[TAP5-1791] On some JDKs, the complex regular expression used by ComponentEventLinkEncoderImpl will cause a stack overflow

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 5.3
• Fix Version/s: 5.3.3, 5.4
• Component/s: tapestry-core
• Assignee: Howard Lewis Ship
• Reporter: Eddie Lo
• Created: 15/Dec/11 00:08
• Updated: 06/Apr/12 19:34
• Resolved: 06/Apr/12 17:46

Description

Some path parameters will cause tapestry to get into infinite loop.
The exact problem is caused by the combination of 3 factors:

• A low priority bug in JVM – http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=6882582
• A regex generated by Tapestry 3.0
  ^/(((\w(?:\w|-))/)(\w+))(\.(\w+(\.\w+)))?(:(\w+))?(/(.))?
• A long and complex enough path parameter.
  /t5/user/UserResetPasswordPage/user-id/22/reset-password-token/bHLQiMR3VD6eFTQ7Txj2y4u_HyGKiHwC9bF6dazuuf3__qhKpK3rtSbZHwB6W2dbmGCmPS1By1uq-rcZXO-Ooxd6Ire1vwPpxXUAlx3Mf15ShvJEf8r9MfWEMATS3Pyr-HaGiqqcjN2IhDtJtxnypanQkBrVPMC_APwDp7aWWZLajUAXbLn8d4-evXGarDqbUQvUGQ9oqzEAEPRt0hL5oDPwDg

When all the the 3 factors are hit, tapestry will get into an infinite loop at
org.apache.tapestry5.internal.services.ComponentEventLinkEncoderImpl.decodeComponentEventRequest(Request):243
and following exception is thrown

[5DAC745F] java.lang.StackOverflowError
at java.util.regex.Pattern$BranchConn.match(Pattern.java:4078)
at java.util.regex.Pattern$BmpCharProperty.match(Pattern.java:3366)
at java.util.regex.Pattern$Branch.match(Pattern.java:4114)
at java.util.regex.Pattern$GroupHead.match(Pattern.java:4168)
at java.util.regex.Pattern$Loop.match(Pattern.java:4295)
at java.util.regex.Pattern$GroupTail.match(Pattern.java:4227)
at java.util.regex.Pattern$BranchConn.match(Pattern.java:4078)
at java.util.regex.Pattern$BmpCharProperty.match(Pattern.java:3366)
at java.util.regex.Pattern$Branch.match(Pattern.java:4114)
at java.util.regex.Pattern$GroupHead.match(Pattern.java:4168)
at java.util.regex.Pattern$Loop.match(Pattern.java:4295)
at java.util.regex.Pattern$GroupTail.match(Pattern.java:4227)
at java.util.regex.Pattern$BranchConn.match(Pattern.java:4078)
at java.util.regex.Pattern$BmpCharProperty.match(Pattern.java:3366)
...

There is a limit in java only holding the top 1024 stacks. As the frame is small this time, it have far more that 1024, the bottom is truncated and lost.
However, I used a debugger to confirm that it is thrown from org.apache.tapestry5.internal.services.ComponentEventLinkEncoderImpl.decodeComponentEventRequest(Request):243

While the problem is caused by JVM bug (Oracle) and a long complex path parameters (us), it is recommended to also fix this in Tapestry to use a simpler regex.