This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch 10.1.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 553a8633b8ca0d0e67be993776b517538885b59a Author: opencode <[email protected]> AuthorDate: Mon Oct 19 12:30:48 2026 +0200 Avoid StringIndexOutOfBoundsException on an empty content-type parameter getContentTypeAttribute() positioned itself after the '=' of the requested attribute, trimmed the remainder and then unconditionally tested charAt(0). A parameter value that was empty or contained only whitespace, for example the malformed but plausible "Content-Type: text/html;charset=" header a remote server could return for a <c:import> of an absolute URL, produced an empty string here and the charAt(0) call threw a StringIndexOutOfBoundsException that propagated out of the generated tag plugin code as a raw runtime exception. Return null for an empty value instead, matching the existing contract for an attribute that is not present, so the callers in the Import tag plugin fall back to the default encoding. Found by code review. --- java/org/apache/jasper/tagplugins/jstl/Util.java | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/java/org/apache/jasper/tagplugins/jstl/Util.java b/java/org/apache/jasper/tagplugins/jstl/Util.java index 9c6faa2e77..a57dfe823e 100644 --- a/java/org/apache/jasper/tagplugins/jstl/Util.java +++ b/java/org/apache/jasper/tagplugins/jstl/Util.java @@ -140,6 +140,11 @@ public class Util { } index += 1; // positioned after the '=' input = input.substring(index).trim(); + if (input.isEmpty()) { + // Empty or whitespace-only parameter value, e.g. a malformed + // "Content-Type: text/html;charset=" header from a remote server. + return null; + } if (input.charAt(0) == '"') { // attribute value is a quoted string --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
