title: ESAPI - Getting NoClassDefFoundError (LoggerFactory) with banned dependency
body: <p>I am using <a href="/questions/tagged/espai" class="post-tag" title="show questions tagged &#39;espai&#39;" rel="tag">espai</a>ESAPI to encode string value to resolve cross site scripting issue as shown below (code snippet).</p>
  
  <pre><code>String encodedString = ESAPI.encoder().encodeForHTML(value);
  </code></pre>
  
  <p><strong>Exception Trace</strong> </p>
  
  <pre><code>org.owasp.esapi.errors.ConfigurationException: java.lang.reflect.InvocationTargetException Encoder class (org.owasp.esapi.reference.DefaultEncoder) CTOR threw exception.
      at org.owasp.esapi.util.ObjFactory.make(ObjFactory.java:129)
      at org.owasp.esapi.ESAPI.encoder(ESAPI.java:99)
  &lt;bold&gt;Caused by: java.lang.NoClassDefFoundError: org/apache/log4j/spi/LoggerFactory&lt;/bold&gt;
      at java.lang.Class.forName0(Native Method)
      at java.lang.Class.forName(Class.java:190)
      at org.owasp.esapi.util.ObjFactory.make(ObjFactory.java:74)
      at org.owasp.esapi.ESAPI.logFactory(ESAPI.java:137)
      at org.owasp.esapi.ESAPI.getLogger(ESAPI.java:154)
      at org.owasp.esapi.reference.DefaultEncoder.&lt;init&gt;(DefaultEncoder.java:75)
      at org.owasp.esapi.reference.DefaultEncoder.getInstance(DefaultEncoder.java:59)
      ... 71 more
  Caused by: java.lang.ClassNotFoundException: org.apache.log4j.spi.LoggerFactory
      at weblogic.utils.classloaders.GenericClassLoader.findLocalClass(GenericClassLoader.java:297)
      at weblogic.utils.classloaders.GenericClassLoader.findClass(GenericClassLoader.java:270)
      at weblogic.utils.classloaders.ChangeAwareClassLoader.findClass(ChangeAwareClassLoader.java:64)
      at java.lang.ClassLoader.loadClass(ClassLoader.java:425)
      at java.lang.ClassLoader.loadClass(ClassLoader.java:358)
  </code></pre>
  
  <p>Maven repository <strong>pom.xml</strong></p>
  
  <pre><code>&lt;dependency&gt;
      &lt;groupId&gt;org.owasp.esapi&lt;/groupId&gt;
      &lt;artifactId&gt;esapi&lt;/artifactId&gt;
      &lt;version&gt;${org.owasp.esapi.version}&lt;/version&gt;
      &lt;exclusions&gt;
          &lt;exclusion&gt;
              &lt;groupId&gt;commons-collections&lt;/groupId&gt;
              &lt;artifactId&gt;commons-collections&lt;/artifactId&gt;
          &lt;/exclusion&gt;
          &lt;exclusion&gt;
              &lt;groupId&gt;xercesImpl&lt;/groupId&gt;
              &lt;artifactId&gt;xercesImpl&lt;/artifactId&gt;
          &lt;/exclusion&gt;
          &lt;exclusion&gt;
              &lt;groupId&gt;commons-logging&lt;/groupId&gt;
              &lt;artifactId&gt;commons-logging&lt;/artifactId&gt;
          &lt;/exclusion&gt;
          &lt;exclusion&gt;
              &lt;groupId&gt;xml-apis&lt;/groupId&gt;
              &lt;artifactId&gt;xml-apis&lt;/artifactId&gt;
          &lt;/exclusion&gt;
          &lt;exclusion&gt;
              &lt;groupId&gt;commons-digester&lt;/groupId&gt;
              &lt;artifactId&gt;commons-digester&lt;/artifactId&gt;
          &lt;/exclusion&gt;
          &lt;exclusion&gt;
              &lt;groupId&gt;commons-codec&lt;/groupId&gt;
              &lt;artifactId&gt;commons-codec&lt;/artifactId&gt;
          &lt;/exclusion&gt;
          &lt;exclusion&gt;
              &lt;groupId&gt;org.owasp.antisamy&lt;/groupId&gt;
              &lt;artifactId&gt;antisamy&lt;/artifactId&gt;
          &lt;/exclusion&gt;
          &lt;exclusion&gt;
              &lt;groupId&gt;log4j&lt;/groupId&gt;
              &lt;artifactId&gt;log4j&lt;/artifactId&gt;
          &lt;/exclusion&gt;
      &lt;/exclusions&gt;
  &lt;/dependency&gt;
  </code></pre>
  
  <p>If I don't exclude <strong>log4j</strong> then it will throw dependency convergence error because <strong>log4j</strong> is declared in maven banned dependency as shown below</p>
  
  <pre><code>&lt;executions&gt;
      &lt;execution&gt;
          &lt;id&gt;enforce&lt;/id&gt;
          &lt;configuration&gt;
              &lt;rules&gt;
                  &lt;requireJavaVersion&gt;
                      &lt;version&gt;${java.version}&lt;/version&gt;
                  &lt;/requireJavaVersion&gt;
                  &lt;requireMavenVersion&gt;
                      &lt;version&gt;3.0&lt;/version&gt;
                  &lt;/requireMavenVersion&gt;
                  &lt;DependencyConvergence /&gt;
                  &lt;bannedDependencies&gt;
                      &lt;excludes&gt;
                          &lt;!-- This should not exist as it will force SLF4J calls to be 
                              delegated to log4j --&gt;
                          &lt;exclude&gt;org.slf4j:slf4j-log4j12&lt;/exclude&gt;
                          &lt;!-- This should not exist as it will force SLF4J calls to be 
                              delegated to jul --&gt;
                          &lt;exclude&gt;org.slf4j:slf4j-jdk14&lt;/exclude&gt;
                          &lt;!-- Ensure only the slf4j binding for logback is on the classpath --&gt;
                          &lt;exclude&gt;log4j:log4j&lt;/exclude&gt;
                          &lt;!-- As recommended from the slf4j guide, exclude commons-logging --&gt;
                          &lt;exclude&gt;commons-logging:commons-logging&lt;/exclude&gt;
                      &lt;/excludes&gt;                                     
                  &lt;/bannedDependencies&gt;
              &lt;/rules&gt;
          &lt;/configuration&gt;
          &lt;goals&gt;
              &lt;goal&gt;enforce&lt;/goal&gt;
          &lt;/goals&gt;
      &lt;/execution&gt;
  &lt;/executions&gt;
  </code></pre>
  
  <p>Help in this regard would be appreciated. Please let me know if you need any more details. Thanks in advance!</p>