Unnecessary reading of java.lang.Object input stream [SPR-10058]

[spring-projects-issues]

Kevin O'Riordan opened SPR-10058 and commented

Environment: Spring MVC 3.1.2 in Tomcat 7.0.23, jdk 1.6. When switching on java security, I realized that spring context is reading java.lang.Object from rt.jar when processing bean definitions, unnecessary and a bit dubious perhaps? It required me to grant read access to rt.jar, no big deal.

Without knowing too much about the innards of the internals of spring's bean/annotation processing, I wonder if ClassMetaReadingVisitor.hasSuperClass() should return false when java core classes are encountered? I am curious as to why an input stream is read for each class rather than doing a simple class load?

I hope this is helpful, really liking the latest Spring MVC stuff!

Stack trace here:
access: access denied (java.io.FilePermission /sbcimp/run/tp/sun/jdk/v1.6.0_31-64bit/jre/lib/rt.jar read)
java.lang.Exception: Stack trace
at java.lang.Thread.dumpStack(Thread.java:1249)
at java.security.AccessControlContext.checkPermission(AccessControlContext.java:364)
at java.security.AccessController.checkPermission(AccessController.java:546)
at java.lang.SecurityManager.checkPermission(SecurityManager.java:532)
at java.lang.SecurityManager.checkRead(SecurityManager.java:871)
at sun.misc.URLClassPath.check(URLClassPath.java:416)
at sun.misc.URLClassPath$JarLoader.checkResource(URLClassPath.java:676)
at sun.misc.URLClassPath$JarLoader.getResource(URLClassPath.java:759)
at sun.misc.URLClassPath.getResource(URLClassPath.java:169)
at sun.misc.URLClassPath.getResource(URLClassPath.java:221)
at java.lang.ClassLoader.getBootstrapResource(ClassLoader.java:1150)
at java.lang.ClassLoader.getResource(ClassLoader.java:999)
at java.lang.ClassLoader.getResource(ClassLoader.java:997)
at java.lang.ClassLoader.getResource(ClassLoader.java:997)
at java.lang.ClassLoader.getResourceAsStream(ClassLoader.java:1192)
at org.apache.catalina.loader.WebappClassLoader.getResourceAsStream(WebappClassLoader.java:1504)
at org.springframework.core.io.ClassPathResource.getInputStream(ClassPathResource.java:154)
at org.springframework.core.type.classreading.SimpleMetadataReader.<init>(SimpleMetadataReader.java:49)
at org.springframework.core.type.classreading.SimpleMetadataReaderFactory.getMetadataReader(SimpleMetadataReaderFactory.java:80)
at org.springframework.core.type.classreading.CachingMetadataReaderFactory.getMetadataReader(CachingMetadataReaderFactory.java:101)
at org.springframework.core.type.classreading.SimpleMetadataReaderFactory.getMetadataReader(SimpleMetadataReaderFactory.java:76)
at org.springframework.context.annotation.ConfigurationClassParser.doProcessConfigurationClass(ConfigurationClassParser.java:257)
at org.springframework.context.annotation.ConfigurationClassParser.processConfigurationClass(ConfigurationClassParser.java:149)
at org.springframework.context.annotation.ConfigurationClassParser.parse(ConfigurationClassParser.java:126)
at org.springframework.context.annotation.ConfigurationClassPostProcessor.processConfigBeanDefinitions(ConfigurationClassPostProcessor.java:263)
at org.springframework.context.annotation.ConfigurationClassPostProcessor.postProcessBeanDefinitionRegistry(ConfigurationClassPostProcessor.java:203)
at org.springframework.context.support.AbstractApplicationContext.invokeBeanFactoryPostProcessors(AbstractApplicationContext.java:622)
at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:451)
at org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:383)
at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:283)
at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:111)
at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:4765)
at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5260)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:866)
at org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:128)
at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:151)
at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:140)
at java.security.AccessController.doPrivileged(Native Method)
at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:840)
at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:615)
at org.apache.catalina.startup.HostConfig.deployDirectory(HostConfig.java:1095)
at org.apache.catalina.startup.HostConfig$DeployDirectory.run(HostConfig.java:1617)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:441)
at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303)
at java.util.concurrent.FutureTask.run(FutureTask.java:138)
at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
at java.lang.Thread.run(Thread.java:662)

---

Affects: 3.1.2

Referenced from: commits 7384c3d, a92f7dd

Backported to: 3.1.4

[spring-projects-issues]

Juergen Hoeller commented

Good point - in fact, no java.* or javax.* superclass should get loaded via ASM there. Fixed for 3.2 GA and 3.1.4.

Juergen