Using the unexpected method, due to dependency conflicts on commons-codec

[HelloCoCooo]

Hi, there are multiple versions of commons-codec:commons-codec in yawp-yawp-2.0.4alpha\yawp-appengine. As shown in the following dependency tree, according to Maven's "nearest wins strategy", only commons-codec:commons-codec:jar:1.10 can be loaded, and commons-codec:commons-codec:jar:1.3 will be shaded.

Your project references the method org.apache.commons.codec.binary.Base64.encode( byte[] ), which is included in the shaded version commons-codec:commons-codec:jar:1.3. However, this method is missing in the actual loaded version commons-codec:jar:1.10. Surprisingly, it will not cause NoSuchMethodError at rumtime.

By further analyzing, I found that the caller Io.yawp.commons.utils.NameGenerator : generate( byte[] ) would invoke the method BaseNCodec.encode( byte[] ) defined in the superclass (Base64 extends BaseNCodec) of org.apache.commons.codec.binary.Base64 with the same signature of the expected callee, due to dynamic binding mechanism.

Although the actual invoked method belonging to BaseNCodec has the same method name, same parameter types and return type, but it has different control flows and different behaviors. Maybe it is buggy behavior.

Solution: Remove the conflicting Jars.

Dependency tree------------- io.yawp:yawp:jar:2.0.4alpha +- io.yawp:yawp-core:jar:2.0.4alpha:compile | +- com.google.code.gson:gson:jar:2.2.4:compile | +- com.owlike:genson:jar:1.4:compile | +- org.apache.commons:commons-lang3:jar:3.1:compile | +- org.reflections:reflections:jar:0.9.10:compile | | +- org.javassist:javassist:jar:3.19.0-GA:compile | | - com.google.code.findbugs:annotations:jar:2.0.1:compile | +- com.google.guava:guava:jar:19.0:compile | +- commons-beanutils:commons-beanutils:jar:1.9.1:compile | | +- commons-logging:commons-logging:jar:1.1.1:compile | | - commons-collections:commons-collections:jar:3.2.1:compile | +- commons-codec:commons-codec:jar:1.10:compile | - org.yaml:snakeyaml:jar:1.16:compile +- com.google.appengine:appengine-api-1.0-sdk:jar:1.9.51:compile +- com.google.appengine:appengine-api-labs:jar:1.9.51:compile +- com.google.appengine.tools:appengine-pipeline:jar:0.2.13:compile | +- org.json:json:jar:20090211:compile | +- (com.google.appengine:appengine-api-1.0-sdk:jar:1.9.51:compile - omitted for duplicate) | - (com.google.guava:guava:jar:19.0:compile - omitted for duplicate) +- com.google.appengine.tools:appengine-gcs-client:jar:0.6:compile | +- (com.google.appengine:appengine-api-1.0-sdk:jar:1.9.51:compile - omitted for duplicate) | +- (com.google.guava:guava:jar:19.0-rc1:compile - omitted for conflict with 19.0) | +- joda-time:joda-time:jar:2.3:compile | +- com.google.apis:google-api-services-storage:jar:v1-rev68-1.21.0:compile | | - com.google.api-client:google-api-client:jar:1.21.0:compile | | +- com.google.oauth-client:google-oauth-client:jar:1.21.0:compile | | | - (com.google.code.findbugs:jsr305:jar:1.3.9:compile - omitted for duplicate) | | - (com.google.http-client:google-http-client-jackson2:jar:1.21.0:compile - omitted for duplicate) | +- com.google.api-client:google-api-client-appengine:jar:1.27.0:compile | | +- com.google.oauth-client:google-oauth-client-appengine:jar:1.27.0:compile | | | +- (com.google.http-client:google-http-client-appengine:jar:1.27.0:compile - omitted for duplicate) | | | +- (com.google.oauth-client:google-oauth-client:jar:1.27.0:compile - omitted for conflict with 1.21.0) | | | - com.google.oauth-client:google-oauth-client-servlet:jar:1.27.0:compile | | | +- (com.google.oauth-client:google-oauth-client:jar:1.27.0:compile - omitted for conflict with 1.21.0) | | | +- com.google.http-client:google-http-client-jdo:jar:1.27.0:compile | | | | - (javax.jdo:jdo2-api:jar:2.3-eb:compile - omitted for duplicate) | | | - (javax.jdo:jdo2-api:jar:2.3-eb:compile - omitted for duplicate) | | +- (com.google.api-client:google-api-client:jar:1.27.0:compile - omitted for conflict with 1.21.0) | | +- com.google.api-client:google-api-client-servlet:jar:1.27.0:compile | | | +- (com.google.oauth-client:google-oauth-client-servlet:jar:1.27.0:compile - omitted for duplicate) | | | +- (com.google.api-client:google-api-client:jar:1.27.0:compile - omitted for conflict with 1.21.0) | | | +- (javax.servlet:servlet-api:jar:2.5:compile - omitted for duplicate) | | | - javax.jdo:jdo2-api:jar:2.3-eb:compile | | | - javax.transaction:transaction-api:jar:1.1:compile | | - com.google.http-client:google-http-client-appengine:jar:1.27.0:compile | - com.google.http-client:google-http-client-jackson2:jar:1.21.0:compile | - com.fasterxml.jackson.core:jackson-core:jar:2.9.6:compile +- com.google.http-client:google-http-client:jar:1.22.0:compile | +- com.google.code.findbugs:jsr305:jar:1.3.9:compile | - org.apache.httpcomponents:httpclient:jar:4.0.1:compile | +- org.apache.httpcomponents:httpcore:jar:4.0.1:compile | +- (commons-logging:commons-logging:jar:1.1.1:compile - omitted for duplicate) | - (commons-codec:commons-codec:jar:1.3:compile - omitted for conflict with 1.10) +- javax.servlet:servlet-api:jar:2.5:provided (scope not updated to compile) - junit:junit:jar:4.11:test - org.hamcrest:hamcrest-core:jar:1.3:test

---

The code snippet of org.apache.commons.codec.binary.Base64.encode( byte[] )----

and code snippet of org.apache.commons.codec.binary.BaseNCodec.encode( byte[] )----

Hope this report can help you. Happy new year!

Best, Coco

[HelloCoCooo]

Using the following test case to run on these two versions of methods separately starting from the entry method NameGenerator.generateFromString( ) in your project, then we can find that variable io.yawp.driver.appengine.IdRefToKey.createShuffledKey.key, is assigned different values. Testcase_feroultyawp.txt

Please check whether the changes of this variable value will affect your semantic behaviors.

Thanks for your attention.

hi, @feroult , could you help me deal with it?

[feroult]

@HelloCoCooo Sure!

I'll take look. Do you need Java7 support? Or could we go with only Java 8 solution for YAWP 2.0?

Also, by any chance, as you pointed out a possible solution, would you mind do provide a PR?

Don't worry if you can't... I'll take look at it anyway, hopefully I'll to get it to you soon.

Regards.

[feroult]

@HelloCoCooo version 2.0.5alpha removes the commons codec dependency.

Let me know if you still have problems.

Regards

[HelloCoCooo]

@feroult Thank you very much!