Errors in integrating ESAPI suite with MyEclipse j2ee project - security

Question

Hi, I am trying to integrate of checkmarx plug in with my project in
myEclipse. I copied the jars (i.e. antisamy-1.4.3.jar &
esapi-2.1.0.jar ) my current jars directory and included in the
project libraries of myeclipse. And copied the property files into
my source directory of project i.e. ESAPI.properties &
validation.properties (prop files) where all my project property
files exists. Below is the screen shot Now I am trying to test if my
integration of ESapi successful. For that I have a create a test
java class(which is provided in the document i.e.
esapi4java-core-2.0-install-guide.pdf ) in my source folder, no
compilation errors found. But when I am running it is giving error ,
so what am I making mistake could you please help me.
Exception log :
SecurityConfiguration for ESAPI.printProperties not found in
ESAPI.properties. Using default: false Exception in thread "main"
org.owasp.esapi.errors.ConfigurationException:
java.lang.reflect.InvocationTargetException AccessController class
(org.owasp.esapi.reference.DefaultAccessController) CTOR threw
exception. at
org.owasp.esapi.util.ObjFactory.make(ObjFactory.java:129) at
org.owasp.esapi.ESAPI.accessController(ESAPI.java:85) at
com.steelwedge.util.checkmarx.EsapiTest.main(EsapiTest.java:14)
Caused by: java.lang.reflect.InvocationTargetException at
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597) at
org.owasp.esapi.util.ObjFactory.make(ObjFactory.java:86) ... 2 more
Caused by: java.lang.NoClassDefFoundError:
org/apache/commons/configuration/ConfigurationException at
org.owasp.esapi.reference.DefaultAccessController.(DefaultAccessController.java:32)
at
org.owasp.esapi.reference.DefaultAccessController.getInstance(DefaultAccessController.java:22)
... 7 more Caused by: java.lang.ClassNotFoundException:
org.apache.commons.configuration.ConfigurationException at
java.net.URLClassLoader$1.run(URLClassLoader.java:202) at
java.security.AccessController.doPrivileged(Native Method) at
java.net.URLClassLoader.findClass(URLClassLoader.java:190) at
java.lang.ClassLoader.loadClass(ClassLoader.java:307) at
sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:301) at
java.lang.ClassLoader.loadClass(ClassLoader.java:248) ... 9 more
Thank you. ~Shyam

Answer 1

I'm not familiar with ESAPI but note that the error includes "Caused by: java.lang.ClassNotFoundException: org.apache.commons.configuration.ConfigurationException"
The class, org.apache.commons.configuration.ConfigurationException, is in the commons-configuration.jar, so you will need that jar in your classpath also (and maybe others).
Note that for web applications, you may also need to add jars to the Deployment Assembly (right click the project, select Properties and then go to the MyEclipse/Deployment Assembly page - you can add jars from the classpath or individuals jars) as this controls what gets deployed to the server.