readExternal(MethodExpressionImpl.java:290)
	at java.io.ObjectInputStream.readExternalData(ObjectInputStream.java:1835)
	at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1794)
	at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1348)
	at java.io.ObjectInputStream.readObject(ObjectInputStream.java:370)
	at com.sun.facelets.el.TagMethodExpression.readExternal(TagMethodExpression.java:101)
	at java.io.ObjectInputStream.readExternalData(ObjectInputStream.java:1835)
	at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1794)
	at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1348)
	at java.io.ObjectInputStream.readArray(ObjectInputStream.java:1704)
	at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1342)
	at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:1989)
	at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:1913)
	at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1796)
	at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1348)
	at java.io.ObjectInputStream.readObject(ObjectInputStream.java:370)
	at java.util.ArrayList.readObject(ArrayList.java:733)
	at sun.reflect.GeneratedMethodAccessor90.invoke(Unknown Source)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:601)
	at java.io.ObjectStreamClass.invokeReadObject(ObjectStreamClass.java:1004)
	at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:1891)
	at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1796)
	at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1348)
	at java.io.ObjectInputStream.readArray(ObjectInputStream.java:1704)
	at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1342)
	at java.io.ObjectInputStream.readArray(ObjectInputStream.java:1704)
	at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1342)
	at java.io.ObjectInputStream.readArray(ObjectInputStream.java:1704)
	at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1342)
	at java.io.ObjectInputStream.readArray(ObjectInputStream.java:1704)
	at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1342)
	at java.io.ObjectInputStream.readArray(ObjectInputStream.java:1704)
	at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1342)
	at java.io.ObjectInputStream.readArray(ObjectInputStream.java:1704)
	at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1342)
	at java.io.ObjectInputStream.readArray(ObjectInputStream.java:1704)
	at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1342)
	at java.io.ObjectInputStream.readArray(ObjectInputStream.java:1704)
	at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1342)
	at java.io.ObjectInputStream.readArray(ObjectInputStream.java:1704)
	at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1342)
	at java.io.ObjectInputStream.readArray(ObjectInputStream.java:1704)
	at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1342)
	at java.io.ObjectInputStream.readArray(ObjectInputStream.java:1704)
	at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1342)
	at java.io.ObjectInputStream.readArray(ObjectInputStream.java:1704)
	at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1342)
	at java.io.ObjectInputStream.readArray(ObjectInputStream.java:1704)
	at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1342)
	at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:1989)
	at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:1913)
	at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1796)
	at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1348)
	at java.io.ObjectInputStream.readObject(ObjectInputStream.java:370)
	at java.util.HashMap.readObject(HashMap.java:1155)
	at sun.reflect.GeneratedMethodAccessor89.invoke(Unknown Source)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:601)
	at java.io.ObjectStreamClass.invokeReadObject(ObjectStreamClass.java:1004)
	at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:1891)
	at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1796)
	at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1348)
	at java.io.ObjectInputStream.readObject(ObjectInputStream.java:370)
	at java.util.HashMap.readObject(HashMap.java:1155)
	at sun.reflect.GeneratedMethodAccessor89.invoke(Unknown Source)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:601)
	at java.io.ObjectStreamClass.invokeReadObject(ObjectStreamClass.java:1004)
	at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:1891)
	at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1796)
	at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1348)
	at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:1989)
	at java.io.ObjectInputStream.defaultReadObject(ObjectInputStream.java:499)
	at org.ajax4jsf.application.AjaxStateHolder.readObject(AjaxStateHolder.java:204)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:601)
	at java.io.ObjectStreamClass.invokeReadObject(ObjectStreamClass.java:1004)
	at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:1891)
	at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1796)
	at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1348)
	at java.io.ObjectInputStream.readObject(ObjectInputStream.java:370)
	at org.apache.catalina.session.StandardSession.readObject(StandardSession.java:1595)
	at org.apache.catalina.session.StandardSession.readObjectData(StandardSession.java:1060)
	at org.apache.catalina.session.JDBCStore.load(JDBCStore.java:657)
	at org.apache.catalina.session.PersistentManagerBase.swapIn(PersistentManagerBase.java:707)
	... 11 more
Comment 1 Maxime Falaize 2013-08-07 12:02:45 UTC
My workaround to make it working is to add Thread.currentThread().setContextClassLoader(classLoader) in the JDBCStore (between line 644 and 645 in method load(String):Session) :

if (classLoader != null)
   Thread.currentThread().setContextClassLoader(classLoader);
   ois = new CustomObjectInputStream(bis, classLoader);
} else {
   ois = new ObjectInputStream(bis);
}

Maybe add a try catch to catch the SecurityException thrown by the setContextClassLoader method.
Comment 2 Violeta Georgieva 2013-08-15 19:47:30 UTC
Thanks for the report.
Fixed in trunk and 7.0.x and will be included in 7.0.43 onwards.