You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by re...@apache.org on 2026/10/19 21:17:39 UTC
(tomcat) 45/46: Match duplicate page directive attribute names exactly
This is an automated email from the ASF dual-hosted git repository.
rmaucher pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 7f35d5292e4f26a2ee2895f67bf1bec32ca8e07b
Author: opencode <re...@apache.org>
AuthorDate: Mon Oct 19 17:11:48 2026 +0200
Match duplicate page directive attribute names exactly
handleDuplicate() tested import and pageEncoding case-insensitively
although duplicates are only ever detected for the exact qname string,
so a differently cased repeat such as Import reached the import merge
branch where the exact-name lookup found no attribute and the merge
threw ArrayIndexOutOfBoundsException for index -1 instead of reporting
a duplicate name.
Compare the constants exactly. A differently cased repeat is a
different attribute per the XML qname rules and now follows the
ordinary duplicate rules; the exact comparison still covers every
attribute the merge branch can legitimately receive, since a detected
duplicate always leaves the exact qname in the store.
Add a test for the rejected, differently cased repeat.
Found by code review.
---
.../apache/jasper/util/UniqueAttributesImpl.java | 7 +++++--
.../jasper/util/TestUniqueAttributesImpl.java | 21 +++++++++++++++++++++
2 files changed, 26 insertions(+), 2 deletions(-)
diff --git a/java/org/apache/jasper/util/UniqueAttributesImpl.java b/java/org/apache/jasper/util/UniqueAttributesImpl.java
index 174a94a819..aa809f50ad 100644
--- a/java/org/apache/jasper/util/UniqueAttributesImpl.java
+++ b/java/org/apache/jasper/util/UniqueAttributesImpl.java
@@ -131,14 +131,17 @@ public class UniqueAttributesImpl extends AttributesImpl {
}
private void handleDuplicate(String qName, String value, AttributesImpl store) {
+ // Duplicates are tracked by exact qname, so act on the exact qnames
+ // here too; a differently cased repeat of import or pageEncoding is a
+ // different attribute and follows the ordinary rules below
if (pageDirective) {
- if (IMPORT.equalsIgnoreCase(qName)) {
+ if (IMPORT.equals(qName)) {
// Always merge imports
int i = store.getIndex(IMPORT);
String v = store.getValue(i);
store.setValue(i, v + "," + value);
return;
- } else if (PAGE_ENCODING.equalsIgnoreCase(qName)) {
+ } else if (PAGE_ENCODING.equals(qName)) {
// Page encoding can only occur once per file so a second
// attribute - even one with a duplicate value - is an error
} else {
diff --git a/test/org/apache/jasper/util/TestUniqueAttributesImpl.java b/test/org/apache/jasper/util/TestUniqueAttributesImpl.java
index ea46f43d1b..74f3c35215 100644
--- a/test/org/apache/jasper/util/TestUniqueAttributesImpl.java
+++ b/test/org/apache/jasper/util/TestUniqueAttributesImpl.java
@@ -249,4 +249,25 @@ public class TestUniqueAttributesImpl {
Assert.assertEquals(1, attrs.getLength());
Assert.assertEquals("1", attrs.getValue("foo"));
}
+
+
+ /*
+ * Names are tracked exactly, so a repeated, differently cased import is
+ * not the mergeable page directive import attribute and must be rejected
+ * like any other duplicate name rather than causing an internal error.
+ */
+ @Test
+ public void testDifferentlyCasedImportRepeatRejected() throws Exception {
+ UniqueAttributesImpl attrs = new UniqueAttributesImpl(true);
+
+ attrs.addAttribute("", "Import", "Import", "CDATA", "a");
+
+ try {
+ attrs.addAttribute("", "Import", "Import", "CDATA", "b");
+ Assert.fail("Expected IllegalArgumentException");
+ } catch (IllegalArgumentException e) {
+ // expected
+ }
+ Assert.assertEquals(1, attrs.getLength());
+ }
}
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org