AccessControlException after migrating to Spring 4.2.4

Question

After migrating from Spring 4.2.3 to 4.2.4, I cannot run the application in Google App Engine

java.lang.IllegalStateException: Cannot load configuration class: xxx.xxx.configuration.AppConfiguration at org.springframework.context.annotation.ConfigurationClassPostProcessor.enhanceConfigurationClasses(ConfigurationClassPostProcessor.java:410) at org.springframework.context.annotation.ConfigurationClassPostProcessor.postProcessBeanFactory(ConfigurationClassPostProcessor.java:263) at org.springframework.context.support.PostProcessorRegistrationDelegate.invokeBeanFactoryPostProcessors(PostProcessorRegistrationDelegate.java:284) at org.springframework.context.support.PostProcessorRegistrationDelegate.invokeBeanFactoryPostProcessors(PostProcessorRegistrationDelegate.java:130) at org.springframework.context.support.AbstractApplicationContext.invokeBeanFactoryPostProcessors(AbstractApplicationContext.java:678) at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:520) at org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:446) at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:328) at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:107) at org.mortbay.jetty.handler.ContextHandler.startContext(ContextHandler.java:548) at org.mortbay.jetty.servlet.Context.startContext(Context.java:136) at org.mortbay.jetty.webapp.WebAppContext.startContext(WebAppContext.java:1250) at org.mortbay.jetty.handler.ContextHandler.doStart(ContextHandler.java:517) at org.mortbay.jetty.webapp.WebAppContext.doStart(WebAppContext.java:467) at org.mortbay.component.AbstractLifeCycle.start(AbstractLifeCycle.java:50) at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.createHandler(AppVersionHandlerMap.java:206) at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.getHandler(AppVersionHandlerMap.java:179) at com.google.apphosting.runtime.jetty.JettyServletEngineAdapter.serviceRequest(JettyServletEngineAdapter.java:136) at com.google.apphosting.runtime.JavaRuntime$RequestRunnable.run(JavaRuntime.java:469) at com.google.tracing.TraceContext$TraceContextRunnable.runInContext(TraceContext.java:437) at com.google.tracing.TraceContext$TraceContextRunnable$1.run(TraceContext.java:444) at com.google.tracing.CurrentContext.runInContext(CurrentContext.java:256) at com.google.tracing.TraceContext$AbstractTraceContextCallback.runInInheritedContextNoUnref(TraceContext.java:308) at com.google.tracing.TraceContext$AbstractTraceContextCallback.runInInheritedContext(TraceContext.java:300) at com.google.tracing.TraceContext$TraceContextRunnable.run(TraceContext.java:441) at com.google.apphosting.runtime.ThreadGroupPool$PoolEntry.run(ThreadGroupPool.java:235) at java.lang.Thread.run(Thread.java:745) Caused by: java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "accessClassInPackage.sun.reflect.annotation") at java.security.AccessControlContext.checkPermission(AccessControlContext.java:382) at java.security.AccessController.checkPermission(AccessController.java:572) at java.lang.SecurityManager.checkPermission(SecurityManager.java:549) at com.google.apphosting.runtime.security.CustomSecurityManager.checkPermission(CustomSecurityManager.java:55) at java.lang.SecurityManager.checkPackageAccess(SecurityManager.java:1525) at sun.reflect.misc.ReflectUtil.checkPackageAccess(ReflectUtil.java:188) at sun.reflect.misc.ReflectUtil.checkPackageAccess(ReflectUtil.java:164) at java.lang.reflect.Proxy.getInvocationHandler(Proxy.java:822) at org.springframework.core.annotation.AnnotationUtils.synthesizeAnnotation(AnnotationUtils.java:1364) at org.springframework.core.annotation.AnnotationUtils.findAnnotation(AnnotationUtils.java:498) at org.springframework.core.annotation.AnnotationUtils.findAnnotation(AnnotationUtils.java:563) at org.springframework.context.annotation.BeanAnnotationHelper.isBeanAnnotated(BeanAnnotationHelper.java:35) at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.isMatch(ConfigurationClassEnhancer.java:487) at org.springframework.context.annotation.ConfigurationClassEnhancer$ConditionalCallbackFilter.accept(ConfigurationClassEnhancer.java:190) at org.springframework.cglib.proxy.Enhancer.emitMethods(Enhancer.java:898) at org.springframework.cglib.proxy.Enhancer.generateClass(Enhancer.java:509) at org.springframework.cglib.transform.TransformingClassGenerator.generateClass(TransformingClassGenerator.java:33) at org.springframework.cglib.core.DefaultGeneratorStrategy.generate(DefaultGeneratorStrategy.java:25) at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanFactoryAwareGeneratorStrategy.generate(ConfigurationClassEnhancer.java:249) at org.springframework.cglib.core.AbstractClassGenerator.create(AbstractClassGenerator.java:231) at org.springframework.cglib.proxy.Enhancer.createHelper(Enhancer.java:378) at org.springframework.cglib.proxy.Enhancer.createClass(Enhancer.java:318) at org.springframework.context.annotation.ConfigurationClassEnhancer.createClass(ConfigurationClassEnhancer.java:135) at org.springframework.context.annotation.ConfigurationClassEnhancer.enhance(ConfigurationClassEnhancer.java:107) at org.springframework.context.annotation.ConfigurationClassPostProcessor.enhanceConfigurationClasses(ConfigurationClassPostProcessor.java:400) ... 26 more 

Answer 1

Spring error, fixed, but not yet released, so either wait for 4.2.5 or return to 4.2.3: https://jira.spring.io/browse/SPR-13829

Answer 2

Thus, it is obvious that something is trying to use the sun.reflect.annotation package, which is not in the JRE whitelist . The question remains, since none of the classes in spring-framework uses this package explicitly (from grepping source ).

The stack trace indicates that the culprit is the following line:

 Proxy.getInvocationHandler(annotation) instanceof SynthesizedAnnotationInvocationHandler)) 

As you might expect, the JDK defines sun.reflect.annotation.AnnotationInvocationHandler as a dynamic proxy implementation of Annotation. So it looks like it's due to synthesized annotation when the method checks this annotation call handler and ends up accessing the sun.reflect.annotation package.

Hope this can lead to a more complete answer.