ClassNotFoundException: javax.xml.bind.DatatypeConverter when using jdk9

[THausherr]

I have read #118 but I'm not sure if this is related. I get this when building with jdk9:

[ERROR] Failed to execute goal de.thetaphi:forbiddenapis:2.3:check (default) on project xmpbox: Check for forbidden API calls failed: java.lang.ClassNotFoundException: javax.xml.bind.DatatypeConverter -> [Help 1]

I was able to get it running by doing this (windows cmd) before calling maven
set MAVEN_OPTS=--add-modules java.xml.bind
so now it's probably just a documentation improvement suggestion.

Maybe it could also work by using the exec-maven-plugin, I didn't test.

[uschindler]

Which signatures file is causing this?

[THausherr]

Here's what I have in the parent pom:

           <plugin>
                <groupId>de.thetaphi</groupId>
                <artifactId>forbiddenapis</artifactId>
                <version>2.3</version>
                <configuration>
                    <!--
                      if the used Java version is too new,
                      don't fail, just do nothing:
                    -->
                    <failOnUnsupportedJava>false</failOnUnsupportedJava>
                    <bundledSignatures>
                        <!--
                          This will automatically choose the right
                          signaturaes based on 'maven.compiler.target':
                        -->
                        <!-- add jdk-unsafe when all has been cleaned up -->
                        <bundledSignature>jdk-deprecated</bundledSignature>
                        <!-- disallow undocumented classes like sun.misc.Unsafe: -->
                        <bundledSignature>jdk-non-portable</bundledSignature>
                    </bundledSignatures>
                </configuration>
                <executions>
                    <execution>
                        <goals>
                            <goal>check</goal>
                            <goal>testCheck</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>

[uschindler]

Can I have a stack the and full Maven log output? Forbidden-apis works fine with current Java 9 and there is no signature file having any xml.bind classes. I know that some projects forbid base64 encoder from the jaxb classes, but that's not the case with this pom file.

[THausherr]

Can I send that file to the mail address that is on top of your thetaphi homepage? The file contains numerous personal details about my installation that I don't want to be public. I tried obscuring it but there's just too much.

[THausherr]

The xmpbox subproject itself needs "--add-modules java.xml.bind" to run its tests. It's just that for some reason, your tool needs it too and my setting influences only the tests.

[uschindler]

Yes you can do this. IMHO, the problem is not in forbiddenapis. To be sure I need a log file with stack trace enabled.

There is one thing where this may happen: If one of your dependencies or your code is using the xml.bind classes, but at the time of scanning forbidden apis they are not visible, you may have the problem. Are you sure, your own code is not using those classes?

FYI, this is unrelated to #118

[THausherr]

Yes my own code is using these classes.

[uschindler]

Sorry, wrong button. I have seen you already posted.

The problem seems the xmpbox subproject: It uses the classes from the xml.bind module (JAXB) in its tests. When forbiddenapis scans the classes for violations, it also needs to see those xml.bind classes, as the code depends on it. As forbiddenapis runs in-process with Maven, there is no other way than also adding the module to Maven itsself.

IMHO, you should fix your subproject to not use JAXB or ideally add the JAXB classes as dependency. With Java 9, JAXB is by default no longer enabled, so the best is to just depend on JAXB directly.

[uschindler]

Hi Tilman,
I got your mail. From the stack trace it looks like the issue is exactly what we already figured out here:

• The test code of the xmpbox subproject uses javax.xml.bind.DatatypeConverter somewhere in its code
• When you run the test the code, you need to add the additional command line option when executing surefire (in a separate process). This is a known issue of Java 9.
• While compiling the tests, you may also need the additional command line option for javac, but depending on other options (e.g., if you use --release 8 instead of -source/-target 8), javac uses the correct class library automatically.
• Forbiddenapis needs to see all classes that are also needed at runtime, otherwise it is impossible to find out class hierarchy of symbols in the file. This is needed to check if code calls a method from an interface that may be on the list of forbidden methods, but the call is done on the instance class. The problem with forbiddenapis, instead of surefire is: it runs in same process like Maven. So Maven needs to see all classes from the required modules.

There is currently nothing that forbiddenapis can do, but you can do one of the following:

• fix the code to no longer use javax.xml.bind.DatatypeConverter: Could it be that you just use it as replacement for java.util.Base64 to encode values? I know a lot of people that do this. With Java 8 minimum that's easy to solve, so you don't need to misuse unrelated packages.
• you can add the failOnMissingClasses=false config option to the plugin using pom.xml: https://jenkins.thetaphi.de/job/Forbidden-APIs/javadoc/check-mojo.html#failOnMissingClasses (it will then just print a warning).

I'll close the issue.