Getting AccessControlException when instantiating Gson in GAE. why? - google-app-engine

Question

I'm writing a servlet for GAE that responds with a simple JSON serialization of a POJO.
The thing is, I'm getting AccessControlException when I instantiate the Gson object itself, even before instantiating the object I want to serialize (!).
the method:
#Override
protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
MyObject object = new MyObject();
Gson gson = new Gson(); // here it throws
String json = gson.toJson(object);
resp.setContentType("application/json");
resp.setContentLength(json.length());
resp.setCharacterEncoding("UTF-8");
resp.getWriter().write(json);
}
any ideas?
stacktrace (sorry for the flood):
java.lang.ExceptionInInitializerError
at com.google.gson.Gson.<init>(Gson.java:149)
at com.foodblox.server.RecipeServlet.doPost(RecipeServlet.java:39)
at com.foodblox.server.RecipeServlet.doGet(RecipeServlet.java:21)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:617)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
at org.mortbay.jetty.servlet.ServletHolder.handle(ServletHolder.java:511)
at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1166)
at com.google.appengine.api.blobstore.dev.ServeBlobFilter.doFilter(ServeBlobFilter.java:58)
at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1157)
at com.google.apphosting.utils.servlet.TransactionCleanupFilter.doFilter(TransactionCleanupFilter.java:43)
at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1157)
at com.google.appengine.tools.development.StaticFileFilter.doFilter(StaticFileFilter.java:122)
at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1157)
at org.mortbay.jetty.servlet.ServletHandler.handle(ServletHandler.java:388)
at org.mortbay.jetty.security.SecurityHandler.handle(SecurityHandler.java:216)
at org.mortbay.jetty.servlet.SessionHandler.handle(SessionHandler.java:182)
at org.mortbay.jetty.handler.ContextHandler.handle(ContextHandler.java:765)
at org.mortbay.jetty.webapp.WebAppContext.handle(WebAppContext.java:418)
at com.google.apphosting.utils.jetty.DevAppEngineWebAppContext.handle(DevAppEngineWebAppContext.java:70)
at org.mortbay.jetty.handler.HandlerWrapper.handle(HandlerWrapper.java:152)
at com.google.appengine.tools.development.JettyContainerService$ApiProxyHandler.handle(JettyContainerService.java:351)
at org.mortbay.jetty.handler.HandlerWrapper.handle(HandlerWrapper.java:152)
at org.mortbay.jetty.Server.handle(Server.java:326)
at org.mortbay.jetty.HttpConnection.handleRequest(HttpConnection.java:542)
at org.mortbay.jetty.HttpConnection$RequestHandler.headerComplete(HttpConnection.java:923)
at org.mortbay.jetty.HttpParser.parseNext(HttpParser.java:547)
at org.mortbay.jetty.HttpParser.parseAvailable(HttpParser.java:212)
at org.mortbay.jetty.HttpConnection.handle(HttpConnection.java:404)
at org.mortbay.io.nio.SelectChannelEndPoint.run(SelectChannelEndPoint.java:409)
at org.mortbay.thread.QueuedThreadPool$PoolThread.run(QueuedThreadPool.java:582)
Caused by: java.security.AccessControlException: access denied (java.lang.RuntimePermission accessClassInPackage.sun.misc)
at java.security.AccessControlContext.checkPermission(AccessControlContext.java:323)
at java.security.AccessController.checkPermission(AccessController.java:546)
at java.lang.SecurityManager.checkPermission(SecurityManager.java:532)
at com.google.appengine.tools.development.DevAppServerFactory$CustomSecurityManager.checkPermission(DevAppServerFactory.java:166)
at java.lang.SecurityManager.checkPackageAccess(SecurityManager.java:1512)
at java.lang.ClassLoader$1.run(ClassLoader.java:331)
at java.security.AccessController.doPrivileged(Native Method)
at java.lang.ClassLoader.checkPackageAccess(ClassLoader.java:329)
at com.google.gson.MappedObjectConstructor.getUnsafe(MappedObjectConstructor.java:61)
at com.google.gson.MappedObjectConstructor.<clinit>(MappedObjectConstructor.java:41)
... 30 more
java.security.AccessControlException: access denied (java.lang.RuntimePermission accessClassInPackage.sun.misc)
at java.security.AccessControlContext.checkPermission(AccessControlContext.java:323)
at java.security.AccessController.checkPermission(AccessController.java:546)
at java.lang.SecurityManager.checkPermission(SecurityManager.java:532)
at com.google.appengine.tools.development.DevAppServerFactory$CustomSecurityManager.checkPermission(DevAppServerFactory.java:166)
at java.lang.SecurityManager.checkPackageAccess(SecurityManager.java:1512)
at java.lang.ClassLoader$1.run(ClassLoader.java:331)
at java.security.AccessController.doPrivileged(Native Method)
at java.lang.ClassLoader.checkPackageAccess(ClassLoader.java:329)
at com.google.gson.MappedObjectConstructor.getUnsafe(MappedObjectConstructor.java:61)
at com.google.gson.MappedObjectConstructor.<clinit>(MappedObjectConstructor.java:41)
at com.google.gson.Gson.<init>(Gson.java:149)
Update
gson revision 730
GAE 1.4.2
managed to circumvent the problem using this patch:
Index: gson/src/main/java/com/google/gson/MappedObjectConstructor.java
===================================================================
--- gson/src/main/java/com/google/gson/MappedObjectConstructor.java (revision 730)
+++ gson/src/main/java/com/google/gson/MappedObjectConstructor.java (working copy)
## -57,7 +57,8 ##
}
private static Unsafe getUnsafe() {
- try {
+ return null;
+/* try {
Field f = Unsafe.class.getDeclaredField("theUnsafe");
f.setAccessible(true);
return (Unsafe) f.get(null);
## -66,7 +67,7 ##
} catch (IllegalAccessException e) {
throw new Error();
}
- }
+*/ }
public Object constructArray(Type type, int length) {
return Array.newInstance(Types.getRawType(type), length);

Answer 1

sun.misc.unsafe isn't available on GAE. I not positive what the consequences are of commenting out those lines, but my best guess is that you'll run into problems with classes that don't have no-arg constructors.