is OSGi implementation being thought off?

[jcompagner]

Hi,

Currently ESAPI is not really usable in a OSGi environment because of all the assumptions that you can load resources and so on based on the current class.

The DefaultSecurity i can work around a bit by using this:

	Properties esapi = new Properties();
	try (InputStream is = getClass().getResourceAsStream("/ESAPI.properties"))
	{
		esapi.load(is);
	}
	catch (IOException e1)
	{
		Debug.error(e1);
	}
	ESAPI.override(new DefaultSecurityConfiguration(esapi));

and then yes i use that override function also in production because i don't see another way of doing this
Problem is if i do that then the next step goes wrong:

Caused by: org.owasp.esapi.errors.ConfigurationException: Unable to locate resource: esapi-java-logging.properties
at org.owasp.esapi.logging.java.JavaLogFactory.readLoggerConfiguration(JavaLogFactory.java:128)
at org.owasp.esapi.logging.java.JavaLogFactory.(JavaLogFactory.java:96)
... 43 more

which does:

    /*
     * This will load the logging properties file to control the format of the output for Java logs.
     */
    try (InputStream stream = JavaLogFactory.class.getClassLoader().
            getResourceAsStream("esapi-java-logging.properties")

which will never really work, except if all those properties files would be actually inside the esapi.jar

Its not that you really need to be OSGi aware but i think this stuff should be done by a the standard Java ServiceLoader mechanism
and then have the correct manifest entries so this is also be able to use inside OSGi

Or you should have something like ResourceLoader.setResourceLoader(y) where y can be a class or an interface where all resources are asked through . So the above is first checking the ResourceLoader.getResourceAsStream("esapi-java-logging.properties") to load it through something the system did set.

Currently i just see no way todo this correctly in environments where classloading is more separated

Also the current manifest.mf is not so nice, it doesn't have a lot if nice things to have like bundle-name and so on.

[kwwall]

Related to issue #661

[xeno6696]

Running mvn org.apache.felix:maven-bundle-plugin:manifest manually before (or after?) running mvn package ought to fix the nice to have issue.

[juvanajohn]

Yes, OSGi (Open Services Gateway initiative) implementation is still considered and utilized in various software development projects, particularly in the realm of enterprise applications, modular systems, and embedded devices. spectrum tv support phone number
OSGi's modular architecture and dynamic component management continue to be valuable for building scalable and flexible software solutions.