SecurityExceptions thrown in Panache Before/After Listeners result in Internal Server errors #35169

gmuellerinform · 2023-08-02T13:54:54Z

Describe the bug

Throwing an io.quarkus.security.ForbiddenException in onBeforeAdd listener results in an Internal Server error.

Expected behavior

The endpoint should return 403 with the message provided to the ForbiddenException

Actual behavior

A 500 response is sent.

How to Reproduce?

No response

Output of `uname -a` or `ver`

No response

Output of `java -version`

No response

GraalVM version (if different from Java)

No response

Quarkus version or git rev

No response

Build tool (ie. output of `mvnw --version` or `gradlew --version`)

No response

Additional information

No response

The text was updated successfully, but these errors were encountered:

quarkus-bot · 2023-08-02T13:54:57Z

/cc @FroMage (panache), @loicmathieu (panache), @sberyozkin (security)

FroMage · 2023-08-14T13:48:35Z

Is this using Hibernate ORM, or Hibernate Reactive? This doesn't look like a Panache issue. Do you have a stack trace you could share please?

FroMage · 2023-08-14T13:49:26Z

Also, is this using RESTEasy Reactive or something else? Not sure who has the hand on those calls.

gmuellerinform · 2023-08-14T14:00:06Z

2023-08-14 13:58:31,681 WARN  [io.qua.hib.orm.res.dat.pan.run.RestDataPanacheExceptionMapper] (executor-thread-1) Mapping an unhandled RestDataPanacheException: io.quarkus.rest.data.panache.RestDataPanacheException: Failed to add an entity
       at com.inform.app.resource.crud.CompaniesJaxRs_6c4e12f29f9b83c374df013d4fa14e3ea3d6416d.add(Unknown Source)
       at com.inform.app.resource.crud.CompaniesJaxRs_6c4e12f29f9b83c374df013d4fa14e3ea3d6416d_Subclass.add$$superforward(Unknown Source)
       at com.inform.app.resource.crud.CompaniesJaxRs_6c4e12f29f9b83c374df013d4fa14e3ea3d6416d_Subclass$$function$$5.apply(Unknown Source)
       at io.quarkus.arc.impl.AroundInvokeInvocationContext.proceed(AroundInvokeInvocationContext.java:73)
       at io.quarkus.arc.impl.AroundInvokeInvocationContext$NextAroundInvokeInvocationContext.proceed(AroundInvokeInvocationContext.java:97)
       at io.quarkus.hibernate.validator.runtime.interceptor.AbstractMethodValidationInterceptor.validateMethodInvocation(AbstractMethodValidationInterceptor.java:71)
       at io.quarkus.hibernate.validator.runtime.jaxrs.JaxrsEndPointValidationInterceptor.validateMethodInvocation(JaxrsEndPointValidationInterceptor.java:38)
       at io.quarkus.hibernate.validator.runtime.jaxrs.JaxrsEndPointValidationInterceptor_Bean.intercept(Unknown Source)
       at io.quarkus.arc.impl.InterceptorInvocation.invoke(InterceptorInvocation.java:42)
       at io.quarkus.arc.impl.AroundInvokeInvocationContext.proceed(AroundInvokeInvocationContext.java:70)
       at io.quarkus.arc.impl.AroundInvokeInvocationContext.proceed(AroundInvokeInvocationContext.java:62)
       at io.quarkus.security.runtime.interceptor.SecurityHandler.handle(SecurityHandler.java:47)
       at io.quarkus.security.runtime.interceptor.RolesAllowedInterceptor.intercept(RolesAllowedInterceptor.java:29)
       at io.quarkus.security.runtime.interceptor.RolesAllowedInterceptor_Bean.intercept(Unknown Source)
       at io.quarkus.arc.impl.InterceptorInvocation.invoke(InterceptorInvocation.java:42)
       at io.quarkus.arc.impl.AroundInvokeInvocationContext.perform(AroundInvokeInvocationContext.java:30)
       at io.quarkus.arc.impl.InvocationContexts.performAroundInvoke(InvocationContexts.java:27)
       at com.inform.app.resource.crud.CompaniesJaxRs_6c4e12f29f9b83c374df013d4fa14e3ea3d6416d_Subclass.add(Unknown Source)
       at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
       at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
       at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
       at java.base/java.lang.reflect.Method.invoke(Method.java:568)
       at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:154)
       at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:118)
       at org.jboss.resteasy.core.ResourceMethodInvoker.internalInvokeOnTarget(ResourceMethodInvoker.java:560)
       at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTargetAfterFilter(ResourceMethodInvoker.java:452)
       at org.jboss.resteasy.core.ResourceMethodInvoker.lambda$invokeOnTarget$2(ResourceMethodInvoker.java:413)
       at org.jboss.resteasy.core.interception.jaxrs.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:321)
       at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:415)
       at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:378)
       at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:356)
       at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:70)
       at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:429)
       at org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:240)
       at org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:154)
       at org.jboss.resteasy.core.interception.jaxrs.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:321)
       at org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:157)
       at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:229)
       at io.quarkus.resteasy.runtime.standalone.RequestDispatcher.service(RequestDispatcher.java:82)
       at io.quarkus.resteasy.runtime.standalone.VertxRequestHandler.dispatch(VertxRequestHandler.java:147)
       at io.quarkus.resteasy.runtime.standalone.VertxRequestHandler$1.run(VertxRequestHandler.java:93)
       at io.quarkus.vertx.core.runtime.VertxCoreRecorder$14.runWith(VertxCoreRecorder.java:576)
       at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513)
       at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
       at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:29)
       at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:29)
       at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
       at java.base/java.lang.Thread.run(Thread.java:833)
Caused by: io.quarkus.security.ForbiddenException: Access denied!
       at com.inform.app.resource.crud.CompaniesListener.onBeforeAdd(CompaniesListener.java:21)
       at com.inform.app.resource.crud.CompaniesListener_ClientProxy.onBeforeAdd(Unknown Source)
       at com.inform.app.resource.crud.CompaniesImpl_6c4e12f29f9b83c374df013d4fa14e3ea3d6416d.add(Unknown Source)
       at com.inform.app.resource.crud.CompaniesImpl_6c4e12f29f9b83c374df013d4fa14e3ea3d6416d_Subclass.add$$superforward(Unknown Source)
       at com.inform.app.resource.crud.CompaniesImpl_6c4e12f29f9b83c374df013d4fa14e3ea3d6416d_Subclass$$function$$2.apply(Unknown Source)
       at io.quarkus.arc.impl.AroundInvokeInvocationContext.proceed(AroundInvokeInvocationContext.java:73)
       at io.quarkus.arc.impl.AroundInvokeInvocationContext.proceed(AroundInvokeInvocationContext.java:62)
       at io.quarkus.narayana.jta.runtime.interceptor.TransactionalInterceptorBase.invokeInOurTx(TransactionalInterceptorBase.java:136)
       at io.quarkus.narayana.jta.runtime.interceptor.TransactionalInterceptorBase.invokeInOurTx(TransactionalInterceptorBase.java:107)
       at io.quarkus.narayana.jta.runtime.interceptor.TransactionalInterceptorRequired.doIntercept(TransactionalInterceptorRequired.java:38)
       at io.quarkus.narayana.jta.runtime.interceptor.TransactionalInterceptorBase.intercept(TransactionalInterceptorBase.java:61)
       at io.quarkus.narayana.jta.runtime.interceptor.TransactionalInterceptorRequired.intercept(TransactionalInterceptorRequired.java:32)
       at io.quarkus.narayana.jta.runtime.interceptor.TransactionalInterceptorRequired_Bean.intercept(Unknown Source)
       at io.quarkus.arc.impl.InterceptorInvocation.invoke(InterceptorInvocation.java:42)
       at io.quarkus.arc.impl.AroundInvokeInvocationContext.perform(AroundInvokeInvocationContext.java:30)
       at io.quarkus.arc.impl.InvocationContexts.performAroundInvoke(InvocationContexts.java:27)
       at com.inform.app.resource.crud.CompaniesImpl_6c4e12f29f9b83c374df013d4fa14e3ea3d6416d_Subclass.add(Unknown Source)
       at com.inform.app.resource.crud.CompaniesImpl_6c4e12f29f9b83c374df013d4fa14e3ea3d6416d_ClientProxy.add(Unknown Source)
       ... 48 more

gmuellerinform · 2023-08-14T14:05:05Z

So, it looks like io.qua.hib.orm.res.dat.pan.run.RestDataPanacheExceptionMapper should rethrow io.quarkus.security.Exceptions!?

gmuellerinform · 2023-09-19T10:34:20Z

Hi! Any news on this?

gastaldi · 2023-09-19T11:28:27Z

@gmuellerinform can you share a small reproducer?

gmuellerinform · 2023-09-20T09:16:05Z

@gastaldi Hi! I created a repository for it: https://github.com/gmuellerinform/quarkus-security-exception-reproducer

gastaldi · 2023-09-20T14:02:29Z

@gmuellerinform @FroMage I have a local branch that works when WebApplicationException is thrown in these methods. Would that work for you?

gmuellerinform · 2023-09-20T14:04:00Z

Sure, that would be great!

…implementations - Fixes quarkusio#35169

gastaldi · 2023-09-20T14:22:03Z

@gmuellerinform please give it a try with https://github.com/gastaldi/quarkus/tree/rest_panache_catch, it's still missing the support for Hibernate Reactive, that's why I haven't sent a PR yet

gmuellerinform · 2023-09-20T14:34:04Z

Do you have a link to a tutorial how to use quarkus from source?

gastaldi · 2023-09-20T14:36:16Z

Build with mvn -Dquickly and change your project to use io.quarkus:quarkus-bom:999-SNAPSHOT (note that the groupid changes)

gmuellerinform · 2023-09-21T07:26:54Z

I now get a different exception:

Expected status code <403> but was <500>.

        at java.base/jdk.internal.reflect.DirectConstructorHandleAccessor.newInstance(DirectConstructorHandleAccessor.java:67)
        at java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:500)
        at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:484)
        at org.codehaus.groovy.reflection.CachedConstructor.invoke(CachedConstructor.java:73)
        at org.codehaus.groovy.runtime.callsite.ConstructorSite$ConstructorSiteNoUnwrapNoCoerce.callConstructor(ConstructorSite.java:108)
        at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCallConstructor(CallSiteArray.java:57)
        at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callConstructor(AbstractCallSite.java:263)
        at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callConstructor(AbstractCallSite.java:277)
        at io.restassured.internal.ResponseSpecificationImpl$HamcrestAssertionClosure.validate(ResponseSpecificationImpl.groovy:512)
        at io.restassured.internal.ResponseSpecificationImpl$HamcrestAssertionClosure$validate$1.call(Unknown Source)
        at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCall(CallSiteArray.java:45)
        at org.codehaus.groovy.runtime.callsite.AbstractCallSite.call(AbstractCallSite.java:125)
        at org.codehaus.groovy.runtime.callsite.AbstractCallSite.call(AbstractCallSite.java:139)
        at io.restassured.internal.ResponseSpecificationImpl.validateResponseIfRequired(ResponseSpecificationImpl.groovy:696)
        at io.restassured.internal.ResponseSpecificationImpl.this$2$validateResponseIfRequired(ResponseSpecificationImpl.groovy)
        at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)
        at java.base/java.lang.reflect.Method.invoke(Method.java:578)
        at org.codehaus.groovy.runtime.callsite.PlainObjectMetaMethodSite.doInvoke(PlainObjectMetaMethodSite.java:43)
        at org.codehaus.groovy.runtime.callsite.PogoMetaMethodSite$PogoCachedMethodSiteNoUnwrapNoCoerce.invoke(PogoMetaMethodSite.java:198)
        at org.codehaus.groovy.runtime.callsite.PogoMetaMethodSite.callCurrent(PogoMetaMethodSite.java:62)
        at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCallCurrent(CallSiteArray.java:49)
        at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callCurrent(AbstractCallSite.java:171)
        at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callCurrent(AbstractCallSite.java:185)
        at io.restassured.internal.ResponseSpecificationImpl.statusCode(ResponseSpecificationImpl.groovy:135)
        at io.restassured.specification.ResponseSpecification$statusCode$0.callCurrent(Unknown Source)
        at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCallCurrent(CallSiteArray.java:49)
        at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callCurrent(AbstractCallSite.java:171)
        at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callCurrent(AbstractCallSite.java:185)
        at io.restassured.internal.ResponseSpecificationImpl.statusCode(ResponseSpecificationImpl.groovy:143)
        at io.restassured.internal.ValidatableResponseOptionsImpl.statusCode(ValidatableResponseOptionsImpl.java:89)
        at org.acme.PersonResourceTest.testAdd(PersonResourceTest.java:19)
        at java.base/java.lang.reflect.Method.invoke(Method.java:578)
        at io.quarkus.test.junit.QuarkusTestExtension.runExtensionMethod(QuarkusTestExtension.java:1014)
        at io.quarkus.test.junit.QuarkusTestExtension.interceptTestMethod(QuarkusTestExtension.java:828)
        at java.base/java.util.ArrayList.forEach(ArrayList.java:1511)
        at java.base/java.util.ArrayList.forEach(ArrayList.java:1511)
        Suppressed: io.quarkus.rest.data.panache.RestDataPanacheException: Failed to add an entity
                at org.acme.PersonResourceJaxRs_3e3f2b08bc61477f296e187a31d4c409f4ab1ae3.add(Unknown Source)
                at java.base/java.lang.reflect.Method.invoke(Method.java:578)
                at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:154)
                at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:118)
                at org.jboss.resteasy.core.ResourceMethodInvoker.internalInvokeOnTarget(ResourceMethodInvoker.java:560)
                at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTargetAfterFilter(ResourceMethodInvoker.java:452)
                at org.jboss.resteasy.core.ResourceMethodInvoker.lambda$invokeOnTarget$2(ResourceMethodInvoker.java:413)
                at org.jboss.resteasy.core.interception.jaxrs.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:321)
                at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:415)
                at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:378)
                at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:356)
                at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:70)
                at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:429)
                at org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:240)
                at org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:154)
                at org.jboss.resteasy.core.interception.jaxrs.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:321)
                at org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:157)
                at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:229)
                at io.quarkus.resteasy.runtime.standalone.RequestDispatcher.service(RequestDispatcher.java:82)
                at io.quarkus.resteasy.runtime.standalone.VertxRequestHandler.dispatch(VertxRequestHandler.java:147)
                at io.quarkus.resteasy.runtime.standalone.VertxRequestHandler$1.run(VertxRequestHandler.java:93)
                at io.quarkus.vertx.core.runtime.VertxCoreRecorder$14.runWith(VertxCoreRecorder.java:582)
                at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513)
                at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
                at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:29)
                at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:29)
                at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
                at java.base/java.lang.Thread.run(Thread.java:1589)
        Caused by: io.quarkus.security.ForbiddenException: Cannot add a person
                at org.acme.PersonResourceListener.onBeforeAdd(PersonResourceListener.java:11)
                at org.acme.PersonResourceListener.onBeforeAdd(PersonResourceListener.java:7)
                at org.acme.PersonResourceListener_ClientProxy.onBeforeAdd(Unknown Source)
                at org.acme.PersonResourceImpl_3e3f2b08bc61477f296e187a31d4c409f4ab1ae3.add(Unknown Source)
                at org.acme.PersonResourceImpl_3e3f2b08bc61477f296e187a31d4c409f4ab1ae3_Subclass.add$$superforward(Unknown Source)
                at org.acme.PersonResourceImpl_3e3f2b08bc61477f296e187a31d4c409f4ab1ae3_Subclass$$function$$2.apply(Unknown Source)
                at io.quarkus.arc.impl.AroundInvokeInvocationContext.proceed(AroundInvokeInvocationContext.java:73)
                at io.quarkus.arc.impl.AroundInvokeInvocationContext.proceed(AroundInvokeInvocationContext.java:62)
                at io.quarkus.narayana.jta.runtime.interceptor.TransactionalInterceptorBase.invokeInOurTx(TransactionalInterceptorBase.java:136)
                at io.quarkus.narayana.jta.runtime.interceptor.TransactionalInterceptorBase.invokeInOurTx(TransactionalInterceptorBase.java:107)
                at io.quarkus.narayana.jta.runtime.interceptor.TransactionalInterceptorRequired.doIntercept(TransactionalInterceptorRequired.java:38)
                at io.quarkus.narayana.jta.runtime.interceptor.TransactionalInterceptorBase.intercept(TransactionalInterceptorBase.java:61)
                at io.quarkus.narayana.jta.runtime.interceptor.TransactionalInterceptorRequired.intercept(TransactionalInterceptorRequired.java:32)
                at io.quarkus.narayana.jta.runtime.interceptor.TransactionalInterceptorRequired_Bean.intercept(Unknown Source)
                at io.quarkus.arc.impl.InterceptorInvocation.invoke(InterceptorInvocation.java:42)
                at io.quarkus.arc.impl.AroundInvokeInvocationContext.perform(AroundInvokeInvocationContext.java:30)
                at io.quarkus.arc.impl.InvocationContexts.performAroundInvoke(InvocationContexts.java:27)
                at org.acme.PersonResourceImpl_3e3f2b08bc61477f296e187a31d4c409f4ab1ae3_Subclass.add(Unknown Source)
                at org.acme.PersonResourceImpl_3e3f2b08bc61477f296e187a31d4c409f4ab1ae3_ClientProxy.add(Unknown Source)
                ... 28 more

gastaldi · 2023-09-21T12:28:23Z

Can you throw a jakarta.ws.rs.ForbiddenException instead?

gmuellerinform · 2023-09-21T13:21:06Z

Doh, forgot. Now the test passes. Is there a way to supress the error log?

2023-09-21 15:18:53,151 INFO  [io.qua.dev.h2.dep.H2DevServicesProcessor] (build-32) Dev Services for H2 started.
2023-09-21 15:18:53,173 INFO  [io.qua.dat.dep.dev.DevServicesDatasourceProcessor] (build-32) Dev Services for default datasource (h2) started
2023-09-21 15:18:53,182 INFO  [io.qua.hib.orm.dep.dev.HibernateOrmDevServicesProcessor] (build-23) Setting quarkus.hibernate-orm.database.generation=drop-and-create to initialize Dev Services managed database
2023-09-21 15:18:56,777 INFO  [io.quarkus] (main) quarkus-security-exception-reproducer 1.0.0-SNAPSHOT on JVM (powered by Quarkus 999-SNAPSHOT) started in 6.131s. Listening on: http://0.0.0.0:8081
2023-09-21 15:18:56,778 INFO  [io.quarkus] (main) Profile test activated. 
2023-09-21 15:18:56,778 INFO  [io.quarkus] (main) Installed features: [agroal, cdi, hibernate-orm, hibernate-orm-panache, hibernate-orm-rest-data-panache, jdbc-h2, narayana-jta, resteasy, resteasy-jackson, security, smallrye-context-propagation, vertx]
2023-09-21 15:18:58,384 ERROR [org.jbo.res.res.i18n] (executor-thread-1) RESTEASY002010: Failed to execute: jakarta.ws.rs.ForbiddenException: Cannot add a person
        at org.acme.PersonResourceListener.onBeforeAdd(PersonResourceListener.java:11)
        at org.acme.PersonResourceListener.onBeforeAdd(PersonResourceListener.java:1)
        at org.acme.PersonResourceListener_ClientProxy.onBeforeAdd(Unknown Source)
        at org.acme.PersonResourceImpl_3e3f2b08bc61477f296e187a31d4c409f4ab1ae3.add(Unknown Source)
        at org.acme.PersonResourceImpl_3e3f2b08bc61477f296e187a31d4c409f4ab1ae3_Subclass.add$$superforward(Unknown Source)
        at org.acme.PersonResourceImpl_3e3f2b08bc61477f296e187a31d4c409f4ab1ae3_Subclass$$function$$2.apply(Unknown Source)
        at io.quarkus.arc.impl.AroundInvokeInvocationContext.proceed(AroundInvokeInvocationContext.java:73)
        at io.quarkus.arc.impl.AroundInvokeInvocationContext.proceed(AroundInvokeInvocationContext.java:62)
        at io.quarkus.narayana.jta.runtime.interceptor.TransactionalInterceptorBase.invokeInOurTx(TransactionalInterceptorBase.java:136)
        at io.quarkus.narayana.jta.runtime.interceptor.TransactionalInterceptorBase.invokeInOurTx(TransactionalInterceptorBase.java:107)
        at io.quarkus.narayana.jta.runtime.interceptor.TransactionalInterceptorRequired.doIntercept(TransactionalInterceptorRequired.java:38)
        at io.quarkus.narayana.jta.runtime.interceptor.TransactionalInterceptorBase.intercept(TransactionalInterceptorBase.java:61)
        at io.quarkus.narayana.jta.runtime.interceptor.TransactionalInterceptorRequired.intercept(TransactionalInterceptorRequired.java:32)
        at io.quarkus.narayana.jta.runtime.interceptor.TransactionalInterceptorRequired_Bean.intercept(Unknown Source)
        at io.quarkus.arc.impl.InterceptorInvocation.invoke(InterceptorInvocation.java:42)
        at io.quarkus.arc.impl.AroundInvokeInvocationContext.perform(AroundInvokeInvocationContext.java:30)
        at io.quarkus.arc.impl.InvocationContexts.performAroundInvoke(InvocationContexts.java:27)
        at org.acme.PersonResourceImpl_3e3f2b08bc61477f296e187a31d4c409f4ab1ae3_Subclass.add(Unknown Source)
        at org.acme.PersonResourceImpl_3e3f2b08bc61477f296e187a31d4c409f4ab1ae3_ClientProxy.add(Unknown Source)
        at org.acme.PersonResourceJaxRs_3e3f2b08bc61477f296e187a31d4c409f4ab1ae3.add(Unknown Source)
        at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)
        at java.base/java.lang.reflect.Method.invoke(Method.java:578)
        at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:154)
        at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:118)
        at org.jboss.resteasy.core.ResourceMethodInvoker.internalInvokeOnTarget(ResourceMethodInvoker.java:560)
        at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTargetAfterFilter(ResourceMethodInvoker.java:452)
        at org.jboss.resteasy.core.ResourceMethodInvoker.lambda$invokeOnTarget$2(ResourceMethodInvoker.java:413)
        at org.jboss.resteasy.core.interception.jaxrs.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:321)
        at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:415)
        at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:378)
        at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:356)
        at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:70)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:429)
        at org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:240)
        at org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:154)
        at org.jboss.resteasy.core.interception.jaxrs.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:321)
        at org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:157)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:229)
        at io.quarkus.resteasy.runtime.standalone.RequestDispatcher.service(RequestDispatcher.java:82)
        at io.quarkus.resteasy.runtime.standalone.VertxRequestHandler.dispatch(VertxRequestHandler.java:147)
        at io.quarkus.resteasy.runtime.standalone.VertxRequestHandler$1.run(VertxRequestHandler.java:93)
        at io.quarkus.vertx.core.runtime.VertxCoreRecorder$14.runWith(VertxCoreRecorder.java:582)
        at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513)
        at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
        at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:29)
        at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:29)
        at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
        at java.base/java.lang.Thread.run(Thread.java:1589)

gastaldi · 2023-09-21T13:23:59Z

I usually do that by adding this to the application.properties:

quarkus.log.category."org.jboss.resteasy.resteasy_jaxrs.i18n".level=OFF

gmuellerinform · 2023-11-10T07:33:51Z

Hi! Any chance that those changes are merged soon? Would be great! Thanks!

…implementations - Fixes quarkusio#35169

gmuellerinform added the kind/bug Something isn't working label Aug 2, 2023

quarkus-bot bot added area/panache area/security labels Aug 2, 2023

gastaldi added a commit to gastaldi/quarkus that referenced this issue Sep 20, 2023

Bubble up WebApplicationExceptions in RestDataResourceMethodListener …

8740e13

…implementations - Fixes quarkusio#35169

gastaldi added a commit to gastaldi/quarkus that referenced this issue Jan 18, 2024

Bubble up WebApplicationExceptions in RestDataResourceMethodListener …

6e3b906

…implementations - Fixes quarkusio#35169

gastaldi linked a pull request Jan 18, 2024 that will close this issue

Bubble up WebApplicationExceptions in RestDataResourceMethodListener implementations #38281

Draft

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

SecurityExceptions thrown in Panache Before/After Listeners result in Internal Server errors #35169

SecurityExceptions thrown in Panache Before/After Listeners result in Internal Server errors #35169

gmuellerinform commented Aug 2, 2023

quarkus-bot bot commented Aug 2, 2023

FroMage commented Aug 14, 2023

FroMage commented Aug 14, 2023

gmuellerinform commented Aug 14, 2023

gmuellerinform commented Aug 14, 2023

gmuellerinform commented Sep 19, 2023

gastaldi commented Sep 19, 2023

gmuellerinform commented Sep 20, 2023

gastaldi commented Sep 20, 2023

gmuellerinform commented Sep 20, 2023

gastaldi commented Sep 20, 2023

gmuellerinform commented Sep 20, 2023

gastaldi commented Sep 20, 2023

gmuellerinform commented Sep 21, 2023

gastaldi commented Sep 21, 2023

gmuellerinform commented Sep 21, 2023

gastaldi commented Sep 21, 2023

gmuellerinform commented Nov 10, 2023

SecurityExceptions thrown in Panache Before/After Listeners result in Internal Server errors #35169

SecurityExceptions thrown in Panache Before/After Listeners result in Internal Server errors #35169

Comments

gmuellerinform commented Aug 2, 2023

Describe the bug

Expected behavior

Actual behavior

How to Reproduce?

Output of uname -a or ver

Output of java -version

GraalVM version (if different from Java)

Quarkus version or git rev

Build tool (ie. output of mvnw --version or gradlew --version)

Additional information

quarkus-bot bot commented Aug 2, 2023

FroMage commented Aug 14, 2023

FroMage commented Aug 14, 2023

gmuellerinform commented Aug 14, 2023

gmuellerinform commented Aug 14, 2023

gmuellerinform commented Sep 19, 2023

gastaldi commented Sep 19, 2023

gmuellerinform commented Sep 20, 2023

gastaldi commented Sep 20, 2023

gmuellerinform commented Sep 20, 2023

gastaldi commented Sep 20, 2023

gmuellerinform commented Sep 20, 2023

gastaldi commented Sep 20, 2023

gmuellerinform commented Sep 21, 2023

gastaldi commented Sep 21, 2023

gmuellerinform commented Sep 21, 2023

gastaldi commented Sep 21, 2023

gmuellerinform commented Nov 10, 2023

Output of `uname -a` or `ver`

Output of `java -version`

Build tool (ie. output of `mvnw --version` or `gradlew --version`)