Spring Boot compatibility differs depending on type of usage

Expected Behavior

When using CM4SB 2.3.0 I would expect the version of Spring Boot that it can be used with to be the same whether CM4SB is a build-time dependency of the Boot project (i.e. a Gradle/Maven dependency) or else an external runtime dependency (used against an existing Spring Boot executable Jar with the PropertiesLauncher).

Current Behavior

When used as a build-time dependency, CM4SB appears to work well with Spring Boot 2.3.8 and 2.4.2 applications.

When the PropertiesLauncher approach is used (incorporating chaos-monkey-spring-boot-2.3.0-jar-with-dependencies.jar) with a simple Spring Boot 2.3.8 web application then everything starts up fine but when the first HTTP request is sent to it a java.lang.NoSuchMethodError is thrown…

Caused by: java.lang.NoSuchMethodError: 'boolean org.springframework.util.StringUtils.matchesCharacter(java.lang.String, char)'
	at org.springframework.web.util.UrlPathHelper.getContextPath(UrlPathHelper.java:398) ~[spring-web-5.2.12.RELEASE.jar!/:5.2.12.RELEASE]
	at org.springframework.web.util.UrlPathHelper.getPathWithinApplication(UrlPathHelper.java:297) ~[spring-web-5.2.12.RELEASE.jar!/:5.2.12.RELEASE]
	at org.springframework.web.util.UrlPathHelper.getLookupPathForRequest(UrlPathHelper.java:186) ~[spring-web-5.2.12.RELEASE.jar!/:5.2.12.RELEASE]
	at org.springframework.web.servlet.handler.AbstractHandlerMethodMapping.getHandlerInternal(AbstractHandlerMethodMapping.java:363) ~[spring-webmvc-5.2.12.RELEASE.jar!/:5.2.12.RELEASE]
	at org.springframework.web.servlet.mvc.method.RequestMappingInfoHandlerMapping.getHandlerInternal(RequestMappingInfoHandlerMapping.java:110) ~[spring-webmvc-5.2.12.RELEASE.jar!/:5.2.12.RELEASE]
	at org.springframework.web.servlet.mvc.method.RequestMappingInfoHandlerMapping.getHandlerInternal(RequestMappingInfoHandlerMapping.java:59) ~[spring-webmvc-5.2.12.RELEASE.jar!/:5.2.12.RELEASE]
	at org.springframework.web.servlet.handler.AbstractHandlerMapping.getHandler(AbstractHandlerMapping.java:396) ~[spring-webmvc-5.2.12.RELEASE.jar!/:5.2.12.RELEASE]
	at org.springframework.web.servlet.DispatcherServlet.getHandler(DispatcherServlet.java:1234) ~[spring-webmvc-5.2.12.RELEASE.jar!/:5.2.12.RELEASE]
	at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1016) ~[spring-webmvc-5.2.12.RELEASE.jar!/:5.2.12.RELEASE]
	... 38 common frames omitted

The “problem” method is org.springframework.util.StringUtils.matchesCharacter(java.lang.String, char) which was introduced to Spring in version 5.2.9.

The identical error occurs for the following versions of Spring Boot:

• 2.3.7 (which pulls in Spring 5.2.12)
• 2.3.6 (Spring 5.2.11)
• 2.3.5 (Spring 5.2.10)
• 2.3.4 (Spring 5.2.9)

Things only begin to work healthily when Spring Boot 2.3.3 is used. This is based off Spring 5.2.8 which does not include the org.springframework.util.StringUtils.matchesCharacter(java.lang.String, char) method.

Possible Solution

Peering at the contents of chaos-monkey-spring-boot-2.3.0-jar-with-dependencies.jar it contains its own copy of the org.springframework.util.StringUtils class dated Tuesday March 24 2020. My assumption is that this older version of the class is being loaded before the one contained by the Spring Boot application we want to inject chaos into. This results in the referenced method not being found at runtime when Spring Boot is above 2.3.3 (Spring Core 5.2.8).

Refreshing the “with-dependencies” Jar with more recent Spring core classes should probably help in this matter.

[georgeharley]

The good news is that the NoSuchMethodError which gave rise to this issue no longer occurs when using chaos-monkey-spring-boot-2.3.9-jar-with-dependencies.jar. The bad news is that using the Jar there’s no sign of any CM4SB activity at all - no sign of the “ready to do evil” message in the Spring Boot web application’s startup log and no sign of any attacks when requests are sent. This is the case for Spring Boot 2.3.1 -> 2.3.9.

Interestingly, when using chaos-monkey-spring-boot-2.3.2-jar-with-dependencies.jar everything works as hoped (start up log entry and expected attack behaviour). Looks like the problem that this issue was opened to track was fixed in the CM4SB 2.3.2 release but there has been some kind of regression in CM4SB 2.3.9?

Will try a few more things out tomorrow and open a new issue if things are still refusing to work.

[WtfJoke]

Hi @georgeharley

Thanks for reaching out to us about that, hank you for checking the compatibility with various versions and the analysis.

I think the “easiest” solution would be to make a CMSB release based on spring boot 2.3.7 so we have the correct class bundled.