Graal Engine Issue with Multi Threaded Access

Describe the bug The Graal.js engine does not appear to work on windows.

To Reproduce Run the following grail http sender script.

// The sendingRequest and responseReceived functions will be called for all requests/responses sent/received by ZAP, 
// including automated tools (e.g. active scanner, fuzzer, ...)

// Note that new HttpSender scripts will initially be disabled
// Right click the script in the Scripts tree and select "enable"  

// 'initiator' is the component the initiated the request:
// 		1	PROXY_INITIATOR
// 		2	ACTIVE_SCANNER_INITIATOR
// 		3	SPIDER_INITIATOR
// 		4	FUZZER_INITIATOR
// 		5	AUTHENTICATION_INITIATOR
// 		6	MANUAL_REQUEST_INITIATOR
// 		7	CHECK_FOR_UPDATES_INITIATOR
// 		8	BEAN_SHELL_INITIATOR
// 		9	ACCESS_CONTROL_SCANNER_INITIATOR
// 		10	AJAX_SPIDER_INITIATOR
// For the latest list of values see the HttpSender class:
// https://github.com/zaproxy/zaproxy/blob/main/zap/src/main/java/org/parosproxy/paros/network/HttpSender.java
// 'helper' just has one method at the moment: helper.getHttpSender() which returns the HttpSender 
// instance used to send the request.
//
// New requests can be made like this:
// msg2 = msg.cloneAll() // msg2 can then be safely changed as required without affecting msg
// helper.getHttpSender().sendAndReceive(msg2, false);
// print('msg2 response=' + msg2.getResponseHeader().getStatusCode())



function sendingRequest(msg, initiator, helper) {


	//msg.getRequestHeader().setHeader("X-ZAP-Initiator", initiator);
	//msg.getRequestHeader().setHeader("Authentication", "Bearer: " + AuthToken);
	// Debugging can be done using println like this
	print('sendingRequest called for url=' + msg.getRequestHeader().getURI().toString())
}

function responseReceived(msg, initiator, helper) {
	// Debugging can be done using println like this
	print('responseReceived called for url=' + msg.getRequestHeader().getURI().toString())
}

Manually proxy a chrome browser and navigate to http://www.google.com

The script crashes and is disabled. The following is the output from the script console.

sendingRequest called for url=https://www.google.com/gen_204?atyp=i&r=1&ei=UdvEYd-VNYuoptQP49WmmAU&ct=slh&v=t1&im=M&pv=0.13916408800352364&me=18:1640291131480,V,0,0,0,0:5902,h,1,1,i:116,h,1,1,o:4088,h,1,1,i:387,h,1,1,o:1829,e,U&zx=1640291143803
responseReceived called for url=https://www.google.com/gen_204?atyp=i&r=1&ei=UdvEYd-VNYuoptQP49WmmAU&ct=slh&v=t1&im=M&pv=0.13916408800352364&me=18:1640291131480,V,0,0,0,0:5902,h,1,1,i:116,h,1,1,o:4088,h,1,1,i:387,h,1,1,o:1829,e,U&zx=1640291143803
sendingRequest called for url=https://www.google.com/
responseReceived called for url=https://www.google.com/
java.lang.IllegalStateException: Multi threaded access requested by thread Thread[ZAP-ProxyThread-913,4,main] but is not allowed for language(s) js.sjava.lang.IllegalStateException: Multi threaded access requested by thread Thread[ZAP-ProxyThread-913,4,main] but is not allowed for language(s) js.e
ndingRequest called for url=https://www.google.com/gen_204?s=webhp&t=aft&atyp=csi&ei=xtvEYcTfIJGbptQPp6m42A0&rt=wsrt.272,aft.30,afti.30&imn=2&ima=2&imad=0&aftp=-1&bl=4JUY
responseReceived called for url=https://www.google.com/gen_204?s=webhp&t=aft&atyp=csi&ei=xtvEYcTfIJGbptQPp6m42A0&rt=wsrt.272,aft.30,afti.30&imn=2&ima=2&imad=0&aftp=-1&bl=4JUY

Expected behavior The above script should run. In general it is my understanding that graal should run be pretty much backward compatible with nashhorn.

Software versions

• ZAP: 2.11.1 Cross Platform
• Add-on: Name and version GraalVM Javascript 0.2.0
• OS: Windows 10 20H2
• Java: [e.g. openjdk version “1.8.0_171”] openjdk version “1.8.0_302” OpenJDK Runtime Environment (Temurin)(build 1.8.0_302-b08) OpenJDK 64-Bit Server VM (Temurin)(build 25.302-b08, mixed mode)
• Browser:Google Chrome | 96.0.4664.110 (Official Build) (64-bit) (cohort: Stable)

Errors from the zap.log file

zap.log

Additional context Add any other context about the problem here.

Would you like to help fix this issue? I would be happy to help fix the issue if I have the expertise to do so.

[sonawanesarvesh]

https://www.graalvm.org/22.0/reference-manual/js/NashornMigrationGuide/#:~:text=The Nashorn engine has been deprecated in JDK,the features for JavaScript previously provided by Nashorn.

Just bumped on this

[trevor-vaughan]

Ah, my system rolled to 17 and it does not appear to be available. I’ll install 11 and pin to that.

It would be nice for the zap.sh script to tell you if things might be broken when you run the app and/or for the script loader to tell you you’re using an incompatible version.