Tapestry 5
  1. Tapestry 5
  2. TAP5-1791

On some JDKs, the complex regular expression used by ComponentEventLinkEncoderImpl will cause a stack overflow

    Details

    • Type: Bug Bug
    • Status: Closed
    • Priority: Critical Critical
    • Resolution: Fixed
    • Affects Version/s: 5.3
    • Fix Version/s: 5.3.3, 5.4
    • Component/s: tapestry-core
    • Labels:
      None

      Description

      Some path parameters will cause tapestry to get into infinite loop.
      The exact problem is caused by the combination of 3 factors:

      • A low priority bug in JVM – http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=6882582
      • A regex generated by Tapestry 3.0
        ^/(((\w(?:\w|-))/)(\w+))(\.(\w+(\.\w+)))?(:(\w+))?(/(.))?
      • A long and complex enough path parameter.
        /t5/user/UserResetPasswordPage/user-id/22/reset-password-token/bHLQiMR3VD6eFTQ7Txj2y4u_HyGKiHwC9bF6dazuuf3__qhKpK3rtSbZHwB6W2dbmGCmPS1By1uq-rcZXO-Ooxd6Ire1vwPpxXUAlx3Mf15ShvJEf8r9MfWEMATS3Pyr-HaGiqqcjN2IhDtJtxnypanQkBrVPMC_APwDp7aWWZLajUAXbLn8d4-evXGarDqbUQvUGQ9oqzEAEPRt0hL5oDPwDg

      When all the the 3 factors are hit, tapestry will get into an infinite loop at
      org.apache.tapestry5.internal.services.ComponentEventLinkEncoderImpl.decodeComponentEventRequest(Request):243
      and following exception is thrown

      [5DAC745F] java.lang.StackOverflowError
      at java.util.regex.Pattern$BranchConn.match(Pattern.java:4078)
      at java.util.regex.Pattern$BmpCharProperty.match(Pattern.java:3366)
      at java.util.regex.Pattern$Branch.match(Pattern.java:4114)
      at java.util.regex.Pattern$GroupHead.match(Pattern.java:4168)
      at java.util.regex.Pattern$Loop.match(Pattern.java:4295)
      at java.util.regex.Pattern$GroupTail.match(Pattern.java:4227)
      at java.util.regex.Pattern$BranchConn.match(Pattern.java:4078)
      at java.util.regex.Pattern$BmpCharProperty.match(Pattern.java:3366)
      at java.util.regex.Pattern$Branch.match(Pattern.java:4114)
      at java.util.regex.Pattern$GroupHead.match(Pattern.java:4168)
      at java.util.regex.Pattern$Loop.match(Pattern.java:4295)
      at java.util.regex.Pattern$GroupTail.match(Pattern.java:4227)
      at java.util.regex.Pattern$BranchConn.match(Pattern.java:4078)
      at java.util.regex.Pattern$BmpCharProperty.match(Pattern.java:3366)
      ...

      There is a limit in java only holding the top 1024 stacks. As the frame is small this time, it have far more that 1024, the bottom is truncated and lost.
      However, I used a debugger to confirm that it is thrown from org.apache.tapestry5.internal.services.ComponentEventLinkEncoderImpl.decodeComponentEventRequest(Request):243

      While the problem is caused by JVM bug (Oracle) and a long complex path parameters (us), it is recommended to also fix this in Tapestry to use a simpler regex.

        Activity

        Eddie Lo created issue -
        Eddie Lo made changes -
        Field Original Value New Value
        Description Some some path parameters will cause tapestry getting into infinite loop.
        The exact problem is caused by the combination of 3 factors:
        * [A low priority bug in JVM|http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=6882582]
        * A regex generated by Tapestry 3.0
        {noformat}
        ^/(((\w(?:\w|-)*)/)*(\w+))(\.(\w+(\.\w+)*))?(\:(\w+))?(/(.*))?
        {noformat}
        * A long and complex enough path parameter.
        {noformat}
        http://platform1-regression.qa.lithium.com/t5/user/UserResetPasswordPage/user-id/22/reset-password-token/bHLQiMR3VD6eFTQ7Txj2y4u_HyGKiHwC9bF6dazuuf3__qhKpK3rtSbZHwB6W2dbmGCmPS1By1uq-rcZXO-Ooxd6Ire1vwPpxXUAlx3Mf15ShvJEf8r9MfWEMATS3Pyr-HaGiqqcjN2IhDtJtxnypanQkBrVPMC_APwDp7aWWZLajUAXbLn8d4-evXGarDqbUQvUGQ9oqzEAEPRt0hL5oDPwDg
        {noformat}

        When all the the 3 factors are hit, tapestry will get into at
        org.apache.tapestry5.internal.services.ComponentEventLinkEncoderImpl.decodeComponentEventRequest(Request):243
        and following exception is thrown
        {noformat}
        [5DAC745F] java.lang.StackOverflowError
        at java.util.regex.Pattern$BranchConn.match(Pattern.java:4078)
        at java.util.regex.Pattern$BmpCharProperty.match(Pattern.java:3366)
        at java.util.regex.Pattern$Branch.match(Pattern.java:4114)
        at java.util.regex.Pattern$GroupHead.match(Pattern.java:4168)
        at java.util.regex.Pattern$Loop.match(Pattern.java:4295)
        at java.util.regex.Pattern$GroupTail.match(Pattern.java:4227)
        at java.util.regex.Pattern$BranchConn.match(Pattern.java:4078)
        at java.util.regex.Pattern$BmpCharProperty.match(Pattern.java:3366)
        at java.util.regex.Pattern$Branch.match(Pattern.java:4114)
        at java.util.regex.Pattern$GroupHead.match(Pattern.java:4168)
        at java.util.regex.Pattern$Loop.match(Pattern.java:4295)
        at java.util.regex.Pattern$GroupTail.match(Pattern.java:4227)
        at java.util.regex.Pattern$BranchConn.match(Pattern.java:4078)
        at java.util.regex.Pattern$BmpCharProperty.match(Pattern.java:3366)
        ...
        {noformat}

        There is a limit in java only holding the top 1024 stacks. As the frame is small this time, it have far more that 1024, the bottom is truncated and lost.
        However, I used debugger to confirm that it is thrown from org.apache.tapestry5.internal.services.ComponentEventLinkEncoderImpl.decodeComponentEventRequest(Request):243

        While the problem is caused by JVM bug (Oracle) and a long complex path parameters (us), it is recommended to also fix this in Tapestry to use a simpler regex.

        Some some path parameters will cause tapestry getting into infinite loop.
        The exact problem is caused by the combination of 3 factors:
        * A low priority bug in JVM -- http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=6882582
        * A regex generated by Tapestry 3.0
        ^/(((\w(?:\w|-)*)/)*(\w+))(\.(\w+(\.\w+)*))?(\:(\w+))?(/(.*))?
        * A long and complex enough path parameter.
        /t5/user/UserResetPasswordPage/user-id/22/reset-password-token/bHLQiMR3VD6eFTQ7Txj2y4u_HyGKiHwC9bF6dazuuf3__qhKpK3rtSbZHwB6W2dbmGCmPS1By1uq-rcZXO-Ooxd6Ire1vwPpxXUAlx3Mf15ShvJEf8r9MfWEMATS3Pyr-HaGiqqcjN2IhDtJtxnypanQkBrVPMC_APwDp7aWWZLajUAXbLn8d4-evXGarDqbUQvUGQ9oqzEAEPRt0hL5oDPwDg


        When all the the 3 factors are hit, tapestry will get into at
        org.apache.tapestry5.internal.services.ComponentEventLinkEncoderImpl.decodeComponentEventRequest(Request):243
        and following exception is thrown

        [5DAC745F] java.lang.StackOverflowError
        at java.util.regex.Pattern$BranchConn.match(Pattern.java:4078)
        at java.util.regex.Pattern$BmpCharProperty.match(Pattern.java:3366)
        at java.util.regex.Pattern$Branch.match(Pattern.java:4114)
        at java.util.regex.Pattern$GroupHead.match(Pattern.java:4168)
        at java.util.regex.Pattern$Loop.match(Pattern.java:4295)
        at java.util.regex.Pattern$GroupTail.match(Pattern.java:4227)
        at java.util.regex.Pattern$BranchConn.match(Pattern.java:4078)
        at java.util.regex.Pattern$BmpCharProperty.match(Pattern.java:3366)
        at java.util.regex.Pattern$Branch.match(Pattern.java:4114)
        at java.util.regex.Pattern$GroupHead.match(Pattern.java:4168)
        at java.util.regex.Pattern$Loop.match(Pattern.java:4295)
        at java.util.regex.Pattern$GroupTail.match(Pattern.java:4227)
        at java.util.regex.Pattern$BranchConn.match(Pattern.java:4078)
        at java.util.regex.Pattern$BmpCharProperty.match(Pattern.java:3366)
        ...


        There is a limit in java only holding the top 1024 stacks. As the frame is small this time, it have far more that 1024, the bottom is truncated and lost.
        However, I used debugger to confirm that it is thrown from org.apache.tapestry5.internal.services.ComponentEventLinkEncoderImpl.decodeComponentEventRequest(Request):243

        While the problem is caused by JVM bug (Oracle) and a long complex path parameters (us), it is recommended to also fix this in Tapestry to use a simpler regex.

        Eddie Lo made changes -
        Description Some some path parameters will cause tapestry getting into infinite loop.
        The exact problem is caused by the combination of 3 factors:
        * A low priority bug in JVM -- http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=6882582
        * A regex generated by Tapestry 3.0
        ^/(((\w(?:\w|-)*)/)*(\w+))(\.(\w+(\.\w+)*))?(\:(\w+))?(/(.*))?
        * A long and complex enough path parameter.
        /t5/user/UserResetPasswordPage/user-id/22/reset-password-token/bHLQiMR3VD6eFTQ7Txj2y4u_HyGKiHwC9bF6dazuuf3__qhKpK3rtSbZHwB6W2dbmGCmPS1By1uq-rcZXO-Ooxd6Ire1vwPpxXUAlx3Mf15ShvJEf8r9MfWEMATS3Pyr-HaGiqqcjN2IhDtJtxnypanQkBrVPMC_APwDp7aWWZLajUAXbLn8d4-evXGarDqbUQvUGQ9oqzEAEPRt0hL5oDPwDg


        When all the the 3 factors are hit, tapestry will get into at
        org.apache.tapestry5.internal.services.ComponentEventLinkEncoderImpl.decodeComponentEventRequest(Request):243
        and following exception is thrown

        [5DAC745F] java.lang.StackOverflowError
        at java.util.regex.Pattern$BranchConn.match(Pattern.java:4078)
        at java.util.regex.Pattern$BmpCharProperty.match(Pattern.java:3366)
        at java.util.regex.Pattern$Branch.match(Pattern.java:4114)
        at java.util.regex.Pattern$GroupHead.match(Pattern.java:4168)
        at java.util.regex.Pattern$Loop.match(Pattern.java:4295)
        at java.util.regex.Pattern$GroupTail.match(Pattern.java:4227)
        at java.util.regex.Pattern$BranchConn.match(Pattern.java:4078)
        at java.util.regex.Pattern$BmpCharProperty.match(Pattern.java:3366)
        at java.util.regex.Pattern$Branch.match(Pattern.java:4114)
        at java.util.regex.Pattern$GroupHead.match(Pattern.java:4168)
        at java.util.regex.Pattern$Loop.match(Pattern.java:4295)
        at java.util.regex.Pattern$GroupTail.match(Pattern.java:4227)
        at java.util.regex.Pattern$BranchConn.match(Pattern.java:4078)
        at java.util.regex.Pattern$BmpCharProperty.match(Pattern.java:3366)
        ...


        There is a limit in java only holding the top 1024 stacks. As the frame is small this time, it have far more that 1024, the bottom is truncated and lost.
        However, I used debugger to confirm that it is thrown from org.apache.tapestry5.internal.services.ComponentEventLinkEncoderImpl.decodeComponentEventRequest(Request):243

        While the problem is caused by JVM bug (Oracle) and a long complex path parameters (us), it is recommended to also fix this in Tapestry to use a simpler regex.

        Some path parameters will cause tapestry to get into infinite loop.
        The exact problem is caused by the combination of 3 factors:
        * A low priority bug in JVM -- http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=6882582
        * A regex generated by Tapestry 3.0
        ^/(((\w(?:\w|-)*)/)*(\w+))(\.(\w+(\.\w+)*))?(\:(\w+))?(/(.*))?
        * A long and complex enough path parameter.
        /t5/user/UserResetPasswordPage/user-id/22/reset-password-token/bHLQiMR3VD6eFTQ7Txj2y4u_HyGKiHwC9bF6dazuuf3__qhKpK3rtSbZHwB6W2dbmGCmPS1By1uq-rcZXO-Ooxd6Ire1vwPpxXUAlx3Mf15ShvJEf8r9MfWEMATS3Pyr-HaGiqqcjN2IhDtJtxnypanQkBrVPMC_APwDp7aWWZLajUAXbLn8d4-evXGarDqbUQvUGQ9oqzEAEPRt0hL5oDPwDg


        When all the the 3 factors are hit, tapestry will get into an infinite loop at
        org.apache.tapestry5.internal.services.ComponentEventLinkEncoderImpl.decodeComponentEventRequest(Request):243
        and following exception is thrown

        [5DAC745F] java.lang.StackOverflowError
        at java.util.regex.Pattern$BranchConn.match(Pattern.java:4078)
        at java.util.regex.Pattern$BmpCharProperty.match(Pattern.java:3366)
        at java.util.regex.Pattern$Branch.match(Pattern.java:4114)
        at java.util.regex.Pattern$GroupHead.match(Pattern.java:4168)
        at java.util.regex.Pattern$Loop.match(Pattern.java:4295)
        at java.util.regex.Pattern$GroupTail.match(Pattern.java:4227)
        at java.util.regex.Pattern$BranchConn.match(Pattern.java:4078)
        at java.util.regex.Pattern$BmpCharProperty.match(Pattern.java:3366)
        at java.util.regex.Pattern$Branch.match(Pattern.java:4114)
        at java.util.regex.Pattern$GroupHead.match(Pattern.java:4168)
        at java.util.regex.Pattern$Loop.match(Pattern.java:4295)
        at java.util.regex.Pattern$GroupTail.match(Pattern.java:4227)
        at java.util.regex.Pattern$BranchConn.match(Pattern.java:4078)
        at java.util.regex.Pattern$BmpCharProperty.match(Pattern.java:3366)
        ...


        There is a limit in java only holding the top 1024 stacks. As the frame is small this time, it have far more that 1024, the bottom is truncated and lost.
        However, I used debugger to confirm that it is thrown from org.apache.tapestry5.internal.services.ComponentEventLinkEncoderImpl.decodeComponentEventRequest(Request):243

        While the problem is caused by JVM bug (Oracle) and a long complex path parameters (us), it is recommended to also fix this in Tapestry to use a simpler regex.

        Eddie Lo made changes -
        Description Some path parameters will cause tapestry to get into infinite loop.
        The exact problem is caused by the combination of 3 factors:
        * A low priority bug in JVM -- http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=6882582
        * A regex generated by Tapestry 3.0
        ^/(((\w(?:\w|-)*)/)*(\w+))(\.(\w+(\.\w+)*))?(\:(\w+))?(/(.*))?
        * A long and complex enough path parameter.
        /t5/user/UserResetPasswordPage/user-id/22/reset-password-token/bHLQiMR3VD6eFTQ7Txj2y4u_HyGKiHwC9bF6dazuuf3__qhKpK3rtSbZHwB6W2dbmGCmPS1By1uq-rcZXO-Ooxd6Ire1vwPpxXUAlx3Mf15ShvJEf8r9MfWEMATS3Pyr-HaGiqqcjN2IhDtJtxnypanQkBrVPMC_APwDp7aWWZLajUAXbLn8d4-evXGarDqbUQvUGQ9oqzEAEPRt0hL5oDPwDg


        When all the the 3 factors are hit, tapestry will get into an infinite loop at
        org.apache.tapestry5.internal.services.ComponentEventLinkEncoderImpl.decodeComponentEventRequest(Request):243
        and following exception is thrown

        [5DAC745F] java.lang.StackOverflowError
        at java.util.regex.Pattern$BranchConn.match(Pattern.java:4078)
        at java.util.regex.Pattern$BmpCharProperty.match(Pattern.java:3366)
        at java.util.regex.Pattern$Branch.match(Pattern.java:4114)
        at java.util.regex.Pattern$GroupHead.match(Pattern.java:4168)
        at java.util.regex.Pattern$Loop.match(Pattern.java:4295)
        at java.util.regex.Pattern$GroupTail.match(Pattern.java:4227)
        at java.util.regex.Pattern$BranchConn.match(Pattern.java:4078)
        at java.util.regex.Pattern$BmpCharProperty.match(Pattern.java:3366)
        at java.util.regex.Pattern$Branch.match(Pattern.java:4114)
        at java.util.regex.Pattern$GroupHead.match(Pattern.java:4168)
        at java.util.regex.Pattern$Loop.match(Pattern.java:4295)
        at java.util.regex.Pattern$GroupTail.match(Pattern.java:4227)
        at java.util.regex.Pattern$BranchConn.match(Pattern.java:4078)
        at java.util.regex.Pattern$BmpCharProperty.match(Pattern.java:3366)
        ...


        There is a limit in java only holding the top 1024 stacks. As the frame is small this time, it have far more that 1024, the bottom is truncated and lost.
        However, I used debugger to confirm that it is thrown from org.apache.tapestry5.internal.services.ComponentEventLinkEncoderImpl.decodeComponentEventRequest(Request):243

        While the problem is caused by JVM bug (Oracle) and a long complex path parameters (us), it is recommended to also fix this in Tapestry to use a simpler regex.

        Some path parameters will cause tapestry to get into infinite loop.
        The exact problem is caused by the combination of 3 factors:
        * A low priority bug in JVM -- http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=6882582
        * A regex generated by Tapestry 3.0
        ^/(((\w(?:\w|-)*)/)*(\w+))(\.(\w+(\.\w+)*))?(\:(\w+))?(/(.*))?
        * A long and complex enough path parameter.
        /t5/user/UserResetPasswordPage/user-id/22/reset-password-token/bHLQiMR3VD6eFTQ7Txj2y4u_HyGKiHwC9bF6dazuuf3__qhKpK3rtSbZHwB6W2dbmGCmPS1By1uq-rcZXO-Ooxd6Ire1vwPpxXUAlx3Mf15ShvJEf8r9MfWEMATS3Pyr-HaGiqqcjN2IhDtJtxnypanQkBrVPMC_APwDp7aWWZLajUAXbLn8d4-evXGarDqbUQvUGQ9oqzEAEPRt0hL5oDPwDg


        When all the the 3 factors are hit, tapestry will get into an infinite loop at
        org.apache.tapestry5.internal.services.ComponentEventLinkEncoderImpl.decodeComponentEventRequest(Request):243
        and following exception is thrown

        [5DAC745F] java.lang.StackOverflowError
        at java.util.regex.Pattern$BranchConn.match(Pattern.java:4078)
        at java.util.regex.Pattern$BmpCharProperty.match(Pattern.java:3366)
        at java.util.regex.Pattern$Branch.match(Pattern.java:4114)
        at java.util.regex.Pattern$GroupHead.match(Pattern.java:4168)
        at java.util.regex.Pattern$Loop.match(Pattern.java:4295)
        at java.util.regex.Pattern$GroupTail.match(Pattern.java:4227)
        at java.util.regex.Pattern$BranchConn.match(Pattern.java:4078)
        at java.util.regex.Pattern$BmpCharProperty.match(Pattern.java:3366)
        at java.util.regex.Pattern$Branch.match(Pattern.java:4114)
        at java.util.regex.Pattern$GroupHead.match(Pattern.java:4168)
        at java.util.regex.Pattern$Loop.match(Pattern.java:4295)
        at java.util.regex.Pattern$GroupTail.match(Pattern.java:4227)
        at java.util.regex.Pattern$BranchConn.match(Pattern.java:4078)
        at java.util.regex.Pattern$BmpCharProperty.match(Pattern.java:3366)
        ...


        There is a limit in java only holding the top 1024 stacks. As the frame is small this time, it have far more that 1024, the bottom is truncated and lost.
        However, I used a debugger to confirm that it is thrown from org.apache.tapestry5.internal.services.ComponentEventLinkEncoderImpl.decodeComponentEventRequest(Request):243

        While the problem is caused by JVM bug (Oracle) and a long complex path parameters (us), it is recommended to also fix this in Tapestry to use a simpler regex.

        Eddie Lo made changes -
        Attachment LIA25066Test.java [ 12514186 ]
        Howard M. Lewis Ship made changes -
        Assignee Howard M. Lewis Ship [ hlship ]
        Howard M. Lewis Ship made changes -
        Status Open [ 1 ] In Progress [ 3 ]
        Howard M. Lewis Ship made changes -
        Summary java.lang.StackOverflowError was thrown at org.apache.tapestry5.internal.services.ComponentEventLinkEncoderImpl.decodeComponentEventRequest(Request):243 On some JDKs, the complex regular expression used by ComponentEventLinkEncoderImpl will cause a stack overflow
        Howard M. Lewis Ship made changes -
        Status In Progress [ 3 ] Closed [ 6 ]
        Fix Version/s 5.3.3 [ 12320045 ]
        Fix Version/s 5.4 [ 12316401 ]
        Resolution Fixed [ 1 ]

          People

          • Assignee:
            Howard M. Lewis Ship
            Reporter:
            Eddie Lo
          • Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved:

              Development