ESAPI - java.lang.reflect.InvocationTargetException....java.lang.ClassCastException: org.owasp.esapi.reference.Log4JLogger ...

參考： How to resolve the error "java.lang.reflect.InvocationTargetException"

今天ＥＳＡＰＩ又出現了這個似曾相似（前篇）的錯誤：

org.owasp.esapi.errors.ConfigurationException: java.lang.reflect.InvocationTargetException HTTPUtilities class (org.owasp.esapi.reference.DefaultHTTPUtilities) CTOR threw exception.
at org.owasp.esapi.util.ObjFactory.make(ObjFactory.java:129)
at org.owasp.esapi.ESAPI.httpUtilities(ESAPI.java:121)
at..
.....
Caused by: java.lang.ClassCastException: org.owasp.esapi.reference.Log4JLogger cannot be cast to org.owasp.esapi.Logger
at org.owasp.esapi.reference.Log4JLogFactory.getLogger(Log4JLogFactory.java:88)
at org.owasp.esapi.ESAPI.getLogger(ESAPI.java:154)
at org.owasp.esapi.reference.DefaultHTTPUtilities.<init>(DefaultHTTPUtilities.java:112)
at org.owasp.esapi.reference.DefaultHTTPUtilities.getInstance(DefaultHTTPUtilities.java:68)
... 40 more

不同的是，此次root exception為：
java.lang.ClassCastException: org.owasp.esapi.reference.Log4JLogger

這...真是太匪夷所思了，這段code我可是改都沒改，且出錯的為esapi內部，而且TestCode又都運作正常全綠燈（確定有測試到這段！！），卻在實際環境上報錯，所以應該可以『很合理』的猜出是與『環境』有關造成的錯誤而非code（TestCode告訴我一定不是我code寫錯～～
），最後找到以上參考網站，看到此段：

By chance, do you happen to have an instance of Apache Tomcat already running, or do you also have Microsoft Outlook running while you are trying to startup Tomcat? If so, shut down Outlook, start Tomcat, then restart Outlook. I've had problems in the past with conflicts like this.

的確，因為我今天才把war從tomcat搬到jboss上，而原先的tomcat還在運作中（同一台機器），因此只要把tomcat給關了，移除掉原先deploy的webapp，再重啟jboss就可以順利運作了～～

p.s:話說這個標籤該分類到哪呢？好像分類在esapi也不太對....?

ESAPI - 出現 Failed to load ESAPI.properties as a classloader resource...

參考：Configuring ESAPI for use with a Java Web Application

客戶需要使用ESAPI來驗證輸出入的參數是安全的，但我一開始嘗試使用就報錯：

org.owasp.esapi.errors.ConfigurationException: java.lang.reflect.InvocationTargetException SecurityConfiguration class (org.owasp.esapi.reference.DefaultSecurityConfiguration) CTOR threw exception.

at org.owasp.esapi.util.ObjFactory.make(ObjFactory.java:129)

at org.owasp.esapi.ESAPI.securityConfiguration(ESAPI.java:184)

at org.owasp.esapi.ESAPI.httpUtilities(ESAPI.java:121)

at com.ctbc.mi.web.util.ServletUtil.getESAPIRequestParameter(ServletUtil.java:169)

at com.ctbc.mi.web.servlet.query.MIQueryServletMain.doProcess(MIQueryServletMain.java:35)

.......

.......

Caused by: java.lang.IllegalArgumentException: Failed to load ESAPI.properties as a classloader resource.

at org.owasp.esapi.reference.DefaultSecurityConfiguration.loadConfigurationFromClasspath(DefaultSecurityConfiguration.java:667)

at org.owasp.esapi.reference.DefaultSecurityConfiguration.loadConfiguration(DefaultSecurityConfiguration.java:436)

... 48 more

查看root exception：
Caused by: java.lang.IllegalArgumentException: Failed to load ESAPI.properties as a classloader resource.

很明顯是設定錯誤，少了ESAPI.properties這個檔案，依照上述參考網站所述，建議放在src root下：

1. Create a ESAPI.properties file in the root source directory of your web application. Do not place it in a package inside the root source directory because the DefaultSecurityConfiguration will not find it.

更改置放的位置後就可以順利執行了～