Bug 64745 - BasicDataSource won't load with enabled SecurityManager
Summary: BasicDataSource won't load with enabled SecurityManager
Status: RESOLVED FIXED
Alias: None
Product: Tomcat 9
Classification: Unclassified
Component: Catalina (show other bugs)
Version: 9.0.38
Hardware: PC Linux
: P2 normal (vote)
Target Milestone: -----
Assignee: Tomcat Developers Mailing List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-09-17 08:16 UTC by Sebastian Haas
Modified: 2020-09-17 11:00 UTC (History)
0 users


Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sebastian Haas 2020-09-17 08:16:26 UTC 
The inner class org.apache.tomcat.dbcp.dbcp2.BasicDataSource$PaGetConnection was removed in 9.0.38, but the class is still loaded in the static initialization block when the SecurityManager is activated.

The problematic code also exists upstream in the Apache Commons DBCP project.
I haven't reported it there yet.


Stacktrace:

Caused by: java.lang.IllegalStateException: Unable to pre-load classes
	at org.apache.tomcat.dbcp.dbcp2.BasicDataSource.<clinit>(BasicDataSource.java:94) ~[tomcat-dbcp.jar:9.0.38]
	... 123 more
Caused by: java.lang.ClassNotFoundException: org.apache.tomcat.dbcp.dbcp2.BasicDataSource$PaGetConnection
	at java.net.URLClassLoader.findClass(URLClassLoader.java:471) ~[?:?]
	at java.lang.ClassLoader.loadClass(ClassLoader.java:589) ~[?:?]
	at java.lang.ClassLoader.loadClass(ClassLoader.java:522) ~[?:?]
	at org.apache.tomcat.dbcp.dbcp2.BasicDataSource.<clinit>(BasicDataSource.java:79) ~[tomcat-dbcp.jar:9.0.38]
	... 123 more
Comment 1 Mark Thomas 2020-09-17 11:00:01 UTC 
Thanks for the report and the analysis.

Fixed in:
- master for 10.0.0-M9 onwards
- 9.0.x for 9.0.39 onwards
- 8.5.x for 8.5.59 onwards