Bug 52666

Summary: EL should coerce String to Integer in equals operation
Product: Tomcat 6 Reporter: Konstantin Kolinko <knst.kolinko>
Component: JasperAssignee: Tomcat Developers Mailing List <dev>
Status: RESOLVED FIXED    
Severity: normal CC: drees76
Priority: P2    
Version: 6.0.35   
Target Milestone: default   
Hardware: PC   
OS: Windows XP   

Description Konstantin Kolinko 2012-02-14 12:55:34 UTC
This issue was reported on the users@ list, thread:
"EL String -> int coercion stopped working after TC 5.5 -> 7.0 upgrade?"

http://tomcat.markmail.org/thread/a7l45meiakblxcvz
http://marc.info/?t=132918931400002&r=1&w=2

Original reporter used <c:out> tag, but it is not necessary to reproduce the issue.

The issue is reproducible in current 7.0 and 6.0. It works correctly in 5.5.35.

To reproduce,
1. save the following JSP page as ROOT/test.jsp
[[[
${param['foo'] == 1}<br>
${1 == param['foo']}<br>
${1 == (0+param['foo'])}<br>
]]]

2. go to http://localhost:8080/test.jsp?foo=01

Expected result:
true
true
true

Actual result:
false
false
true

This happens for foo=01, 001 etc. The equals result happens only when foo=1


According to EL 2.2 specification chapter 1.8.2 the ==,!= operators have the following step: "If A or B is Byte, Short, Character, Integer, or Long coerce both A and B to Long, apply operator". This step should happen earlier than coercion to String.
Comment 1 Mark Thomas 2012-02-15 17:13:27 UTC
Fixed in trunk and 7.0.x and will be included in 7.0.26 onwards.

the fix has been proposed for 6.0.x.
Comment 2 Mark Thomas 2012-02-17 18:06:15 UTC
Fixed in 6.0.x and will be included in 6.0.36 onwards.