尝试使用Java代理运行WebGoat时发生崩溃

时间:2018-06-07 02:52:03

标签: java maven spring-boot javaagents

我目前正在学习如何使用java代理启动Web应用程序进行监控。

我选择的Web应用程序是WebGoat,并且正如WebGoat的README中所述,使用java -jar webgoat-server-8.0.0.M17.jar运行WebGoat非常合适。

然而,当我尝试添加我的代理时,我得到以下一堆错误日志:

  .   ____          _            __ _ _
 /\\ / ___'_ __ _ _(_)_ __  __ _ \ \ \ \
( ( )\___ | '_ | '_| | '_ \/ _` | \ \ \ \
 \\/  ___)| |_)| | | | | || (_| |  ) ) ) )
  '  |____| .__|_| |_|_| |_\__, | / / / /
 =========|_|==============|___/=/_/_/_/
 :: Spring Boot ::       (v1.5.12.RELEASE)

2018-06-06 22:36:08.528  INFO 3741 --- [           main] org.owasp.webgoat.StartWebGoat           : Starting StartWebGoat v8.0.0.M17 on MacBook-Pro.local with PID 3741 (/Users/andrewfan/Desktop/Lang Agent Dev Proj help info/webgoat-server-8.0.0.M17.jar started by andrewfan in /Users/andrewfan/Desktop/Lang Agent Dev Proj help info)
2018-06-06 22:36:08.531  INFO 3741 --- [           main] org.owasp.webgoat.StartWebGoat           : No active profile set, falling back to default profiles: default
2018-06-06 22:36:08.844  INFO 3741 --- [           main] ationConfigEmbeddedWebApplicationContext : Refreshing org.springframework.boot.context.embedded.AnnotationConfigEmbeddedWebApplicationContext@1376c05c: startup date [Wed Jun 06 22:36:08 EDT 2018]; root of context hierarchy
2018-06-06 22:36:11.354  INFO 3741 --- [           main] trationDelegate$BeanPostProcessorChecker : Bean 'org.springframework.transaction.annotation.ProxyTransactionManagementConfiguration' of type [org.springframework.transaction.annotation.ProxyTransactionManagementConfiguration$$EnhancerBySpringCGLIB$$8e12590a] is not eligible for getting processed by all BeanPostProcessors (for example: not eligible for auto-proxying)
2018-06-06 22:36:11.442  WARN 3741 --- [           main] ationConfigEmbeddedWebApplicationContext : Exception encountered during context initialization - cancelling refresh attempt: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'mvcConfiguration': Injection of autowired dependencies failed; nested exception is java.lang.IllegalArgumentException: Could not resolve placeholder 'webgoat.user.directory' in value "${webgoat.user.directory}"
2018-06-06 22:36:11.455  INFO 3741 --- [           main] utoConfigurationReportLoggingInitializer : 

Error starting ApplicationContext. To display the auto-configuration report re-run your application with 'debug' enabled.
2018-06-06 22:36:11.464 ERROR 3741 --- [           main] o.s.boot.SpringApplication               : Application startup failed

org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'mvcConfiguration': Injection of autowired dependencies failed; nested exception is java.lang.IllegalArgumentException: Could not resolve placeholder 'webgoat.user.directory' in value "${webgoat.user.directory}"
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor.postProcessPropertyValues(AutowiredAnnotationBeanPostProcessor.java:372) ~[spring-beans-4.3.16.RELEASE.jar!/:4.3.16.RELEASE]
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.populateBean(AbstractAutowireCapableBeanFactory.java:1268) ~[spring-beans-4.3.16.RELEASE.jar!/:4.3.16.RELEASE]
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:553) ~[spring-beans-4.3.16.RELEASE.jar!/:4.3.16.RELEASE]
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:483) ~[spring-beans-4.3.16.RELEASE.jar!/:4.3.16.RELEASE]
    at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:312) ~[spring-beans-4.3.16.RELEASE.jar!/:4.3.16.RELEASE]
    at 

...

由于跟踪长达几页,我将错误消息缩短,但主要错误似乎是org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'mvcConfiguration': Injection of autowired dependencies failed; nested exception is java.lang.IllegalArgumentException: Could not resolve placeholder 'webgoat.user.directory' in value "${webgoat.user.directory}"

我按照以下方式运行代理: java -javaagent:/Users/path/to/jar/Spn-LangAgent-0.0.jar -jar webgoat-server-8.0.0.M17.jar --server.port=8080 --server.address=localhost

我的经纪人如下:

package com.spnlangagent.langagent;

import java.io.File;
import java.nio.file.Files;
import java.nio.file.StandardCopyOption;
import java.io.IOException;
import java.io.InputStream;
import java.net.URL;
import java.net.URLClassLoader;
import java.lang.reflect.Field;
import java.lang.instrument.Instrumentation;
import java.lang.instrument.UnmodifiableClassException;

import com.google.monitoring.runtime.instrumentation.AllocationRecorder;

public class LangAgent {

    public static void premain(String agentArgs, Instrumentation inst) throws Exception {
        System.out.println("LangAgent: premain now running");
        setupInstrumentation(agentArgs, inst);
        startRuntime(agentArgs);
    }

    private static void setupInstrumentation(String agentArgs, Instrumentation inst) throws Exception {
        System.out.println("setupInstrumentation: now running with agentArgs: " + agentArgs);
    }

    private static void startRuntime(String agentArgs) throws Exception {
        System.out.println("startRuntime: now running with agentArgs: " + agentArgs);
    }
}

除了一些打印语句之外,代理的原始内容已被注释掉,但即便如此,WebGoat在启动时也会崩溃。

我尝试了另一个使用WebGoat的代理,它工作得很好,所以我唯一能想到的是我的代理或者它的打包方式都有问题。

我正在使用Maven,我的MANIFEST.MF如下:

Manifest-Version: 1.0
Premain-Class: com.spnlangagent.langagent.LangAgent
Can-Redefine-Classes: true
Can-Retransform-Classes: true

运行mvn package后,打包在.jar中的MANIFEST如下:

Manifest-Version: 1.0
Premain-Class: com.spnlangagent.langagent.LangAgent
Built-By: andrewfan
Can-Redefine-Classes: true
Can-Retransform-Classes: true
Created-By: Apache Maven 3.5.3
Build-Jdk: 1.8.0_172

在我的pom.xml中,我正在执行以下操作来访问清单:

         <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-jar-plugin</artifactId>
            <version>3.1.0</version>
            <configuration>
                <archive>
                    <manifestFile>src/main/resources/META-INF/MANIFEST.MF</manifestFile>
                </archive>
            </configuration>
        </plugin>

如果有人可以指出我正确的方向,找出WebGoat崩溃的原因,或者有人能够更深入地了解我目前正在做的事情是错误的,那将非常感激。

谢谢。

注意:如果我的pom.xml的其余部分是调试所必需的,我很乐意提供它;只是问题已经很长了。

2 个答案:

答案 0 :(得分:0)

解决方案是$i=0;$weeks=12; while ($i < $weeks) { $thisweek = Carbon::now()->addWeeks($i)->startOfWeek()->format('Y-m-d'); $requiredcap = DB::table('projects')->select(DB::raw("sum(progress_pw) as progress")) ->where('install_date', ">=", $thisweek) //<<< This is where im getting stuck! ->get(); $capacity['label'][] = Carbon::now()->addWeeks($i)->startOfWeek()->format('d M'); $capacity['required'][] = $requiredcap; $i++; }

之前我有一个mvn clean自动添加为Spring Boot Initializr的一部分。这个文件在我的代理.jar中的存在,即使没有任何内容,似乎也是WebGoat吓坏了的原因。现在它已不存在,WebGoat正在通过application.properties

正常运行

我要感谢Adrian Shum提到java -javaagent:/Users/path/to/jar/Spn-LangAgent-0.0.jar -jar webgoat-server-8.0.0.M17.jar --server.port=8080 --server.address=localhost,因为我已经删除了一段时间。我运行时application.properties实际上没有重建.jar,所以我测试的jar是仍然包含mvn package的jar。

答案 1 :(得分:0)

Webgoat(以及大多数基于Spring的应用程序)依赖于属性文件(通常为propertiesyaml格式)来执行占位符查找。

失败的症状表明Spring无法查找占位符处理的属性。

鉴于占位符查找在没有您的代理JAR的情况下运行良好,并且您在评论中提到的信息,问题是由

引起的
  • 您的代理JAR提供了application.properties(其名称与Webgoat用于占位符的属性文件冲突)
  • 代理JAR将成为类路径的一部分,甚至可能比主JAR
  • 更早出现
  • 您的空application.properties&#34;阴影&#34; Webgoat主JAR中的那个。这意味着,当Webgoat启动时,Spring为其占位符处理选择了空application.properties,因此失败了。