fix: exclude project maven dependencies from isolated class loader (#…

…20523) (#20530) If the user project directly or transitively depends on maven artifacts, mojos can fail at runtime because of Maven API loaded from both isolated class loader and maven.api realm. This change prevents maven artifacts from being added to the isolated class loader. Co-authored-by: Marco Collovati <[email protected]>
vaadin · Nov 21, 2024 · a0938a3 · a0938a3
1 parent a9819c2
commit a0938a3
Show file tree

Hide file tree

Showing 5 changed files with 149 additions and 0 deletions.
diff --git a/...-plugins/flow-dev-bundle-plugin/src/main/java/com/vaadin/flow/plugin/maven/Reflector.java b/...-plugins/flow-dev-bundle-plugin/src/main/java/com/vaadin/flow/plugin/maven/Reflector.java
@@ -27,6 +27,7 @@
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Set;
 import java.util.function.Function;
 import java.util.stream.Collectors;
 
@@ -48,6 +49,9 @@
 public final class Reflector {
 
     public static final String INCLUDE_FROM_COMPILE_DEPS_REGEX = ".*(/|\\\\)(portlet-api|javax\\.servlet-api)-.+jar$";
+    private static final Set<String> DEPENDENCIES_GROUP_EXCLUSIONS = Set.of(
+            "org.apache.maven", "org.codehaus.plexus", "org.slf4j",
+            "org.eclipse.sisu");
 
     private final URLClassLoader isolatedClassLoader;
     private Object classFinder;
@@ -223,6 +227,10 @@ private static URLClassLoader createIsolatedClassLoader(
 
         Map<String, Artifact> projectDependencies = new HashMap<>(project
                 .getArtifacts().stream()
+                // Exclude all maven artifacts to prevent class loading clash
+                // with maven.api class realm
+                .filter(artifact -> !DEPENDENCIES_GROUP_EXCLUSIONS
+                        .contains(artifact.getGroupId()))
                 .filter(artifact -> artifact.getFile() != null
                         && artifact.getArtifactHandler().isAddedToClasspath()
                         && (Artifact.SCOPE_COMPILE.equals(artifact.getScope())
@@ -238,6 +246,10 @@ private static URLClassLoader createIsolatedClassLoader(
         if (mojoExecution != null) {
             mojoExecution.getMojoDescriptor().getPluginDescriptor()
                     .getArtifacts().stream()
+                    // Exclude all maven artifacts to prevent class loading
+                    // clash with maven.api class realm
+                    .filter(artifact -> !DEPENDENCIES_GROUP_EXCLUSIONS
+                            .contains(artifact.getGroupId()))
                     .filter(artifact -> !projectDependencies
                             .containsKey(keyMapper.apply(artifact)))
                     .forEach(artifact -> projectDependencies

diff --git a/flow-plugins/flow-maven-plugin/src/it/ignore-maven-deps-from-project/invoker.properties b/flow-plugins/flow-maven-plugin/src/it/ignore-maven-deps-from-project/invoker.properties
@@ -0,0 +1,17 @@
+#
+# Copyright 2000-2024 Vaadin Ltd.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may not
+# use this file except in compliance with the License. You may obtain a copy of
+# the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations under
+# the License.
+#
+
+invoker.goals=clean package
diff --git a/flow-plugins/flow-maven-plugin/src/it/ignore-maven-deps-from-project/pom.xml b/flow-plugins/flow-maven-plugin/src/it/ignore-maven-deps-from-project/pom.xml
@@ -0,0 +1,88 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>com.vaadin.test.maven</groupId>
+    <artifactId>resources-from-project</artifactId>
+    <version>1.0</version>
+    <packaging>jar</packaging>
+
+    <description>
+        Tests that plugin dependencies do not override resources from project artifacts.
+    </description>
+
+    <properties>
+        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+        <maven.compiler.release>17</maven.compiler.release>
+        <maven.compiler.source>${maven.compiler.release}</maven.compiler.source>
+        <maven.compiler.target>${maven.compiler.release}</maven.compiler.target>
+        <maven.test.skip>true</maven.test.skip>
+
+        <flow.version>@project.version@</flow.version>
+        <maven.version>3.9.9</maven.version>
+    </properties>
+
+    <dependencies>
+        <dependency>
+            <groupId>com.vaadin</groupId>
+            <artifactId>flow-server</artifactId>
+            <version>${flow.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>com.vaadin</groupId>
+            <artifactId>flow-client</artifactId>
+            <version>${flow.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.maven</groupId>
+            <artifactId>maven-artifact</artifactId>
+            <version>${maven.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.maven</groupId>
+            <artifactId>maven-core</artifactId>
+            <version>${maven.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.maven</groupId>
+            <artifactId>maven-plugin-api</artifactId>
+            <version>${maven.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-simple</artifactId>
+            <version>2.0.16</version>
+        </dependency>
+        <dependency>
+            <groupId>org.codehaus.plexus</groupId>
+            <artifactId>plexus-build-api</artifactId>
+            <version>1.2.0</version>
+        </dependency>
+
+    </dependencies>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <version>3.13.0</version>
+            </plugin>
+            <plugin>
+                <groupId>com.vaadin</groupId>
+                <artifactId>flow-maven-plugin</artifactId>
+                <version>${flow.version}</version>
+                <executions>
+                    <execution>
+                        <goals>
+                            <goal>prepare-frontend</goal>
+                            <goal>build-frontend</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
+        </plugins>
+    </build>
+
+</project>
diff --git a/...it/ignore-maven-deps-from-project/src/main/java/com/vaadin/test/ProjectFlowExtension.java b/...it/ignore-maven-deps-from-project/src/main/java/com/vaadin/test/ProjectFlowExtension.java
@@ -0,0 +1,20 @@
+package com.vaadin.test;
+
+import java.util.List;
+
+import com.vaadin.flow.server.frontend.Options;
+import com.vaadin.flow.server.frontend.TypeScriptBootstrapModifier;
+import com.vaadin.flow.server.frontend.scanner.FrontendDependenciesScanner;
+
+/**
+ * Hello world!
+ */
+public class ProjectFlowExtension implements TypeScriptBootstrapModifier {
+
+    @Override
+    public void modify(List<String> bootstrapTypeScript, Options options,
+            FrontendDependenciesScanner frontendDependenciesScanner) {
+        System.out.println("ProjectFlowExtension");
+        bootstrapTypeScript.add("(window as any).testProject=1;");
+    }
+}
diff --git a/flow-plugins/flow-maven-plugin/src/main/java/com/vaadin/flow/plugin/maven/Reflector.java b/flow-plugins/flow-maven-plugin/src/main/java/com/vaadin/flow/plugin/maven/Reflector.java
@@ -27,6 +27,7 @@
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Set;
 import java.util.function.Function;
 import java.util.stream.Collectors;
 
@@ -48,6 +49,9 @@
 public final class Reflector {
 
     public static final String INCLUDE_FROM_COMPILE_DEPS_REGEX = ".*(/|\\\\)(portlet-api|javax\\.servlet-api)-.+jar$";
+    private static final Set<String> DEPENDENCIES_GROUP_EXCLUSIONS = Set.of(
+            "org.apache.maven", "org.codehaus.plexus", "org.slf4j",
+            "org.eclipse.sisu");
 
     private final URLClassLoader isolatedClassLoader;
     private Object classFinder;
@@ -223,6 +227,10 @@ private static URLClassLoader createIsolatedClassLoader(
 
         Map<String, Artifact> projectDependencies = new HashMap<>(project
                 .getArtifacts().stream()
+                // Exclude all maven artifacts to prevent class loading clash
+                // with maven.api class realm
+                .filter(artifact -> !DEPENDENCIES_GROUP_EXCLUSIONS
+                        .contains(artifact.getGroupId()))
                 .filter(artifact -> artifact.getFile() != null
                         && artifact.getArtifactHandler().isAddedToClasspath()
                         && (Artifact.SCOPE_COMPILE.equals(artifact.getScope())
@@ -238,6 +246,10 @@ private static URLClassLoader createIsolatedClassLoader(
         if (mojoExecution != null) {
             mojoExecution.getMojoDescriptor().getPluginDescriptor()
                     .getArtifacts().stream()
+                    // Exclude all maven artifacts to prevent class loading
+                    // clash with maven.api class realm
+                    .filter(artifact -> !DEPENDENCIES_GROUP_EXCLUSIONS
+                            .contains(artifact.getGroupId()))
                     .filter(artifact -> !projectDependencies
                             .containsKey(keyMapper.apply(artifact)))
                     .forEach(artifact -> projectDependencies