This applies to both 6.x and 5.5x version !! Tomcat6.x http://svn.apache.org/repos/asf/tomcat/tc6.0.x/trunk/java/org/apache/catalina/core/ApplicationDispatcher.java Tomcat5.5.x http://svn.apache.org/repos/asf/tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/core/ApplicationDispatcher.java There is a severe always-NULL case in both T6.x and T5.5x sources if request is non-HTTP forward. processRequest(req, res, state) method should use the original "request" and "response" objects, but it gives "hrequest" and "hresponse" objects. private void doForward(ServletRequest request, ServletResponse response) { ...continue... // Identify the HTTP-specific request and response objects (if any) HttpServletRequest hrequest = null; if (request instanceof HttpServletRequest) hrequest = (HttpServletRequest) request; HttpServletResponse hresponse = null; if (response instanceof HttpServletResponse) hresponse = (HttpServletResponse) response; // Handle a non-HTTP forward by passing the existing request/response if ((hrequest == null) || (hresponse == null)) { processRequest(hrequest,hresponse,state); } ...continue... } Calling program gets a NPE exception when forwarding a request. java.lang.NullPointerException at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:459)
Created attachment 21017 [details] Patch against 6.0 trunk to fix this This handles the case where the outer most wrapper is a ServletRequestWrapper, but not a HttpServletRequestWrapper. This further breaks 39417, but that one is invalid anyway (according to the spec).
39417: ApplicationDispatcher.unwrapRequest() should not assume servletRequestWrapper http://issues.apache.org/bugzilla/show_bug.cgi?id=39417 What do you mean, is it that a bug 39417 is even further away to be fixed? I made a quick test and posted a solution I used, a simple is-instanceof check and bail out. Fix is posted at the end of 39417 report.
Fixed in the next 6.0 release with the attached patch.