[TOBAGO-2050] StringIndexOutOfBoundsException in ...util.WebXmlUtils.normalizePath()

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 4.5.0
• Fix Version/s: 4.5.4, 5.0.0-alpha-1, 5.0.0
• Component/s: Core
• Assignee: Udo Schnurpfeil
• Reporter: Andy Price
• Created: 10/Jul/20 20:17
• Updated: 31/May/21 05:34
• Resolved: 07/Apr/21 20:16

Description

I have a servlet "/ExceptionHandler" listed as an error handler in my web.xml:

        <error-page>
                <exception-type>javax.servlet.ServletException</exception-type>
                <location>/ExceptionHandler</location>
        </error-page>

and it is triggering this bug in Tobago while attempting to handle an exception in an ajax path:

19:53:34,734 ERROR [io.undertow.request] (default task-19) UT005023: Exception handling request to /incubation.xhtml: java.lang.StringIndexOutOfBoundsException: String index out of range: -1
	at java.lang.String.substring(String.java:1967)
	at org.apache.myfaces.tobago.util.WebXmlUtils.normalizePath(WebXmlUtils.java:184)
	at org.apache.myfaces.tobago.util.WebXmlUtils.init(WebXmlUtils.java:104)
	at org.apache.myfaces.tobago.util.WebXmlUtils.getErrorPageLocation(WebXmlUtils.java:50)
	at org.apache.myfaces.tobago.webapp.AjaxExceptionHandler.handle(AjaxExceptionHandler.java:68)
	at org.apache.myfaces.lifecycle.LifecycleImpl.executePhase(LifecycleImpl.java:216)
	at org.apache.myfaces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:142)
	at javax.faces.webapp.FacesServlet.service(FacesServlet.java:204)
        ...

Looking at the relevant code in Tobago (https://github.com/apache/myfaces-tobago/blob/master/tobago-core/src/main/java/org/apache/myfaces/tobago/util/WebXmlUtils.java#L184 ):

      if (path.endsWith(suffix)) {
        return path;
      } else {
        return path.substring(0, path.lastIndexOf('.')) + suffix;
      }

It appears to be assuming that the <location> entry is a path that has a '.' separated suffix and when the path is "/ExceptionHandler" it throws the above exception. (I don't understand why it's trying to 'normalize' the location by replacing the suffix here; perhaps it isn't even needed.)