Confluence Startup Failure Caused by Deprecated 'ServerInfoFilter' class in web.xml
Platform notice: Server and Data Center only. This article only applies to Atlassian products on the Server and Data Center platforms.
Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Except Fisheye and Crucible
Summary
In Confluence version 7.19.15, the ServerInfoFilter class has been deprecated and removed.
If you use a web.xml from a previous Confluence version when upgrading to Confluence versions 7.19.15, 7.19.16, or the latest version, they may encounter the following ClassNotFoundException error.
ERROR [Catalina-utility-1] [ContainerBase.[Standalone].[localhost].[/c71916]] log Exception starting filter [ServerInfoFilter]
java.lang.ClassNotFoundException: com.atlassian.confluence.util.ServerInfoFilter
at org.apache.catalina.loader.WebappClassLoaderBase.loadClass(WebappClassLoaderBase.java:1329)
at org.apache.catalina.loader.WebappClassLoaderBase.loadClass(WebappClassLoaderBase.java:1141)
at org.apache.catalina.core.DefaultInstanceManager.loadClass(DefaultInstanceManager.java:488)
at org.apache.catalina.core.DefaultInstanceManager.loadClassMaybePrivileged(DefaultInstanceManager.java:470)
...
...Environment
7.19.15
7.19.16
Diagnosis
The Confluence UI displays an HTTP 404 Not Found error, and you can find the following ClassNotFoundException in the Confluence logs:
ERROR [Catalina-utility-1] [ContainerBase.[Standalone].[localhost].[/c71916]] log Exception starting filter [ServerInfoFilter]
java.lang.ClassNotFoundException: com.atlassian.confluence.util.ServerInfoFilter
at org.apache.catalina.loader.WebappClassLoaderBase.loadClass(WebappClassLoaderBase.java:1329)
at org.apache.catalina.loader.WebappClassLoaderBase.loadClass(WebappClassLoaderBase.java:1141)
at org.apache.catalina.core.DefaultInstanceManager.loadClass(DefaultInstanceManager.java:488)
at org.apache.catalina.core.DefaultInstanceManager.loadClassMaybePrivileged(DefaultInstanceManager.java:470)
at org.apache.catalina.core.DefaultInstanceManager.newInstance(DefaultInstanceManager.java:142)
at org.apache.catalina.core.ApplicationFilterConfig.getFilter(ApplicationFilterConfig.java:242)
at org.apache.catalina.core.ApplicationFilterConfig.<init>(ApplicationFilterConfig.java:97)
at org.apache.catalina.core.StandardContext.filterStart(StandardContext.java:4311)
at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:4940)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:171)
at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1332)
at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1322)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
at java.base/java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:304)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.base/java.lang.Thread.run(Thread.java:834)Reviewing the web.xml file, the following filter and filter-mapping tags are present in the file:
<filter>
<filter-name>ServerInfoFilter</filter-name>
<filter-class&gt;com.atlassian.confluence.util.ServerInfoFilter</filter-class&gt;
</filter>
<filter-mapping>
<filter-name>ServerInfoFilter</filter-name>
<url-pattern>/server-info.action</url-pattern>
</filter-mapping>The reason for the issue is that the upgraded instance is attempting to start Confluence with the CONFLUENCE_INSTALL_HOME/Confluence/WEB-INF/web.xml which still references the now-deprecated com.atlassian.confluence.util.ServerInfoFilter
Cause
The class com.atlassian.confluence.util.ServerInfoFilter was removed in version 7.19.15. The Java Docs page for v7.19.14 which contains information about this filter, works as expected. However, the Java Docs page for v7.19.15 results in a 404 error.
The deprecation of this filter was prompted by security concerns identified during the CVE (CVE-2023-22515).
Solution
The web.xml the file is from the CONFLUENCE_INSTALL_HOME/Confluence/WEB-INF/web.xml
Workaround
Replace CONFLUENCE_INSTALL_HOME/Confluence/WEB-INF/web.xml (that may contain deleted/deprecated filters) with the web.xml that is bundled with the Confluence binaries downloaded from Atlassian's Confluence Server & Data Center download archives.
Note: Please keep in mind if you have any other custom modifications to the web.xml they would need to be ported over.