This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch 9.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 56ecfaad7f9e90a2b33cb2e79050e26862e9a9a0 Author: opencode <[email protected]> AuthorDate: Mon Oct 19 12:30:48 2026 +0200 Avoid StringIndexOutOfBoundsException on an empty content-type parameter getContentTypeAttribute() positioned itself after the '=' of the requested attribute, trimmed the remainder and then unconditionally tested charAt(0). A parameter value that was empty or contained only whitespace, for example the malformed but plausible "Content-Type: text/html;charset=" header a remote server could return for a <c:import> of an absolute URL, produced an empty string here and the charAt(0) call threw a StringIndexOutOfBoundsException that propagated out of the generated tag plugin code as a raw runtime exception. Return null for an empty value instead, matching the existing contract for an attribute that is not present, so the callers in the Import tag plugin fall back to the default encoding. Found by code review. --- java/org/apache/jasper/tagplugins/jstl/Util.java | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/java/org/apache/jasper/tagplugins/jstl/Util.java b/java/org/apache/jasper/tagplugins/jstl/Util.java index c73532d0d2..de0a39d87d 100644 --- a/java/org/apache/jasper/tagplugins/jstl/Util.java +++ b/java/org/apache/jasper/tagplugins/jstl/Util.java @@ -139,6 +139,11 @@ public class Util { } index += 1; // positioned after the '=' input = input.substring(index).trim(); + if (input.isEmpty()) { + // Empty or whitespace-only parameter value, e.g. a malformed + // "Content-Type: text/html;charset=" header from a remote server. + return null; + } if (input.charAt(0) == '"') { // attribute value is a quoted string --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
