Uploaded image for project: 'JBoss Enterprise Application Platform'
  1. JBoss Enterprise Application Platform
  2. JBEAP-29835

[8.1.0.GA] - [GSS](8.0.z) WFLY-20433 - Unescaped characters throw a NPE although allowed in settings

XMLWordPrintable

    • False
    • Hide

      None

      Show
      None
    • False
    • Known Issue
    • Hide

      1. set "allow-unescaped-characters-in-url" = true in config

      2. Do a request with an unescaped char like ">" to a servlet:
      curl "http://localhost:8080/servlet/find?query=>"

      Show
      1. set " allow-unescaped-characters-in-url " = true in config 2. Do a request with an unescaped char like ">" to a servlet: curl "http://localhost:8080/servlet/find?query=>"

      We have set the Property "allow-unescaped-characters-in-url" to true.

      Anyway a request containing a char like '>' now throws a NPE.

      Request example:
      curl "http://localhost:8080/servlet/find?query=>"

       

      Stacktrace:
      2025-02-26 18:19:11,064 ERROR [io.undertow.request] (default task-513) UT005023: Exception handling request to /inbound-servletapi/getSearchResult: java.lang.NullPointerException: Cannot invoke "java.net.URI.toString()" because the return value of "org.wildfly.security.http.HttpServerRequest.getRequestURI()" is null
             at org.wildfly.extension.elytron@27.0.0.Final//org.wildfly.extension.elytron.HttpServerDefinitions.lambda$getRequestInformationHashMap$0(HttpServerDefinitions.java:244)
             at org.wildfly.security.elytron-base@2.6.0.Final//org.wildfly.security.http.util.SetRequestInformationCallbackMechanismFactory$1.evaluateRequest(SetRequestInformationCallbackMechanismFactory.java:77) [wildfly-elytron-http-util-2.6.0.Final.jar:2.6.0.Final]
             at org.wildfly.security.elytron-base@2.6.0.Final//org.wildfly.security.auth.server.SecurityIdentityServerMechanismFactory$1.evaluateRequest(SecurityIdentityServerMechanismFactory.java:85) [wildfly-elytron-auth-server-deprecated-2.6.0.Final.jar:2.6.0.Final]
             at org.wildfly.security.elytron-base@2.6.0.Final//org.wildfly.security.http.HttpAuthenticator$AuthenticationExchange.authenticate(HttpAuthenticator.java:326) [wildfly-elytron-http-2.6.0.Final.jar:2.6.0.Final]
             at org.wildfly.security.elytron-base@2.6.0.Final//org.wildfly.security.http.HttpAuthenticator$AuthenticationExchange.access$800(HttpAuthenticator.java:296) [wildfly-elytron-http-2.6.0.Final.jar:2.6.0.Final]
             at org.wildfly.security.elytron-base@2.6.0.Final//org.wildfly.security.http.HttpAuthenticator.authenticate(HttpAuthenticator.java:93) [wildfly-elytron-http-2.6.0.Final.jar:2.6.0.Final]
             at org.wildfly.security.elytron-web.undertow-server@4.1.0.Final//org.wildfly.elytron.web.undertow.server.SecurityContextImpl.authenticate(SecurityContextImpl.java:107)
             at org.wildfly.security.elytron-web.undertow-server-servlet@4.1.0.Final//org.wildfly.elytron.web.undertow.server.servlet.ServletSecurityContextImpl.authenticate(ServletSecurityContextImpl.java:117)
             at io.undertow.servlet@2.3.18.Final//io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:55) [undertow-servlet-2.3.18.Final.jar:2.3.18.Final]
             at io.undertow.core@2.3.18.Final//io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-2.3.18.Final.jar:2.3.18.Final]
             at io.undertow.core@2.3.18.Final//io.undertow.security.handlers.AuthenticationConstraintHandler.handleRequest(AuthenticationConstraintHandler.java:53) [undertow-core-2.3.18.Final.jar:2.3.18.Final]
             at io.undertow.core@2.3.18.Final//io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46) [undertow-core-2.3.18.Final.jar:2.3.18.Final]
             at io.undertow.servlet@2.3.18.Final//io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64) [undertow-servlet-2.3.18.Final.jar:2.3.18.Final]
             at io.undertow.servlet@2.3.18.Final//io.undertow.servlet.handlers.security.ServletSecurityConstraintHandler.handleRequest(ServletSecurityConstraintHandler.java:60) [undertow-servlet-2.3.18.Final.jar:2.3.18.Final]
             at io.undertow.core@2.3.18.Final//io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43) [undertow-core-2.3.18.Final.jar:2.3.18.Final]
             at org.wildfly.security.elytron-web.undertow-server-servlet@4.1.0.Final//org.wildfly.elytron.web.undertow.server.servlet.CleanUpHandler.handleRequest(CleanUpHandler.java:38)
             at io.undertow.core@2.3.18.Final//io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-2.3.18.Final.jar:2.3.18.Final]
             at org.wildfly.extension.undertow@35.0.0.Final//org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:44)
             at io.undertow.core@2.3.18.Final//io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-2.3.18.Final.jar:2.3.18.Final]
             at org.wildfly.extension.undertow@35.0.0.Final//org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:51)
             at io.undertow.servlet@2.3.18.Final//io.undertow.servlet.handlers.SendErrorPageHandler.handleRequest(SendErrorPageHandler.java:52) [undertow-servlet-2.3.18.Final.jar:2.3.18.Final]
             at io.undertow.core@2.3.18.Final//io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-2.3.18.Final.jar:2.3.18.Final]
             at io.undertow.servlet@2.3.18.Final//io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:276) [undertow-servlet-2.3.18.Final.jar:2.3.18.Final]
             at io.undertow.servlet@2.3.18.Final//io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135) [undertow-servlet-2.3.18.Final.jar:2.3.18.Final]
             at io.undertow.servlet@2.3.18.Final//io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:132) [undertow-servlet-2.3.18.Final.jar:2.3.18.Final]
             at io.undertow.servlet@2.3.18.Final//io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48) [undertow-servlet-2.3.18.Final.jar:2.3.18.Final]
             at io.undertow.servlet@2.3.18.Final//io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43) [undertow-servlet-2.3.18.Final.jar:2.3.18.Final]
             at org.wildfly.extension.undertow@35.0.0.Final//org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1421)
             at org.wildfly.extension.undertow@35.0.0.Final//org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1421)
             at org.wildfly.extension.undertow@35.0.0.Final//org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1421)
             at org.wildfly.extension.undertow@35.0.0.Final//org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1421)
             at org.wildfly.extension.undertow@35.0.0.Final//org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1421)
             at io.undertow.servlet@2.3.18.Final//io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:256) [undertow-servlet-2.3.18.Final.jar:2.3.18.Final]
             at io.undertow.servlet@2.3.18.Final//io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:101) [undertow-servlet-2.3.18.Final.jar:2.3.18.Final]
             at io.undertow.core@2.3.18.Final//io.undertow.server.Connectors.executeRootHandler(Connectors.java:395) [undertow-core-2.3.18.Final.jar:2.3.18.Final]
             at io.undertow.core@2.3.18.Final//io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:861) [undertow-core-2.3.18.Final.jar:2.3.18.Final]
             at org.jboss.threads@2.4.0.Final//org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35) [org.jboss.threads-jboss-threads-3.5.0.Final.jar:3.5.0.Final]
             at org.jboss.threads@2.4.0.Final//org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1990) [org.jboss.threads-jboss-threads-3.5.0.Final.jar:3.5.0.Final]
             at org.jboss.threads@2.4.0.Final//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1486) [org.jboss.threads-jboss-threads-3.5.0.Final.jar:3.5.0.Final]
             at org.jboss.threads@2.4.0.Final//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1377) [org.jboss.threads-jboss-threads-3.5.0.Final.jar:3.5.0.Final]
             at org.jboss.xnio@3.8.16.Final//org.xnio.XnioWorker$WorkerThreadFactory$1$1.run(XnioWorker.java:1282)
             at java.base/java.lang.Thread.run(Thread.java:1583) [java.base:]

              darran.lofthouse@redhat.com Darran Lofthouse
              rhn-support-aogburn Aaron Ogburn
              Ondrej Kotek Ondrej Kotek
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: