Bug 49081

Summary: EL expression preceded by a # in an attribute value of jsp documents
Product: Tomcat 6 Reporter: Silvio Corciolani <silvio.corciolani>
Component: JasperAssignee: Tomcat Developers Mailing List <dev>
Severity: regression CC: kgeis
Priority: P2    
Version: 6.0.26   
Target Milestone: default   
Hardware: HP   
OS: Windows XP   

Description Silvio Corciolani 2010-04-09 16:50:50 UTC
Behaviour detected in versions 6.0.24 and 6.0.26 of Tomcat. Behaviour not present in version 6.0.20 and previous.

In a jsp document (jspx), version 2.1 or 2.0, when in an attribute value you specify an EL expression with immediate evaluation (${...}) preceded by a # character, the EL expression is treated as a literal.

See this example:

<?xml version="1.0" encoding="UTF-8" ?>
<jsp:root xmlns:jsp="http://java.sun.com/JSP/Page"
  <jsp:output omit-xml-declaration="false" doctype-root-element="html" doctype-public="-//W3C//DTD XHTML 1.0 Strict//EN" doctype-system="http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd" />
  <jsp:directive.page contentType="text/html; charset=UTF-8" session="false" />
    <html xmlns="http://www.w3.org/1999/xhtml" lang="it">
        <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
        <input type="text" value="#${1+1}"/>

The rendered input field contains the text "#${1+1}" (without quotes), while i expected the text "#2" (without quotes): the # character treated as a literal and ${1+1} treated as an eval-expression.
Comment 1 Mark Thomas 2010-04-12 06:18:55 UTC
This has been fixed in trunk and proposed for 6.0.x.

Note that the root cause was a bug in the definition of literals in the EL spec. I have raised a bug against the EL spec for this.
Comment 2 Mark Thomas 2010-05-14 15:13:22 UTC
This has been fixed in 6.0.x and will be included in 6.0.27 onwards.
Comment 3 Ken Geis 2010-06-23 17:57:37 UTC
*** Bug 49495 has been marked as a duplicate of this bug. ***