Bug 64745

Summary:	BasicDataSource won't load with enabled SecurityManager
Product:	Tomcat 9	Reporter:	Sebastian Haas <sebastian.haas>
Component:	Catalina	Assignee:	Tomcat Developers Mailing List <dev>
Status:	RESOLVED FIXED
Severity:	normal
Priority:	P2
Version:	9.0.38
Target Milestone:	-----
Hardware:	PC
OS:	Linux

Description Sebastian Haas 2020-09-17 08:16:26 UTC

The inner class org.apache.tomcat.dbcp.dbcp2.BasicDataSource$PaGetConnection was removed in 9.0.38, but the class is still loaded in the static initialization block when the SecurityManager is activated.

The problematic code also exists upstream in the Apache Commons DBCP project.
I haven't reported it there yet.


Stacktrace:

Caused by: java.lang.IllegalStateException: Unable to pre-load classes
	at org.apache.tomcat.dbcp.dbcp2.BasicDataSource.<clinit>(BasicDataSource.java:94) ~[tomcat-dbcp.jar:9.0.38]
	... 123 more
Caused by: java.lang.ClassNotFoundException: org.apache.tomcat.dbcp.dbcp2.BasicDataSource$PaGetConnection
	at java.net.URLClassLoader.findClass(URLClassLoader.java:471) ~[?:?]
	at java.lang.ClassLoader.loadClass(ClassLoader.java:589) ~[?:?]
	at java.lang.ClassLoader.loadClass(ClassLoader.java:522) ~[?:?]
	at org.apache.tomcat.dbcp.dbcp2.BasicDataSource.<clinit>(BasicDataSource.java:79) ~[tomcat-dbcp.jar:9.0.38]
	... 123 more

Comment 1 Mark Thomas 2020-09-17 11:00:01 UTC

Thanks for the report and the analysis.

Fixed in:
- master for 10.0.0-M9 onwards
- 9.0.x for 9.0.39 onwards
- 8.5.x for 8.5.59 onwards