Protecting Java applications that use Spring Framework Core

DashO has support for protecting applications that use Spring Framework Core. Spring can be configured either by custom annotations or XML configuration files, and DashO has support for both. However, applications that use custom annotations require additional handling.

If you are using XML configuration files, the DashO Wizard will read them and automatically configure Renameable entry points for any Spring Bean classes it encounters. It will then rename the corresponding XML to match the new bean name assigned to the bean class. It will do the same for properties of the bean.

For example, here is a Spring bean called HelloWorld, which the DashO Wizard has automatically configured as a special Spring bean entry point:

During the build, DashO renames the class to “a” and its “message” property to “a”. It also updates the Spring XML definitions to match:

In the above scenario, no additional DashO configuration was required after the initial setup wizard.

When configuring via annotations, we can still apply obfuscation to the class files, but the Wizard will not automatically identify the Spring Beans. For example, if I run the DashO Wizard on the Spring annotated jar file without any other DashO configuration, I receive an error when running the obfuscated jar:

This is because DashO’s Removal feature removed the call to getHelloWorld because it was not called directly from the main method entry point. However, the getHelloWorld method has the @Bean Annotation, which returns the bean to be managed by Spring context.

To prevent this from happening, I added an exclude rule to the Removal exclusions for the getHelloWorld() method.

Finally, from the Removal tab, I need to confirm that “Visible Annotations” is not checked. This ensures that the @Configuration and @Bean Spring annotations do not get Removed.

There are obviously many ways to configure Spring, and I have presented just two simple examples. However, the main concept is the same for all the ways of doing it: DashO is able to automatically configure more features when you use Spring’s XML features, but even if you don’t, your projects can still be processed by configuring a few simple settings.

You can download the example projects here.

If you have any feedback on this topic, or other topics you would like us to discuss in the Support Corner, please feel free to contact us at support [at] preemptive [dot] com.