ESAPI 2.2.0.0-RC2 causes compilation errors in Java Encoder project

Question

ESAPI 2.2.0.0-RC2 causes compilation errors in Java Encoder project

kwwall opened this issue 5 years ago · 7 comments

Running 'mvn compile' causes the following compilation errors in the encoder-esapi artifact (aka, ESAPI Thunk) when used with esapi-2.2.0.0-rc2.jar:

[ERROR] Failed to execute goal org.apache.maven.plugins:maven-compiler-plugin:3.5.1:compile (default-compile) on project encoder-esapi: Compilation failure
[ERROR] /home/kww/Code/GitHub/owasp-java-encoder/esapi/src/main/java/org/owasp/encoder/esapi/ESAPIEncoder.java:[128,13] org.owasp.encoder.esapi.ESAPIEncoder.Impl is not abstract and does not override abstract method getCanonicalizedURI(java.net.URI) in org.owasp.esapi.Encoder

Note that this problem was described as part of your GitHub issue #30 but is not related to that. It was the serendipitous discovery caused by the non-pinned ESAPI transitive dependency that allowed this issue to be discovered.

If you want to eventually be able to support ESAPI 2.2.0.0 this will need to be fixed.

Answer 1 · 2019-05-02T07:45:39.000Z

week before owasp compiled without below error (But compilation failing now).
org.owasp.encoder.esapi.ESAPIEncoder.Impl is not abstract and does not override abstract method getCanonicalizedURI(java.net.URI) in org.owasp.esapi.Encoder

Haven't changed any version of the "mvn or java" even getting the same error on released tag v1.2.1 and v1.2.2. What could lead to this compilation failure ?

Answer 2 · 2019-05-02T13:44:06.000Z

It's failing because the ESAPI dependency is not pinned to a specific version, so the latest 2.x ESAPI jar gets used. But on 4/29, we pushed a new ESAPI release to Maven Central (2.2.0.0-RC2) which it is now pulling down. That new ESAPI jar has changed some of the interfaces. Thus the compilation errors.

…

-kevin -- Blog: http://off-the-wall-security.blogspot.com/ | Twitter: @KevinWWall NSA: All your crypto bit are belong to us.

On Thu, May 2, 2019, 03:45 guru prasad HB ***@***.***> wrote: week before owasp compiled without below error . org.owasp.encoder.esapi.ESAPIEncoder.Impl is not abstract and does not override abstract method getCanonicalizedURI(java.net.URI) in org.owasp.esapi.Encoder Haven't changed any version of the "mvn or java" even getting the same error on released tag v1.2.1 and v1.2.2. What could lead to this compilation failure ? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#31 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAO6PGYSZ2I2KU47XDRD45TPTKL2NANCNFSM4HJQ767Q> .

Answer 3 · 2020-07-24T22:01:51.000Z

I am assuming this is fixed, please reopen if not.

Answer 4 · 2020-07-30T00:44:08.000Z

@jmanico - Not fixed; needs reopened. If you ask nicely, I'll even submit a PR. :)

Answer 5 · 2020-07-30T00:47:22.000Z

Can we please have a PR, Kevin? Pretty please?

…

-- Jim Manico @manicode

On Jul 29, 2020, at 8:44 PM, Kevin W. Wall ***@***.***> wrote: @jmanico - Not fixed; needs reopened. If you ask nicely, I'll even submit a PR. :) — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or unsubscribe.

Answer 6 · 2020-07-30T03:22:22.000Z

@jmanico - Since the OWASP Java Encoder project is already using SLF4J and has that configured, I am just going to configure ESAPI to use SLF4J That will greatly simplify things since I don't need to use the esapi-java-logging.properties and can eliminate some of the Logger properties.

Answer 7 · 2020-07-30T04:08:54.000Z

Okay; upon close look, you are not using any logger at all, so exceptions are not logged. But NBD. SLF4J works better without configuration than does JUL.