ESAPI-java.lang.ClassNotFoundException: org.owasp.esapi.reference.JavaLogFactory

Question

Iam currently using esapi 2.2.0.0 version. When i tried to upgrade 2.2.0.0 to 2.5.2.0 iam getting this error..java.lang.ClassNotFoundException: org.owasp.esapi.reference.JavaLogFactory LogFactory class (org.owasp.esapi.reference.JavaLogFactory) must be in class path. I tried to add ESAPI.properties also but its not helped

Answer 1

I do believe that I have previously answered this identical question previously on SO, but to save us both the trouble of looking it up, instead just download the esapi-2.5.2.0-configuration.jar found under the 'Assets' section at https://github.com/ESAPI/esapi-java-legacy/releases/tag/esapi-2.5.2.0. Unjar that jar file, find the ESAPI.properties file and replace that 2.5.2.0 version of ESAPI.properties one with the old one that you presumably kept from ESAPI 2.2.0.0. That ought to fix your problem. (If you are using the ESAPI Encryptor, you may also want to copy your Encryptor.MasterKey and Encryptor.MasterSalt properties from your 2.2.0.0 ESAPI.properties file. But unless you made configuration changes, that's probably all that you need to preserve.)

BTW, the reason you are getting that error is because the package namespace of JavaLogFactory changed when we started supporting SLF4J somewhere around 2.3.0.0. If you follow instructions in the release notes and read all the intervening release notes (well, at least through 2.3.0.0 or so), it probably would have been obvious.

Anyhow, HTH. -kevin

Answer 2

Some extension of the first answer.

ESAPI logger package structure was refactored in the 2.2.1.0 release.

To fix the issue you need to replace the old log factory class in your ESAPI.properties file with the correct one, e.g.:

#ESAPI.Logger=org.owasp.esapi.reference.JavaLogFactory
ESAPI.Logger=org.owasp.esapi.logging.java.JavaLogFactory

For more details, see ESAPI 2.2.3.0 release notes