This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch 11.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit a85dc3d65182bc2e206abdda8dbb8df268c6bbf3 Author: opencode <[email protected]> AuthorDate: Sun Oct 18 22:27:17 2026 +0200 Avoid NullPointerException in include error path for non-JAR pages When ParserController.doParse() failed to resolve the name of a file included using an include directive, the error handling assumed that the page was being read from a JAR. For a page read from the file system the "jar" argument is null, so evaluating the error message threw a NullPointerException. That exception was then caught by Parser.processIncludeDirective() which re-dispatched its message, so compiling a page such as one containing <%@ include file="a b.jsp" %> reported the details of the NullPointerException, or nothing at all on older JDKs, instead of a translation error describing the problem with the include. Report the invalid include via a dedicated message that does not depend on the page being read from a JAR. This also removes an incorrect report of an include escaping /META-INF/tags for any include with an invalid URI that did happen to be read from a JAR. Found by code review. --- .../apache/jasper/compiler/ParserController.java | 3 +- .../jasper/resources/LocalStrings.properties | 1 + .../jasper/compiler/TestParserController.java | 43 ++++++++++++++++++++++ test/webapp/jsp/parsing/include-invalid-uri.jsp | 24 ++++++++++++ 4 files changed, 70 insertions(+), 1 deletion(-) diff --git a/java/org/apache/jasper/compiler/ParserController.java b/java/org/apache/jasper/compiler/ParserController.java index 1629af24f4..7dbe122479 100644 --- a/java/org/apache/jasper/compiler/ParserController.java +++ b/java/org/apache/jasper/compiler/ParserController.java @@ -198,7 +198,8 @@ public class ParserController implements TagConstants { try { absFileName = resolveFileName(inFileName); } catch (URISyntaxException e) { - err.jspError("jsp.error.invalid.includeInTagFileJar", inFileName, jar.getJarFileURL().toString()); + // Note: jar may be null here, so avoid referencing it + err.jspError("jsp.error.invalid.include", inFileName); } if (processingTagInJar && !absFileName.startsWith(TAGS_IN_JAR_LOCATION)) { /* diff --git a/java/org/apache/jasper/resources/LocalStrings.properties b/java/org/apache/jasper/resources/LocalStrings.properties index 2704f38a7c..b7a4b65fb4 100644 --- a/java/org/apache/jasper/resources/LocalStrings.properties +++ b/java/org/apache/jasper/resources/LocalStrings.properties @@ -93,6 +93,7 @@ jsp.error.invalid.directive=Invalid directive jsp.error.invalid.expression=[{0}] contains invalid expression(s): [{1}] jsp.error.invalid.implicit=Invalid implicit TLD for tag file at [{0}] jsp.error.invalid.implicit.version=Invalid JSP version defined in implicit TLD for tag file at [{0}] +jsp.error.invalid.include=The include [{0}] is invalid as it cannot be resolved to a valid URI jsp.error.invalid.includeInTagFileJar=The include [{0}] is not valid since it is outside of /META-INF/tags in the current JAR jsp.error.invalid.name=File [{0}] uses name [{1}] in jsp:getProperty for a bean that was not previously introduced as per JSP.5.3 jsp.error.invalid.scope=Illegal value of ''scope'' attribute: [{0}] (must be one of "page", "request", "session", or "application") diff --git a/test/org/apache/jasper/compiler/TestParserController.java b/test/org/apache/jasper/compiler/TestParserController.java new file mode 100644 index 0000000000..51594b2512 --- /dev/null +++ b/test/org/apache/jasper/compiler/TestParserController.java @@ -0,0 +1,43 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.jasper.compiler; + +import org.junit.Assert; +import org.junit.Test; + +import org.apache.catalina.startup.TomcatBaseTest; +import org.apache.tomcat.util.buf.ByteChunk; + +public class TestParserController extends TomcatBaseTest { + + @Test + public void testIncludeInvalidUri() throws Exception { + getTomcatInstanceTestWebapp(false, true); + + ByteChunk res = new ByteChunk(); + int sc = getUrl("http://localhost:"; + getPort() + "/test/jsp/parsing/include-invalid-uri.jsp", res, null); + + Assert.assertEquals(500, sc); + + // The report should include the translation error for the invalid + // include. The error handling code previously threw a + // NullPointerException itself which was reported instead. + String result = res.toString(); + Assert.assertTrue(result, result.contains("The include [a b.jsp] is invalid")); + Assert.assertFalse(result, result.contains("Cannot invoke")); + } +} diff --git a/test/webapp/jsp/parsing/include-invalid-uri.jsp b/test/webapp/jsp/parsing/include-invalid-uri.jsp new file mode 100644 index 0000000000..62cb5bf970 --- /dev/null +++ b/test/webapp/jsp/parsing/include-invalid-uri.jsp @@ -0,0 +1,24 @@ +<%-- + Licensed to the Apache Software Foundation (ASF) under one or more + contributor license agreements. See the NOTICE file distributed with + this work for additional information regarding copyright ownership. + The ASF licenses this file to You under the Apache License, Version 2.0 + (the "License"); you may not use this file except in compliance with + the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +--%> +<%@ page contentType="text/html;charset=UTF-8" %> +<%@ include file="a b.jsp" %> +<html> + <head><title>Include with an invalid URI test case</title></head> + <body> + <p>Should fail</p> + </body> +</html> --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
