迁移到Spring 4.2.4后的AccessControlException

Question

从Spring 4.2.3迁移到4.2.4后，我无法在Google App Engine上运行应用程序

java.lang.IllegalStateException: Cannot load configuration class: xxx.xxx.configuration.AppConfiguration
    at org.springframework.context.annotation.ConfigurationClassPostProcessor.enhanceConfigurationClasses(ConfigurationClassPostProcessor.java:410)
    at org.springframework.context.annotation.ConfigurationClassPostProcessor.postProcessBeanFactory(ConfigurationClassPostProcessor.java:263)
    at org.springframework.context.support.PostProcessorRegistrationDelegate.invokeBeanFactoryPostProcessors(PostProcessorRegistrationDelegate.java:284)
    at org.springframework.context.support.PostProcessorRegistrationDelegate.invokeBeanFactoryPostProcessors(PostProcessorRegistrationDelegate.java:130)
    at org.springframework.context.support.AbstractApplicationContext.invokeBeanFactoryPostProcessors(AbstractApplicationContext.java:678)
    at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:520)
    at org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:446)
    at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:328)
    at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:107)
    at org.mortbay.jetty.handler.ContextHandler.startContext(ContextHandler.java:548)
    at org.mortbay.jetty.servlet.Context.startContext(Context.java:136)
    at org.mortbay.jetty.webapp.WebAppContext.startContext(WebAppContext.java:1250)
    at org.mortbay.jetty.handler.ContextHandler.doStart(ContextHandler.java:517)
    at org.mortbay.jetty.webapp.WebAppContext.doStart(WebAppContext.java:467)
    at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:50)
    at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.createHandler(AppVersionHandlerMap.java:206)
    at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.getHandler(AppVersionHandlerMap.java:179)
    at com.google.apphosting.runtime.jetty.JettyServletEngineAdapter.serviceRequest(JettyServletEngineAdapter.java:136)
    at com.google.apphosting.runtime.JavaRuntime$RequestRunnable.run(JavaRuntime.java:469)
    at com.google.tracing.TraceContext$TraceContextRunnable.runInContext(TraceContext.java:437)
    at com.google.tracing.TraceContext$TraceContextRunnable$1.run(TraceContext.java:444)
    at com.google.tracing.CurrentContext.runInContext(CurrentContext.java:256)
    at com.google.tracing.TraceContext$AbstractTraceContextCallback.runInInheritedContextNoUnref(TraceContext.java:308)
    at com.google.tracing.TraceContext$AbstractTraceContextCallback.runInInheritedContext(TraceContext.java:300)
    at com.google.tracing.TraceContext$TraceContextRunnable.run(TraceContext.java:441)
    at com.google.apphosting.runtime.ThreadGroupPool$PoolEntry.run(ThreadGroupPool.java:235)
    at java.lang.Thread.run(Thread.java:745)
Caused by: java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "accessClassInPackage.sun.reflect.annotation")
    at java.security.AccessControlContext.checkPermission(AccessControlContext.java:382)
    at java.security.AccessController.checkPermission(AccessController.java:572)
    at java.lang.SecurityManager.checkPermission(SecurityManager.java:549)
    at com.google.apphosting.runtime.security.CustomSecurityManager.checkPermission(CustomSecurityManager.java:55)
    at java.lang.SecurityManager.checkPackageAccess(SecurityManager.java:1525)
    at sun.reflect.misc.ReflectUtil.checkPackageAccess(ReflectUtil.java:188)
    at sun.reflect.misc.ReflectUtil.checkPackageAccess(ReflectUtil.java:164)
    at java.lang.reflect.Proxy.getInvocationHandler(Proxy.java:822)
    at org.springframework.core.annotation.AnnotationUtils.synthesizeAnnotation(AnnotationUtils.java:1364)
    at org.springframework.core.annotation.AnnotationUtils.findAnnotation(AnnotationUtils.java:498)
    at org.springframework.core.annotation.AnnotationUtils.findAnnotation(AnnotationUtils.java:563)
    at org.springframework.context.annotation.BeanAnnotationHelper.isBeanAnnotated(BeanAnnotationHelper.java:35)
    at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.isMatch(ConfigurationClassEnhancer.java:487)
    at org.springframework.context.annotation.ConfigurationClassEnhancer$ConditionalCallbackFilter.accept(ConfigurationClassEnhancer.java:190)
    at org.springframework.cglib.proxy.Enhancer.emitMethods(Enhancer.java:898)
    at org.springframework.cglib.proxy.Enhancer.generateClass(Enhancer.java:509)
    at org.springframework.cglib.transform.TransformingClassGenerator.generateClass(TransformingClassGenerator.java:33)
    at org.springframework.cglib.core.DefaultGeneratorStrategy.generate(DefaultGeneratorStrategy.java:25)
    at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanFactoryAwareGeneratorStrategy.generate(ConfigurationClassEnhancer.java:249)
    at org.springframework.cglib.core.AbstractClassGenerator.create(AbstractClassGenerator.java:231)
    at org.springframework.cglib.proxy.Enhancer.createHelper(Enhancer.java:378)
    at org.springframework.cglib.proxy.Enhancer.createClass(Enhancer.java:318)
    at org.springframework.context.annotation.ConfigurationClassEnhancer.createClass(ConfigurationClassEnhancer.java:135)
    at org.springframework.context.annotation.ConfigurationClassEnhancer.enhance(ConfigurationClassEnhancer.java:107)
    at org.springframework.context.annotation.ConfigurationClassPostProcessor.enhanceConfigurationClasses(ConfigurationClassPostProcessor.java:400)
    ... 26 more

Answer 1

Spring错误，已修复但尚未发布，因此请等待4.2.5或恢复为4.2.3： https : //jira.spring.io/browse/SPR-13829

Answer 2

因此，显而易见的是，有人在尝试使用不在JRE白名单上的'sun.reflect.annotation'软件包。 问题仍然是什么呢，因为spring-framework中没有一个类明确使用此包（通过grepping source ）。

堆栈跟踪指示罪魁祸首为以下行：

Proxy.getInvocationHandler(annotation) instanceof SynthesizedAnnotationInvocationHandler))

可以猜测，JDK将sun.reflect.annotation.AnnotationInvocationHandler定义为Annotation的动态代理实现。 因此，当方法检查该注释的调用处理程序并最终访问“ sun.reflect.annotation”包时，似乎这与注释的合成有关。

希望这可以使某人获得更完整的答案。