Bug ID: 61854
           Summary: Function not found when using maps or sets in EL
           Product: Tomcat 9
           Version: 9.0.2
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: Jasper
  Target Milestone: -----

Created attachment 35582
JSP example for trhe bug

The EL specification 3.0 defines the use of maps and sets like this:

sets: {1, 2, 3}
maps: {"one":1, "two":2, "three":3}

See chapter 2.2 Construction of Collection Objects in the specification

So in EL 3.0 a expression like this is is valid:

${ map = {'1':'2', 'a':'b'}; fn:length(map['a']) }

It should return 1. In all tomcat versions this throws:

org.apache.jasper.JasperException: org.apache.jasper.JasperException:
javax.el.ELException: Function [fn:length] not found

The main reason seems to be that the ELParser that register the functions does
not take into account that a closing bracket is now possible before closing the
real EL expression. So it is closing the expression before and the function is
not registered (and it's not found later on). The following change makes it

--- java/org/apache/jasper/compiler/       (revision 1817073)
+++ java/org/apache/jasper/compiler/       (working copy)
@@ -106,11 +106,17 @@
         ELexpr = new ELNode.Nodes();
         curToken = null;
         prevToken = null;
+        int openBracket = 0;
         while (hasNext()) {
             curToken = nextToken();
             if (curToken instanceof Char) {
                 if (curToken.toChar() == '}') {
-                    break;
+                    openBracket--;
+                    if (openBracket < 0) {
+                        break;
+                    }
+                } else if (curToken.toChar() == '{') {
+                    openBracket++;
             } else {

The modification just counts the opening brackets and the EL expression is only
considered as complete when the brackets are all closed.

You are receiving this mail because:
You are the assignee for the bug.
To unsubscribe, e-mail:
For additional commands, e-mail:

Reply via email to