ClassCastException org.owasp.esapi.filters.SafeRequest cannot be cast to javax.servlet.ServletRequestWrapper using jdk1.6

[GoogleCodeExporter]

We are getting the following error on chain.doFilter in the filter class
after we use the SafeRequest and SafeResponse with jdk1.6


ERROR [com.pgi.web.filter.SecureHttpFilter] java.lang.ClassCastException:
org.owasp.esapi.filters.SafeRequest cannot be cast to
javax.servlet.ServletRequestWrapper

The following line of code is used in the filter class:-

HttpServletRequest hrequest = (HttpServletRequest) request;
            HttpServletResponse hresponse = (HttpServletResponse) response;
ESAPI.httpUtilities().setCurrentHTTP(hrequest, hresponse);

                            chain.doFilter(ESAPI.httpUtilities().getCurrentRequest(),
ESAPI.httpUtilities().getCurrentResponse());

Original issue reported on code.google.com by ajitkaml...@gmail.com on 14 May 2009 at 3:11

[GoogleCodeExporter]

What Container/Application Server are you encountering this error under? (Please
include version) 

Original comment by chrisisbeef on 15 Jul 2009 at 5:47

[GoogleCodeExporter]

we are using jboss application server and struts framework.here is the detail 
related
to this error

java.lang.ClassCastException: org.owasp.esapi.filters.SafeRequest cannot be 
cast to
javax.servlet.ServletRequestWrapper
        at
org.apache.catalina.core.ApplicationDispatcher.unwrapRequest(ApplicationDispatch
er.java:809)
        at
org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.j
ava:406)
        at
org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.jav
a:301)
        at
org.apache.struts.action.RequestProcessor.doForward(RequestProcessor.java:1063)
        at
org.apache.struts.tiles.TilesRequestProcessor.doForward(TilesRequestProcessor.ja
va:263)
        at
org.apache.struts.action.RequestProcessor.processForwardConfig(RequestProcessor.
java:386)
        at
org.apache.struts.tiles.TilesRequestProcessor.processForwardConfig(TilesRequestP
rocessor.java:318)
        at org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:229)
        at org.apache.struts.action.ActionServlet.process(ActionServlet.java:1194)
        at org.apache.struts.action.ActionServlet.doGet(ActionServlet.java:414)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:617)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
        at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilt
erChain.java:290)
        at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.
java:206)
        at
org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java
:687)
        at
org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatc
her.java:469)
        at
org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.j
ava:403)
        at
org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.jav
a:301)
        at
org.apache.struts.action.RequestProcessor.doForward(RequestProcessor.java:1063)
        at
org.apache.struts.tiles.TilesRequestProcessor.doForward(TilesRequestProcessor.ja
va:263)
        at
org.apache.struts.action.RequestProcessor.processForwardConfig(RequestProcessor.
java:386)
        at
org.apache.struts.tiles.TilesRequestProcessor.processForwardConfig(TilesRequestP
rocessor.java:318)
        at org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:229)
        at org.apache.struts.action.ActionServlet.process(ActionServlet.java:1194)

Original comment by ajitkaml...@gmail.com on 5 Aug 2009 at 7:24

[GoogleCodeExporter]

Any update on this?

I am getting this error on production also.

Original comment by ajitkaml...@gmail.com on 28 Aug 2009 at 3:12

[GoogleCodeExporter]

Should be fixed in revision 911. These two classes now extends
HttpServlet{Request,Response}Wrapper which should hopefully make containers 
more happy.

Be aware that these classes have been removed/renamed in 2.0.

Original comment by schal...@darkmist.net on 14 Dec 2009 at 3:11

• Changed state: Fixed