Unable to detect mode.

[bhaghyaxmedia]

Unable to detect mode. when i try to deploy the app in apache tomcat

12:57:29.436 [http-nio-8080-exec-53] INFO n.d.o.c.security.CertificateModule - Certificate subject: C=SG, O=My Organization Name, OU=PEPPOL TEST AP, CN=PSG000***
12:57:29.436 [http-nio-8080-exec-53] INFO n.d.o.c.security.CertificateModule - Certificate issuer: CN=PEPPOL ACCESS POINT TEST CA - G2, OU=FOR TEST ONLY, O=OpenPEPPOL AISBL, C=BE
12:57:29.888 [http-nio-8080-exec-53] ERROR n.d.o.c.guice.GuiceModuleLoader - Unable to detect mode.
no.difi.oxalis.api.lang.OxalisLoadingException: Unable to detect mode.
at no.difi.oxalis.commons.mode.ModeProvider.get(ModeProvider.java:74)
at no.difi.oxalis.commons.mode.ModeProvider.get(ModeProvider.java:46)
at com.google.inject.internal.ProviderInternalFactory.provision(ProviderInternalFactory.java:85)
at com.google.inject.internal.BoundProviderFactory.provision(BoundProviderFactory.java:77)
at com.google.inject.internal.ProviderInternalFactory.circularGet(ProviderInternalFactory.java:59)
at com.google.inject.internal.BoundProviderFactory.get(BoundProviderFactory.java:61)
at com.google.inject.internal.ProviderToInternalFactoryAdapter.get(ProviderToInternalFactoryAdapter.java:40)
at com.google.inject.internal.SingletonScope$1.get(SingletonScope.java:168)
at com.google.inject.internal.InternalFactoryToProviderAdapter.get(InternalFactoryToProviderAdapter.java:39)
at com.google.inject.internal.InternalInjectorCreator.loadEagerSingletons(InternalInjectorCreator.java:211)
at com.google.inject.internal.InternalInjectorCreator.injectDynamically(InternalInjectorCreator.java:182)
at com.google.inject.internal.InternalInjectorCreator.build(InternalInjectorCreator.java:109)
at com.google.inject.Guice.createInjector(Guice.java:87)
at com.google.inject.Guice.createInjector(Guice.java:69)
at no.difi.oxalis.commons.guice.GuiceModuleLoader.initiate(GuiceModuleLoader.java:66)
at no.difi.oxalis.inbound.OxalisGuiceContextListener.(OxalisGuiceContextListener.java:45)
at no.difi.oxalis.dist.war.WarServletContextListener.(WarServletContextListener.java:11)
at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:490)
at org.apache.catalina.core.DefaultInstanceManager.newInstance(DefaultInstanceManager.java:151)
at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:4640)
at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5177)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)
at org.apache.catalina.manager.ManagerServlet.start(ManagerServlet.java:1421)
at org.apache.catalina.manager.HTMLManagerServlet.start(HTMLManagerServlet.java:704)
at org.apache.catalina.manager.HTMLManagerServlet.doPost(HTMLManagerServlet.java:223)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:652)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:733)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.apache.catalina.filters.CsrfPreventionFilter.doFilter(CsrfPreventionFilter.java:211)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:667)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:143)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:690)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:374)
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868)
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1590)
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)

root@ubuntu-s-1vcpu-1gb-blr1-01:/# javac -version
javac 1.8.0_272
root@ubuntu-s-1vcpu-1gb-blr1-01:/# mvn -version
Apache Maven 3.6.0
Maven home: /usr/share/maven
Java version: 1.8.0_272, vendor: Private Build, runtime: /usr/lib/jvm/java-8-openjdk-amd64/jre
Default locale: en, platform encoding: UTF-8
OS name: "linux", version: "4.15.0-122-generic", arch: "amd64", family: "unix"
root@ubuntu-s-1vcpu-1gb-blr1-01:/#

My oxalis.conf
oxalis.keystore {
# Relative to OXALIS_HOME
path= TestApCertificate.p12
password = mychoosespassword
key.alias = myalias
key.password = mychoosespassword
}
oxalis.path.plugin = home/oxalis/oxalis

Signals to Oxalis that we should look for plugin

oxalis.persister.receipt = plugin

Where to store inbound files

oxalis.path.inbound = /var/peppol/IN

[post-svejk]

I got this error too, when I was experimenting with upgrading versions of Oxalis's transitive dependencies (due to vulnerabilities in old libraries). The workaround was to stick to Oxalis's versions.

[aaron-kumar]

@post-svejk : can you provide list of libraries with vulnerabilities? We would like to upgrade them.

[post-svejk]

Sure: You can start with running maven-enforcer-plugin with Sonatype's BanVulnerable:

[WARNING] Rule 1: org.sonatype.ossindex.maven.enforcer.BanVulnerableDependencies failed with message:
Detected 3 vulnerable components:
  com.google.guava:guava:jar:29.0-jre:compile; https://ossindex.sonatype.org/component/pkg:maven/com.google.guava/[email protected]?utm_source=ossindex-client&utm_medium=integration&utm_content=1.1.1
    * [CVE-2020-8908] A temp directory creation vulnerability exists in all versions of Guava, allowin... (3.3); https://ossindex.sonatype.org/vulnerability/8e973be2-4220-410d-a4cb-2de7a755bdbe?component-type=maven&component-name=com.google.guava.guava&utm_source=ossindex-client&utm_medium=integration&utm_content=1.1.1
  org.hibernate.validator:hibernate-validator:jar:6.2.0.Final:compile; https://ossindex.sonatype.org/component/pkg:maven/org.hibernate.validator/[email protected]?utm_source=ossindex-client&utm_medium=integration&utm_content=1.1.1
    * [CVE-2020-10693] A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the messag... (5.3); https://ossindex.sonatype.org/vulnerability/6360908f-637a-4214-a2e9-fd57263d84c9?component-type=maven&component-name=org.hibernate.validator.hibernate-validator&utm_source=ossindex-client&utm_medium=integration&utm_content=1.1.1
  org.apache.cxf:cxf-core:jar:3.3.6:compile; https://ossindex.sonatype.org/component/pkg:maven/org.apache.cxf/[email protected]?utm_source=ossindex-client&utm_medium=integration&utm_content=1.1.1
    * [CVE-2021-22696] CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT tok... (7.5); https://ossindex.sonatype.org/vulnerability/58181fef-c312-4ff6-ad7e-57d34563e086?component-type=maven&component-name=org.apache.cxf.cxf-core&utm_source=ossindex-client&utm_medium=integration&utm_content=1.1.1
    * [CVE-2021-30468] A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacke... (7.5); https://ossindex.sonatype.org/vulnerability/ac300245-a8d6-4627-a952-1b8a759020f9?component-type=maven&component-name=org.apache.cxf.cxf-core&utm_source=ossindex-client&utm_medium=integration&utm_content=1.1.1
    * [CVE-2020-13954] By default, Apache CXF creates a /services page containing a listing of the avai... (6.1); https://ossindex.sonatype.org/vulnerability/4f0443dd-abe9-4e0f-a760-a56b0d86da1c?component-type=maven&component-name=org.apache.cxf.cxf-core&utm_source=ossindex-client&utm_medium=integration&utm_content=1.1.1

[WARNING] Rule 6: org.apache.maven.plugins.enforcer.BannedDependencies failed with message:
Found Banned Dependency: javax.xml.stream:stax-api:jar:1.0-2
Use 'mvn dependency:tree' to locate the source of the banned dependencies.

But there is way more. azure/container-scan (in our Github Actions pipeline) on the Docker image of a server process launching oxalis-inbound (almost identical to the official image on DockerHub) gave more than 20 errors, most of them related to Java libraries. We haven't enabled Dependabot yet on this repo, so that will probably also find some.

Problems discovered by azure/container-scan:

• CVE-2018-14718
  • CVE-2018-14719
  • CVE-2018-14720
  • CVE-2018-14721
  • CVE-2018-19360
  • CVE-2018-19361
  • CVE-2018-19362
  • CVE-2019-14379
  • CVE-2019-14540
  • CVE-2019-14892
  • CVE-2019-14893
  • CVE-2019-16335
  • CVE-2019-16942
  • CVE-2019-16943
  • CVE-2019-17267
  • CVE-2019-17531
  • CVE-2019-20330
  • CVE-2020-8840
  • CVE-2020-9546
  • CVE-2020-9547
  • CVE-2020-9548
  • CVE-2019-12086
  • CVE-2019-14439
  • CVE-2020-10672
  • CVE-2020-10673
  • CVE-2020-10968
  • CVE-2020-10969
  • CVE-2020-11111
  • CVE-2020-11112
  • CVE-2020-11113
  • CVE-2020-11619
  • CVE-2020-11620
  • CVE-2020-14060
  • CVE-2020-14061
  • CVE-2020-14062
  • CVE-2020-14195
  • CVE-2020-24616
  • CVE-2020-24750
  • CVE-2020-25649
  • CVE-2020-35490
  • CVE-2020-35491
  • CVE-2020-35728
  • CVE-2020-36179
  • CVE-2020-36180
  • CVE-2020-36181
  • CVE-2020-36182
  • CVE-2020-36183
  • CVE-2020-36184
  • CVE-2020-36185
  • CVE-2020-36186
  • CVE-2020-36187
  • CVE-2020-36188
  • CVE-2020-36189
  • CVE-2021-20190
  • CVE-2018-1000873
  • CVE-2019-12384
  • CVE-2019-12814
  • CVE-2020-27216
  • CVE-2021-28165
  • CVE-2019-10241
  • CVE-2019-10247
  • CVE-2020-27223
  • CVE-2021-28165
  • CVE-2018-12545
  • CVE-2020-27216
  • CVE-2021-28165
  • CVE-2019-10241
  • CVE-2019-10246
  • CVE-2019-10247
  • CVE-2020-27218
  • CVE-2020-27223
  • CVE-2020-27216
  • CVE-2021-28165
  • CVE-2020-27223
  • CVE-2020-8908
  • CVE-2019-10247
  • CVE-2021-34428

[aaron-kumar]

Thanks, we will start fixing them in upcoming version.
We also have some list available from static code scanner and there are some vulnerability already reported by GitHub dependabot. Whatever you shared is matching that...

[aaron-kumar]

We already started working on security vulnerability fix as reported by GitHub dependabot, GitHub CodeQL code scanning and other SAST reported vulnerabilities. Some of vulnerability fix require Java upgrade. This will run as separate project soon. This is in response of @post-svejk your comment.
Regarding @bhaghyaxmedia issue, can you let us know whether you are still facing this issue? For now, we are converting this topic to discussion. But if you can provide additional information to reproduce this problem then we can change this discussion back to issue (based on findings)