1

After almost a year without any problem suddenly my Glassfish web application is not working any more. In the browser the requested pages are truncated and bad formatted. The log is full of the following exceptions:

 [2016-01-04T17:45:21.263+0100] [glassfish 4.0] [WARNING] [] [javax.enterprise.web.core] [tid: _ThreadID=22 _ThreadName=http-listener-1(5)] [timeMillis: 1451925921263] [levelValue: 900] [[
Error invoking requestInitialized method on ServletRequestListener org.jboss.weld.servlet.WeldListener
java.lang.IllegalStateException: isHexDigit

[2016-01-04T17:45:21.367+0100] [glassfish 4.0] [WARNING] [] [javax.enterprise.web.core] [tid: _ThreadID=22 _ThreadName=http-listener-1(5)] [timeMillis: 1451925921367] [levelValue: 900] [[
Servlet.service() for servlet Faces Servlet threw exception
java.lang.IllegalStateException: A request must be associated with the context in order to load the known conversations

and others related perhaps to a poorly configured error page. It seems that glassfish responds with a 500 internal error to requests like this: www.mysite/faces/javax.faces.resource/primefaces.css?ln=primefaces&v=4.0

In internet I found the following related posts:

  1. java.lang.IllegalArgumentException
  2. Glassfish 4 do not load js files
  3. random Http 500 Internal Error

From the above documentation it is clear that Glassfish 4 has some bugs and it is not wise to use it in production. I wonder why everything seemed to work well for more than a year and suddenly it broke. The third link suggests it may be due to an external attack and it provides a patch I'm going to test. Is it correct or am I misunderstanding something ?

Community
  • 1
  • 1
Filippo
  • 1,123
  • 1
  • 11
  • 28
  • 1
    It looks very much like you have fallen victim to the Struts2 vulnerability in your 3rd link. It will be fixed in the latest release of GlassFish, version 4.1.1 which was released this year. If you are concerned about GlassFish in production, you may wish to consider Payara, which is a supported build of GlassFish, but completely free and open source. (Full disclosure: I am an employee of Payara, so I won't say anything more about it here, this isn't the place for an advertisement) – Mike Jan 05 '16 at 20:00

0 Answers0