In Bean definition by XMLConfig, class constructor selection may be random

[takahashihrzg]

Affects: version 6.1.0-M3 or later

---

Summary

In XMLConfig, if a bean-defined class has an overloaded constructor, an exception may occur at runtime.
I checked the logs and found that the wrong constructor was used.

This behavior seems to occur when only the name attribute is used on the constructor-arg element.
It does not occur when the type or index attribute is used on the constructor-arg element.

Detail

I found this behavior in the bean definition of RestTemplate.
Here is an example of a Baen definition that throws an exception.

  <bean id="proxyHttpClientBuilder" class="org.apache.hc.client5.http.impl.classic.HttpClientBuilder" factory-method="create">
    <property name="proxy">
      <bean class="org.apache.hc.core5.http.HttpHost">
        <constructor-arg name="hostname" value="${rscl.http.proxyHost}" />
        <constructor-arg name="port" value="${rscl.http.proxyPort}" />
      </bean>
    </property>
  </bean>

  <bean id="proxyRestTemplate" class="org.springframework.web.client.RestTemplate">
    <constructor-arg>
      <bean class="org.springframework.http.client.HttpComponentsClientHttpRequestFactory">
        <constructor-arg>
          <bean factory-bean="proxyHttpClientBuilder" factory-method="build" />
        </constructor-arg>
      </bean>
    </constructor-arg>
  </bean>

I was expecting
HttpHost(final String hostname, final int port)
to be used in the above example.

But actuality
HttpHost(final String scheme, final String hostname)
was used.
https://github.com/apache/httpcomponents-core/blob/master/httpcore5/src/main/java/org/apache/hc/core5/http/HttpHost.java#L118-L135

The log of that case is shown below.

log.txt

org.springframework.web.client.ResourceAccessException: I/O error on GET request for "http://localhost:8080/spring-functionaltest-web/api/v1/rscl/1401002": localhost protocol is not supported
  	at org.springframework.web.client.RestTemplate.createResourceAccessException(RestTemplate.java:888)
  	at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:868)
  	at org.springframework.web.client.RestTemplate.execute(RestTemplate.java:804)
  	at org.springframework.web.client.RestTemplate.getForEntity(RestTemplate.java:421)
  	at jp.co.ntt.fw.spring.functionaltest.domain.service.rscl.ProxyRestClientServiceImpl.confirmProxy02(ProxyRestClientServiceImpl.java:67)
  	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
  	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
  	at java.base/java.lang.reflect.Method.invoke(Method.java:568)
  	at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:343)
  	at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:196)
  	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:163)
  	at org.terasoluna.gfw.common.exception.ResultMessagesLoggingInterceptor.invoke(ResultMessagesLoggingInterceptor.java:96)
  	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:173)
  	at org.springframework.aop.interceptor.ExposeInvocationInterceptor.invoke(ExposeInvocationInterceptor.java:97)
  	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:184)
  	at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:244)
  	at jdk.proxy3/jdk.proxy3.$Proxy271.confirmProxy02(Unknown Source)
  	at jp.co.ntt.fw.spring.functionaltest.app.rscl.RSCL14Controller.handle1401002(RSCL14Controller.java:69)
  	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
  	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
  	at java.base/java.lang.reflect.Method.invoke(Method.java:568)
  	at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:253)
  	at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:181)
  	at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:118)
  	at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:918)
  	at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:830)
  	at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87)
  	at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1086)
  	at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:979)
  	at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1011)
  	at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:914)
  	at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:590)
  	at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:885)
  	at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:658)
  	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:205)
  	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149)
  	at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:51)
  	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174)
  	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149)
  	at org.springframework.security.web.FilterChainProxy.lambda$doFilterInternal$3(FilterChainProxy.java:231)
  	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:365)
  	at org.springframework.security.web.access.intercept.AuthorizationFilter.doFilter(AuthorizationFilter.java:100)
  	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374)
  	at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:126)
  	at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:120)
  	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374)
  	at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:100)
  	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374)
  	at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:179)
  	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374)
  	at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63)
  	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374)
  	at org.springframework.security.web.authentication.ui.DefaultLogoutPageGeneratingFilter.doFilterInternal(DefaultLogoutPageGeneratingFilter.java:58)
  	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
  	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374)
  	at org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter.doFilter(DefaultLoginPageGeneratingFilter.java:188)
  	at org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter.doFilter(DefaultLoginPageGeneratingFilter.java:174)
  	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374)
  	at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:227)
  	at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:221)
  	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374)
  	at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:107)
  	at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:93)
  	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374)
  	at org.springframework.security.web.csrf.CsrfFilter.doFilterInternal(CsrfFilter.java:131)
  	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
  	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374)
  	at org.springframework.security.web.header.HeaderWriterFilter.doHeadersAfter(HeaderWriterFilter.java:90)
  	at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:75)
  	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
  	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374)
  	at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:62)
  	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
  	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374)
  	at org.springframework.security.web.context.SecurityContextHolderFilter.doFilter(SecurityContextHolderFilter.java:82)
  	at org.springframework.security.web.context.SecurityContextHolderFilter.doFilter(SecurityContextHolderFilter.java:69)
  	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374)
  	at org.springframework.security.web.session.DisableEncodeUrlFilter.doFilterInternal(DisableEncodeUrlFilter.java:42)
  	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
  	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374)
  	at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:233)
  	at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:191)
  	at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:352)
  	at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:268)
  	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174)
  	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149)
  	at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:91)
  	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
  	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174)
  	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149)
  	at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201)
  	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
  	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174)
  	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149)
  	at org.terasoluna.gfw.web.logging.mdc.AbstractMDCPutFilter.doFilterInternal(AbstractMDCPutFilter.java:116)
  	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
  	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174)
  	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149)
  	at org.terasoluna.gfw.web.exception.ExceptionLoggingFilter.doFilter(ExceptionLoggingFilter.java:99)
  	at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:352)
  	at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:268)
  	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174)
  	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149)
  	at org.terasoluna.gfw.web.logging.mdc.MDCClearFilter.doFilterInternal(MDCClearFilter.java:51)
  	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
  	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174)
  	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149)
  	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:166)
  	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:90)
  	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:482)
  	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:115)
  	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:93)
  	at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:676)
  	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
  	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:341)
  	at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:391)
  	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63)
  	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:894)
  	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1741)
  	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52)
  	at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191)
  	at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)
  	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
  	at java.base/java.lang.Thread.run(Thread.java:833)
  Caused by: org.apache.hc.client5.http.UnsupportedSchemeException: localhost protocol is not supported
  	at org.apache.hc.client5.http.impl.io.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:131)
  	at org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:447)
  	at org.apache.hc.client5.http.impl.classic.InternalExecRuntime.connectEndpoint(InternalExecRuntime.java:162)
  	at org.apache.hc.client5.http.impl.classic.InternalExecRuntime.connectEndpoint(InternalExecRuntime.java:172)
  	at org.apache.hc.client5.http.impl.classic.ConnectExec.execute(ConnectExec.java:146)
  	at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
  	at org.apache.hc.client5.http.impl.classic.ProtocolExec.execute(ProtocolExec.java:192)
  	at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
  	at org.apache.hc.client5.http.impl.classic.HttpRequestRetryExec.execute(HttpRequestRetryExec.java:96)
  	at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
  	at org.apache.hc.client5.http.impl.classic.ContentCompressionExec.execute(ContentCompressionExec.java:152)
  	at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
  	at org.apache.hc.client5.http.impl.classic.RedirectExec.execute(RedirectExec.java:115)
  	at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
  	at org.apache.hc.client5.http.impl.classic.InternalHttpClient.doExecute(InternalHttpClient.java:170)
  	at org.apache.hc.client5.http.impl.classic.CloseableHttpClient.execute(CloseableHttpClient.java:87)
  	at org.apache.hc.client5.http.impl.classic.CloseableHttpClient.execute(CloseableHttpClient.java:55)
  	at org.apache.hc.client5.http.classic.HttpClient.executeOpen(HttpClient.java:183)
  	at org.springframework.http.client.HttpComponentsClientHttpRequest.executeInternal(HttpComponentsClientHttpRequest.java:95)
  	at org.springframework.http.client.AbstractStreamingClientHttpRequest.executeInternal(AbstractStreamingClientHttpRequest.java:70)
  	at org.springframework.http.client.AbstractClientHttpRequest.execute(AbstractClientHttpRequest.java:66)
  	at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:862)
  	... 124 common frames omitted

On the other hand, when I wrote a bean definition with the type attribute
HttpHost(final String hostname, final int port)
is used.

  <bean id="proxyHttpClientBuilder" class="org.apache.hc.client5.http.impl.classic.HttpClientBuilder" factory-method="create">
    <property name="proxy">
      <bean class="org.apache.hc.core5.http.HttpHost">
        <constructor-arg type="java.lang.String" name="hostname" value="${rscl.http.proxyHost}" />
        <constructor-arg type="int" name="port" value="${rscl.http.proxyPort}" />
      </bean>
    </property>
  </bean>

  <bean id="proxyRestTemplate" class="org.springframework.web.client.RestTemplate">
    <constructor-arg>
      <bean class="org.springframework.http.client.HttpComponentsClientHttpRequestFactory">
        <constructor-arg>
          <bean factory-bean="proxyHttpClientBuilder" factory-method="build" />
        </constructor-arg>
      </bean>
    </constructor-arg>
  </bean>

I think that within the constructor-arg element, the name attribute has not worked version 6.1.0-M3 or later.
Is this a Spring Framework spec change or a bug?

[bclozel]

Could you share a minimal sample project that demonstrates the problem?

Can you replicate the issue with 6.1.0-M1 as well? This could be linked to #29559 and this note about parameter name retention in the upgrade guide. It doesn't look like httpcomponents is compiling their code with the -parameters option, so that could explain it.

[spring-projects-issues]

If you would like us to look at this issue, please provide the requested information. If the information is not provided within the next 7 days this issue will be closed.

[spring-projects-issues]

Closing due to lack of requested feedback. If you would like us to look at this issue, please provide the requested information and we will re-open the issue.

[takahashihrzg]

I apologize for the delayed response. I have created a sample (sample-constructor.zip) to demonstrate this problem. This sample uses Spring 6.1.4, but the same problem occurs with Spring 6.1.14.
sample-constructor.zip

In this sample, as you pointed out, when using HttpHost compiled from source code with the -parameters option, the correct constructor is used.

However, HttpHost is not a class from our application but is a class provided by a third-party library, Apache HttpComponents Core. Normally, such third-party libraries are obtained from repositories like Maven Central Repository, and users of Apache HttpComponents Core typically do not build them from source code.

I understand that building from the source code with the -parameters option resolves the problem, but currently, it appears that the Spring Framework assumes that not only user applications but also third-party libraries are always compiled with the -parameters option.

Since the default behavior of javac does not include -parameters, I believe this assumption should not be made. Is this situation intended by the Spring Framework?

if compiling with the -parameters option is indeed the intended assumption, does it mean that in Bean definitions using XMLConfig, to address this problem for third-party libraries built without the -parameters option, we need to specify the type attribute or arg-index attribute?