WARNING: An illegal reflective access operation has occurred about tsunami-security-scanner HOT 4 CLOSED

Hi all, using java -jar will not work as Tsunami loads all plugins from runtime classpath to allow dynamic plugin loading. We are adding new features to allow users to run with java -jar and specify plugin directories via config file, but it will take a while to ship.

For now, if you use the quick_start.sh script, at the end of the output it will printout a command you can copy-paste for scanning. Please use that command instead.

from tsunami-security-scanner.

Getting the same exception on Artix Rolling, with OpenJDK 14.0.1.

from tsunami-security-scanner.

same here,
I installed using the easy quick start script and I get the following error

root@tako:~/tsunami# java -jar tsunami-main-0.0.2-SNAPSHOT-cli.jar --ip-v4-target 10.10.0.10
Jul 09, 2020 1:36:02 PM com.google.tsunami.main.cli.TsunamiCli main
INFO: Full classpath scan took 3.039 s
Jul 09, 2020 1:36:02 PM com.google.tsunami.common.cli.CliOptionsModule configure
INFO: Found CliOption: com.google.tsunami.common.io.archiving.GoogleCloudStorageArchiver$Options
Jul 09, 2020 1:36:02 PM com.google.tsunami.common.cli.CliOptionsModule configure
INFO: Found CliOption: com.google.tsunami.main.cli.ScanResultsArchiver$Options
Jul 09, 2020 1:36:02 PM com.google.tsunami.common.cli.CliOptionsModule configure
INFO: Found CliOption: com.google.tsunami.main.cli.option.ScanTargetCliOptions
WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by com.google.inject.internal.cglib.core.$ReflectUtils$1 (file:/root/tsunami/tsunami-main-0.0.2-SNAPSHOT-cli.jar) to method java.lang.ClassLoader.defineClass(java.lang.String,byte[],int,int,java.security.ProtectionDomain)
WARNING: Please consider reporting this to the maintainers of com.google.inject.internal.cglib.core.$ReflectUtils$1
WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
WARNING: All illegal access operations will be denied in a future release
Jul 09, 2020 1:36:03 PM com.google.tsunami.main.cli.TsunamiCli main
SEVERE: Exiting due to workflow execution exceptions.
com.google.inject.ConfigurationException: Guice configuration errors:

1. No implementation for java.util.Map<com.google.tsunami.plugin.PluginDefinition, javax.inject.Provider<com.google.tsunami.plugin.TsunamiPlugin>> was bound.
   while locating java.util.Map<com.google.tsunami.plugin.PluginDefinition, javax.inject.Provider<com.google.tsunami.plugin.TsunamiPlugin>>
   for the 1st parameter of com.google.tsunami.plugin.PluginManager.(PluginManager.java:41)
   while locating com.google.tsunami.plugin.PluginManager
   for the 1st parameter of com.google.tsunami.workflow.DefaultScanningWorkflow.(DefaultScanningWorkflow.java:100)
   while locating com.google.tsunami.workflow.DefaultScanningWorkflow
   for the 1st parameter of com.google.tsunami.main.cli.TsunamiCli.(TsunamiCli.java:63)
   while locating com.google.tsunami.main.cli.TsunamiCli

1 error
at com.google.inject.internal.InjectorImpl.getProvider(InjectorImpl.java:1120)
at com.google.inject.internal.InjectorImpl.getProvider(InjectorImpl.java:1078)
at com.google.inject.internal.InjectorImpl.getInstance(InjectorImpl.java:1131)
at com.google.tsunami.main.cli.TsunamiCli.main(TsunamiCli.java:139)

Running:
openjdk version "11.0.7-ea" 2020-04-14
OpenJDK Runtime Environment (build 11.0.7-ea+9-post-Debian-1)
OpenJDK 64-Bit Server VM (build 11.0.7-ea+9-post-Debian-1, mixed mode, sharing)

from tsunami-security-scanner.

I will close this issue for now. Please let us know if you still get the same error.

from tsunami-security-scanner.