Issue2693

classification
Title: SAXParser, classloader and dynamically loading jython
Type: Severity: normal
Components: Any Versions: Jython 2.7
Milestone:
process
Status: open Resolution:
Dependencies: Superseder:
Assigned To: Nosy List: amak, jamesmudd, webpentest
Priority: Keywords:

Created on 2018-06-21.00:11:50 by webpentest, last changed 2018-06-28.10:23:46 by webpentest.

Messages
msg12011 (view) Author: webpentest (webpentest) Date: 2018-06-21.00:11:48
I am developing an extension for a java program that embeds jython as a scripting environment. When trying to use xml parsing routines from inside the python script, I run into the following exception:

java.lang.ClassNotFoundException: org.apache.xerces.parsers.SAXParser


The issue is similar to http://bugs.jython.org/issue1537

After some investigations (see the whole discussion in https://support.portswigger.net/customer/en/portal/questions/17349567-saxparser-dependency-delimma), I think I've found the root cause. Namely, SAX's XMLReaderFactory.createXMLReader does not honor the class loader inheritance and uses current thread's classloader. In my case this classloader does not contain jython's jar, so that createXMLReader cannot find both org.python.apache.xerces.parsers.SAXParser and org.apache.xerces.parsers.SAXParser classes. 

I have a workaround that employs switching current Thread's classloader to the classloader that has jython's jar. But maybe there is a way to fix this issue inside jython itself?
msg12012 (view) Author: webpentest (webpentest) Date: 2018-06-21.00:28:27
Maybe instead of using the deprecated org.xml.sax.helpers.XMLReaderFactory, Lib/xml/parsers/expat.py can use AXParserFactory.newInstance ( https://docs.oracle.com/javase/7/docs/api/javax/xml/parsers/SAXParserFactory.html#newInstance(java.lang.String,%20java.lang.ClassLoader) )?
msg12014 (view) Author: webpentest (webpentest) Date: 2018-06-23.08:42:00
https://gist.github.com/ngo/2e694fe096273cf928424fc6f19938ff - I've created a gist that can be used to reproduce the problem - just comment line 15.
msg12029 (view) Author: James Mudd (jamesmudd) Date: 2018-06-27.21:31:15
This is very closely related to issue 2142. That issue contains a patch for Jython which implements switching the TCCL maybe you could try it out and see if it fixes this problem as well?
msg12032 (view) Author: webpentest (webpentest) Date: 2018-06-28.10:23:46
I'm positive that the fix proposed in issue 2142, would solve this issue as well, however the patch you mentioned doesn't apply cleanly to the latest HEAD of jython.
History
Date User Action Args
2018-06-28 10:23:46webpentestsetmessages: + msg12032
2018-06-27 21:31:15jamesmuddsetnosy: + jamesmudd
messages: + msg12029
2018-06-23 08:42:01webpentestsetmessages: + msg12014
2018-06-22 16:14:54amaksetnosy: + amak
2018-06-21 00:28:28webpentestsetmessages: + msg12012
2018-06-21 00:11:50webpentestcreate