Graal Engine Issue with Multi Threaded Access

[groogiam]

Describe the bug
The Graal.js engine does not appear to work on windows.

To Reproduce
Run the following grail http sender script.

// The sendingRequest and responseReceived functions will be called for all requests/responses sent/received by ZAP, 
// including automated tools (e.g. active scanner, fuzzer, ...)

// Note that new HttpSender scripts will initially be disabled
// Right click the script in the Scripts tree and select "enable"  

// 'initiator' is the component the initiated the request:
// 		1	PROXY_INITIATOR
// 		2	ACTIVE_SCANNER_INITIATOR
// 		3	SPIDER_INITIATOR
// 		4	FUZZER_INITIATOR
// 		5	AUTHENTICATION_INITIATOR
// 		6	MANUAL_REQUEST_INITIATOR
// 		7	CHECK_FOR_UPDATES_INITIATOR
// 		8	BEAN_SHELL_INITIATOR
// 		9	ACCESS_CONTROL_SCANNER_INITIATOR
// 		10	AJAX_SPIDER_INITIATOR
// For the latest list of values see the HttpSender class:
// https://github.com/zaproxy/zaproxy/blob/main/zap/src/main/java/org/parosproxy/paros/network/HttpSender.java
// 'helper' just has one method at the moment: helper.getHttpSender() which returns the HttpSender 
// instance used to send the request.
//
// New requests can be made like this:
// msg2 = msg.cloneAll() // msg2 can then be safely changed as required without affecting msg
// helper.getHttpSender().sendAndReceive(msg2, false);
// print('msg2 response=' + msg2.getResponseHeader().getStatusCode())



function sendingRequest(msg, initiator, helper) {


	//msg.getRequestHeader().setHeader("X-ZAP-Initiator", initiator);
	//msg.getRequestHeader().setHeader("Authentication", "Bearer: " + AuthToken);
	// Debugging can be done using println like this
	print('sendingRequest called for url=' + msg.getRequestHeader().getURI().toString())
}

function responseReceived(msg, initiator, helper) {
	// Debugging can be done using println like this
	print('responseReceived called for url=' + msg.getRequestHeader().getURI().toString())
}

Manually proxy a chrome browser and navigate to http://www.google.com

The script crashes and is disabled. The following is the output from the script console.

sendingRequest called for url=https://www.google.com/gen_204?atyp=i&r=1&ei=UdvEYd-VNYuoptQP49WmmAU&ct=slh&v=t1&im=M&pv=0.13916408800352364&me=18:1640291131480,V,0,0,0,0:5902,h,1,1,i:116,h,1,1,o:4088,h,1,1,i:387,h,1,1,o:1829,e,U&zx=1640291143803
responseReceived called for url=https://www.google.com/gen_204?atyp=i&r=1&ei=UdvEYd-VNYuoptQP49WmmAU&ct=slh&v=t1&im=M&pv=0.13916408800352364&me=18:1640291131480,V,0,0,0,0:5902,h,1,1,i:116,h,1,1,o:4088,h,1,1,i:387,h,1,1,o:1829,e,U&zx=1640291143803
sendingRequest called for url=https://www.google.com/
responseReceived called for url=https://www.google.com/
java.lang.IllegalStateException: Multi threaded access requested by thread Thread[ZAP-ProxyThread-913,4,main] but is not allowed for language(s) js.sjava.lang.IllegalStateException: Multi threaded access requested by thread Thread[ZAP-ProxyThread-913,4,main] but is not allowed for language(s) js.e
ndingRequest called for url=https://www.google.com/gen_204?s=webhp&t=aft&atyp=csi&ei=xtvEYcTfIJGbptQPp6m42A0&rt=wsrt.272,aft.30,afti.30&imn=2&ima=2&imad=0&aftp=-1&bl=4JUY
responseReceived called for url=https://www.google.com/gen_204?s=webhp&t=aft&atyp=csi&ei=xtvEYcTfIJGbptQPp6m42A0&rt=wsrt.272,aft.30,afti.30&imn=2&ima=2&imad=0&aftp=-1&bl=4JUY

Expected behavior
The above script should run. In general it is my understanding that graal should run be pretty much backward compatible with nashhorn.

Software versions

• ZAP: 2.11.1 Cross Platform
• Add-on: Name and version GraalVM Javascript 0.2.0
• OS: Windows 10 20H2
• Java: [e.g. openjdk version "1.8.0_171"]
  openjdk version "1.8.0_302"
  OpenJDK Runtime Environment (Temurin)(build 1.8.0_302-b08)
  OpenJDK 64-Bit Server VM (Temurin)(build 25.302-b08, mixed mode)
• Browser:Google Chrome | 96.0.4664.110 (Official Build) (64-bit) (cohort: Stable)

Errors from the zap.log file

zap.log

Additional context
Add any other context about the problem here.

Would you like to help fix this issue?
I would be happy to help fix the issue if I have the expertise to do so.

[kingthorin]

It did run, and was disabled when an unhandled exception was hit.

[thc202]

This is a known issue with the Graal.js engine.

[groogiam]

@thc202 Can you point me to some possible documentation on the issue? Is there any known work around? Thanks.

[thc202]

The issue is that the script is being accessed concurrently, which Graal.js engine does not support (https://github.com/oracle/graaljs/blob/e8ca82a9da934fb692f94eca67b7dff98e7c17fc/docs/user/Multithreading.md). Since you are still using Java 8 the "workaround" would be to use Nashorn engine, which allows concurrent access.

[trevor-vaughan]

Is there a workaround for this with Java > 8 or do users need to roll back to 8 and use Nashorn?

[thc202]

I'm not aware of a workaround, Nashorn is still available in Java 11.

[trevor-vaughan]

Ah, my system rolled to 17 and it does not appear to be available. I'll install 11 and pin to that.

It would be nice for the zap.sh script to tell you if things might be broken when you run the app and/or for the script loader to tell you you're using an incompatible version.

[kingthorin]

https://medium.com/swlh/porting-from-nashorn-how-to-handle-multi-threading-in-graal-js-957e359b7df5 ? 🤷‍♂️ (I'm far from versed in any of this)

[sonawanesarvesh]

https://www.graalvm.org/22.0/reference-manual/js/NashornMigrationGuide/#:~:text=The%20Nashorn%20engine%20has%20been%20deprecated%20in%20JDK,the%20features%20for%20JavaScript%20previously%20provided%20by%20Nashorn.

Just bumped on this

[github-actions]

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.