SonarQube 9 - class not found: WstxInputFactory

[tyutyutyu]

Since SonarQube 9 the sonar-plugin-api doesn't depend on the woodstox-core-lgpl library so the mvn sonar:sonar command is failing.

Maven error message

Caused by: org.apache.maven.plugin.PluginContainerException: A required class was missing while executing org.sonarsource.scanner.maven:sonar-maven-plugin:3.9.0.2155:sonar: com/ctc/wstx/stax/WstxInputFactory
-----------------------------------------------------
realm =    plugin>org.sonarsource.scanner.maven:sonar-maven-plugin:3.9.0.2155
strategy = org.codehaus.plexus.classworlds.strategy.SelfFirstStrategy
urls[0] = file:/C:/Users/FoldhaziI/.m2/repository/org/sonarsource/scanner/maven/sonar-maven-plugin/3.9.0.2155/sonar-maven-plugin-3.9.0.2155.jar
urls[1] = file:/C:/Users/FoldhaziI/.m2/repository/org/sonatype/plexus/plexus-sec-dispatcher/1.4/plexus-sec-dispatcher-1.4.jar
urls[2] = file:/C:/Users/FoldhaziI/.m2/repository/org/sonatype/plexus/plexus-cipher/1.4/plexus-cipher-1.4.jar
urls[3] = file:/C:/Users/FoldhaziI/.m2/repository/org/codehaus/plexus/plexus-utils/3.2.1/plexus-utils-3.2.1.jar
urls[4] = file:/C:/Users/FoldhaziI/.m2/repository/org/sonarsource/scanner/api/sonar-scanner-api/2.16.1.361/sonar-scanner-api-2.16.1.361.jar
urls[5] = file:/C:/Users/FoldhaziI/.m2/repository/commons-lang/commons-lang/2.6/commons-lang-2.6.jar
Number of foreign imports: 1
import: Entry[import  from realm ClassRealm[maven.api, parent: null]]

-----------------------------------------------------

Stack trace

Caused by: java.lang.ClassNotFoundException: com.ctc.wstx.stax.WstxInputFactory
    at org.sonar.classloader.ParentFirstStrategy.loadClass (ParentFirstStrategy.java:39)
    at org.sonar.classloader.ClassRealm.loadClass (ClassRealm.java:87)
    at org.sonar.classloader.ClassRealm.loadClass (ClassRealm.java:76)
    at org.sonar.plugins.clover.StaxParser.<init> (StaxParser.java:44)
    at org.sonar.plugins.clover.CloverXmlReportParser.createStaxParser (CloverXmlReportParser.java:83)
    at org.sonar.plugins.clover.CloverXmlReportParser.collect (CloverXmlReportParser.java:66)
    at org.sonar.plugins.clover.CloverSensor.execute (CloverSensor.java:73)
    at org.sonar.scanner.sensor.AbstractSensorWrapper.analyse (AbstractSensorWrapper.java:48)
    at org.sonar.scanner.sensor.ModuleSensorsExecutor.execute (ModuleSensorsExecutor.java:85)
    at org.sonar.scanner.sensor.ModuleSensorsExecutor.lambda$execute$1 (ModuleSensorsExecutor.java:59)
    at org.sonar.scanner.sensor.ModuleSensorsExecutor.withModuleStrategy (ModuleSensorsExecutor.java:77)
    at org.sonar.scanner.sensor.ModuleSensorsExecutor.execute (ModuleSensorsExecutor.java:59)
    at org.sonar.scanner.scan.ModuleScanContainer.doAfterStart (ModuleScanContainer.java:79)
    at org.sonar.core.platform.ComponentContainer.startComponents (ComponentContainer.java:137)
    at org.sonar.core.platform.ComponentContainer.execute (ComponentContainer.java:123)
    at org.sonar.scanner.scan.ProjectScanContainer.scan (ProjectScanContainer.java:382)
    at org.sonar.scanner.scan.ProjectScanContainer.scanRecursively (ProjectScanContainer.java:378)
    at org.sonar.scanner.scan.ProjectScanContainer.scanRecursively (ProjectScanContainer.java:375)
    at org.sonar.scanner.scan.ProjectScanContainer.doAfterStart (ProjectScanContainer.java:347)
    at org.sonar.core.platform.ComponentContainer.startComponents (ComponentContainer.java:137)
    at org.sonar.core.platform.ComponentContainer.execute (ComponentContainer.java:123)
    at org.sonar.scanner.bootstrap.GlobalContainer.doAfterStart (GlobalContainer.java:136)
    at org.sonar.core.platform.ComponentContainer.startComponents (ComponentContainer.java:137)
    at org.sonar.core.platform.ComponentContainer.execute (ComponentContainer.java:123)
    at org.sonar.batch.bootstrapper.Batch.doExecute (Batch.java:72)
    at org.sonar.batch.bootstrapper.Batch.execute (Batch.java:66)
    at org.sonarsource.scanner.api.internal.batch.BatchIsolatedLauncher.execute (BatchIsolatedLauncher.java:46)
    at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
    at jdk.internal.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
    at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke (Method.java:566)
    at org.sonarsource.scanner.api.internal.IsolatedLauncherProxy.invoke (IsolatedLauncherProxy.java:60)
    at com.sun.proxy.$Proxy25.execute (Unknown Source)
    at org.sonarsource.scanner.api.EmbeddedScanner.doExecute (EmbeddedScanner.java:189)
    at org.sonarsource.scanner.api.EmbeddedScanner.execute (EmbeddedScanner.java:138)
    at org.sonarsource.scanner.maven.bootstrap.ScannerBootstrapper.execute (ScannerBootstrapper.java:65)
    at org.sonarsource.scanner.maven.SonarQubeMojo.execute (SonarQubeMojo.java:108)
    at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:137)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:210)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:156)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:148)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:117)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:81)
    at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:56)
    at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:128)
    at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:305)
    at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:192)
    at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:105)
    at org.apache.maven.cli.MavenCli.execute (MavenCli.java:957)
    at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:289)
    at org.apache.maven.cli.MavenCli.main (MavenCli.java:193)
    at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
    at jdk.internal.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
    at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke (Method.java:566)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:282)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:225)
    at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:406)
    at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:347)

Environment

• OS: Windows 10
• Java: openjdk 11.0.11 2021-04-20
• Maven: Apache Maven 3.6.3
• SonarQube: Version 9.0 (build 45539)
• SonarQube Clover Plugin: 4.1

Workaround

Adding the missing dependency to the sonar-maven-plugin in the analyzed project's pom.xml solves the problem:

...
                        <plugin>
                            <groupId>org.sonarsource.scanner.maven</groupId>
                            <artifactId>sonar-maven-plugin</artifactId>
                            <version>3.9.0.2155</version>
                            <dependencies>
                                <dependency>
                                    <groupId>org.codehaus.woodstox</groupId>
                                    <artifactId>woodstox-core-lgpl</artifactId>
                                    <version>4.4.1</version>
                                </dependency>
                            </dependencies>
                        </plugin>
...

[Tony-Proum]

@tyutyutyu Thank you for submitting an issue, I did not see it: sorry for the delay.
I will try this and release a fix in the upcoming days if possible.

[akath19]

@Tony-Proum do you have any updates for this?, I'm using the plugin but with sonar-scanner cli and adding the plugin to the pom file doesn't work

[Tony-Proum]

Hi,
I have done some modifications here, but I have to test those updates with all supported versions of SonarQube. So it remains some steps to be able to release the new version. I'll do my best to release it as soon as possible

[jalabarzo]

Any ideas on the next release date with this fix?

[eshwarkarthikn]

We have tried the workaround but still facing the issue. Any update on this?

Thanks!

[josesa-xx]

The workaround needs to be applied in the root pom under "build/pluginManagement/plugins" section, otherwise sonar analysis will use the default settings and ignore any custom plugin definitions if defined in sub-module.