-
Bug
-
Resolution: Done
-
Critical
-
8.0 Update 5, 8.1.0.Beta
-
False
-
-
False
-
-
-
-
-
-
Known Issue
-
-
-
We have set the Property "allow-unescaped-characters-in-url" to true.
Anyway a request containing a char like '>' now throws a NPE.
Request example:
curl "http://localhost:8080/servlet/find?query=>"
Stacktrace:
2025-02-26 18:19:11,064 ERROR [io.undertow.request] (default task-513) UT005023: Exception handling request to /inbound-servletapi/getSearchResult: java.lang.NullPointerException: Cannot invoke "java.net.URI.toString()" because the return value of "org.wildfly.security.http.HttpServerRequest.getRequestURI()" is null
at org.wildfly.extension.elytron@27.0.0.Final//org.wildfly.extension.elytron.HttpServerDefinitions.lambda$getRequestInformationHashMap$0(HttpServerDefinitions.java:244)
at org.wildfly.security.elytron-base@2.6.0.Final//org.wildfly.security.http.util.SetRequestInformationCallbackMechanismFactory$1.evaluateRequest(SetRequestInformationCallbackMechanismFactory.java:77) [wildfly-elytron-http-util-2.6.0.Final.jar:2.6.0.Final]
at org.wildfly.security.elytron-base@2.6.0.Final//org.wildfly.security.auth.server.SecurityIdentityServerMechanismFactory$1.evaluateRequest(SecurityIdentityServerMechanismFactory.java:85) [wildfly-elytron-auth-server-deprecated-2.6.0.Final.jar:2.6.0.Final]
at org.wildfly.security.elytron-base@2.6.0.Final//org.wildfly.security.http.HttpAuthenticator$AuthenticationExchange.authenticate(HttpAuthenticator.java:326) [wildfly-elytron-http-2.6.0.Final.jar:2.6.0.Final]
at org.wildfly.security.elytron-base@2.6.0.Final//org.wildfly.security.http.HttpAuthenticator$AuthenticationExchange.access$800(HttpAuthenticator.java:296) [wildfly-elytron-http-2.6.0.Final.jar:2.6.0.Final]
at org.wildfly.security.elytron-base@2.6.0.Final//org.wildfly.security.http.HttpAuthenticator.authenticate(HttpAuthenticator.java:93) [wildfly-elytron-http-2.6.0.Final.jar:2.6.0.Final]
at org.wildfly.security.elytron-web.undertow-server@4.1.0.Final//org.wildfly.elytron.web.undertow.server.SecurityContextImpl.authenticate(SecurityContextImpl.java:107)
at org.wildfly.security.elytron-web.undertow-server-servlet@4.1.0.Final//org.wildfly.elytron.web.undertow.server.servlet.ServletSecurityContextImpl.authenticate(ServletSecurityContextImpl.java:117)
at io.undertow.servlet@2.3.18.Final//io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:55) [undertow-servlet-2.3.18.Final.jar:2.3.18.Final]
at io.undertow.core@2.3.18.Final//io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-2.3.18.Final.jar:2.3.18.Final]
at io.undertow.core@2.3.18.Final//io.undertow.security.handlers.AuthenticationConstraintHandler.handleRequest(AuthenticationConstraintHandler.java:53) [undertow-core-2.3.18.Final.jar:2.3.18.Final]
at io.undertow.core@2.3.18.Final//io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46) [undertow-core-2.3.18.Final.jar:2.3.18.Final]
at io.undertow.servlet@2.3.18.Final//io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64) [undertow-servlet-2.3.18.Final.jar:2.3.18.Final]
at io.undertow.servlet@2.3.18.Final//io.undertow.servlet.handlers.security.ServletSecurityConstraintHandler.handleRequest(ServletSecurityConstraintHandler.java:60) [undertow-servlet-2.3.18.Final.jar:2.3.18.Final]
at io.undertow.core@2.3.18.Final//io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43) [undertow-core-2.3.18.Final.jar:2.3.18.Final]
at org.wildfly.security.elytron-web.undertow-server-servlet@4.1.0.Final//org.wildfly.elytron.web.undertow.server.servlet.CleanUpHandler.handleRequest(CleanUpHandler.java:38)
at io.undertow.core@2.3.18.Final//io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-2.3.18.Final.jar:2.3.18.Final]
at org.wildfly.extension.undertow@35.0.0.Final//org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:44)
at io.undertow.core@2.3.18.Final//io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-2.3.18.Final.jar:2.3.18.Final]
at org.wildfly.extension.undertow@35.0.0.Final//org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:51)
at io.undertow.servlet@2.3.18.Final//io.undertow.servlet.handlers.SendErrorPageHandler.handleRequest(SendErrorPageHandler.java:52) [undertow-servlet-2.3.18.Final.jar:2.3.18.Final]
at io.undertow.core@2.3.18.Final//io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-2.3.18.Final.jar:2.3.18.Final]
at io.undertow.servlet@2.3.18.Final//io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:276) [undertow-servlet-2.3.18.Final.jar:2.3.18.Final]
at io.undertow.servlet@2.3.18.Final//io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135) [undertow-servlet-2.3.18.Final.jar:2.3.18.Final]
at io.undertow.servlet@2.3.18.Final//io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:132) [undertow-servlet-2.3.18.Final.jar:2.3.18.Final]
at io.undertow.servlet@2.3.18.Final//io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48) [undertow-servlet-2.3.18.Final.jar:2.3.18.Final]
at io.undertow.servlet@2.3.18.Final//io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43) [undertow-servlet-2.3.18.Final.jar:2.3.18.Final]
at org.wildfly.extension.undertow@35.0.0.Final//org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1421)
at org.wildfly.extension.undertow@35.0.0.Final//org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1421)
at org.wildfly.extension.undertow@35.0.0.Final//org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1421)
at org.wildfly.extension.undertow@35.0.0.Final//org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1421)
at org.wildfly.extension.undertow@35.0.0.Final//org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1421)
at io.undertow.servlet@2.3.18.Final//io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:256) [undertow-servlet-2.3.18.Final.jar:2.3.18.Final]
at io.undertow.servlet@2.3.18.Final//io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:101) [undertow-servlet-2.3.18.Final.jar:2.3.18.Final]
at io.undertow.core@2.3.18.Final//io.undertow.server.Connectors.executeRootHandler(Connectors.java:395) [undertow-core-2.3.18.Final.jar:2.3.18.Final]
at io.undertow.core@2.3.18.Final//io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:861) [undertow-core-2.3.18.Final.jar:2.3.18.Final]
at org.jboss.threads@2.4.0.Final//org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35) [org.jboss.threads-jboss-threads-3.5.0.Final.jar:3.5.0.Final]
at org.jboss.threads@2.4.0.Final//org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1990) [org.jboss.threads-jboss-threads-3.5.0.Final.jar:3.5.0.Final]
at org.jboss.threads@2.4.0.Final//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1486) [org.jboss.threads-jboss-threads-3.5.0.Final.jar:3.5.0.Final]
at org.jboss.threads@2.4.0.Final//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1377) [org.jboss.threads-jboss-threads-3.5.0.Final.jar:3.5.0.Final]
at org.jboss.xnio@3.8.16.Final//org.xnio.XnioWorker$WorkerThreadFactory$1$1.run(XnioWorker.java:1282)
at java.base/java.lang.Thread.run(Thread.java:1583) [java.base:]
- blocks
-
JBEAP-29571 [GSS](8.0.z) WFLY-20433 - Unescaped characters throw a NPE although allowed in settings
-
- Verified
-
- is incorporated by
-
JBEAP-29868 [8.1] Upgrade Elytron Web to 4.1.2.Final
-
- Verified
-