Is Jasypt 1.9.2 compatible with Spring 4.3.8?

user_349667 0
Viewed 2385

We are migrating an ant based spring 3.1 app to maven based spring 4.3.8. We are encrypting our property file entries with Jasypt 1.9.2. However, when the app is started, it throws 

Caused by: org.springframework.beans.factory.CannotLoadBeanClassException: Cannot find class [org.jasypt.spring31.properties.EncryptablePropertyPlaceholderConfigurer] for bean with name 'propertyPlaceholderConfigurer' defined in ServletContext resource [/WEB-INF/applicationContext.xml]; nested exception is java.lang.ClassNotFoundException: org.jasypt.spring31.properties.EncryptablePropertyPlaceholderConfigurer

jasypt-1.9.2 and jasypt-spring31-1.9.2 jars are available under WEB-INF/lib folder. Below is the application context:

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"   
    xmlns:context="http://www.springframework.org/schema/context"
    xmlns:mvc="http://www.springframework.org/schema/mvc"
    xmlns:aop="http://www.springframework.org/schema/aop"
    xsi:schemaLocation="
        http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
        http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
        http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc.xsd
        http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop.xsd">

    <mvc:annotation-driven />
    <mvc:resources mapping="*.html" location="/" />

    <context:component-scan base-package="com.xyz" />
     <bean id="propertyPlaceholderConfigurer"
      class="org.jasypt.spring31.properties.EncryptablePropertyPlaceholderConfigurer">
        <constructor-arg ref="configurationEncryptor" />
    </bean>

    <bean id="configurationEncryptor" class="org.jasypt.encryption.pbe.StandardPBEStringEncryptor">
        <property name="config" ref="environmentVariablesConfiguration" />
    </bean>

    <bean id="environmentVariablesConfiguration"
      class="org.jasypt.encryption.pbe.config.EnvironmentStringPBEConfig">
        <property name="algorithm" value="PBEWithMD5AndDES" />
        <property name="password" value="xxxx" /> 
    </bean>
</beans>

Maven entry is :

<dependency>
        <groupId>org.jasypt</groupId>
        <artifactId>jasypt-spring31</artifactId>
        <version>1.9.2</version>
</dependency>
jasypt spring-mvc
2 Answers

No. According to http://jasypt.org/encrypting-configuration.html:

Spring-integrated transparent decryption of .properties files: Jasypt can integrate into the configuration system of the Spring Framework (2.x and 3.x) and transparently decrypt .properties files used by Spring applications. Learn more: Spring 2.x, Spring 3.0, Spring 3.1.

user_13948970

Not directly substitutable, but can be easily fixed

We also had the Cannot find class [org.jasypt.spring31.properties.EncryptablePropertyPlaceholderConfigurer] when trying to upgrade to Jasypt 1.9.3.

We were using Jasypt 1.4.1 and had to migrate due to vulnerabilities, so our only option (according to the vulnerabilities scanner) was "1.9.2 or higher."

1.9.3 is not a direct substitution for 1.4.1. The class hierarchy changes and, since we had springframework 4.x, we had to use the jasypt-spring4artifact:

<dependency>
    <groupId>org.jasypt</groupId>
    <artifactId>jasypt-spring4</artifactId>
    <version>1.9.3</version>
</dependency>

So our beans (we used it directly from XML with spring) now look like this:

<bean id="myBasicTextEncryptor" class="org.jasypt.util.text.BasicTextEncryptor">
    <property name="password" value="YouWishIShowYou" />
</bean>

<bean id="myPropertyConfigurer" class="org.jasypt.spring4.properties.EncryptablePropertyPlaceholderConfigurer">
    <property name="ignoreUnresolvablePlaceholders" value="true" />
    <constructor-arg ref="myBasicTextEncryptor" />
    <property name="locations">
        <list>
            <value>classpath:/properties/localSecrets.properties</value>
        </list>
    </property>
</bean>

In which the only change we had to do to make it work was adding that 4 in org.jasypt.spring4.properties.EncryptablePropertyPlaceholderConfigurer

user_51087770
Related