Bug 60413

Summary: RewriteValve: empty capturing group results in null backreference instead of "" (empty string)
Product: Tomcat 8 Reporter: Michael Osipov <michaelo>
Component: CatalinaAssignee: Tomcat Developers Mailing List <dev>
Severity: major    
Priority: P2    
Version: 8.5.x-trunk   
Target Milestone: ----   
Hardware: All   
OS: All   
Attachments: Avoid null return values

Description Michael Osipov 2016-11-24 09:47:21 UTC
Created attachment 34474 [details]
Avoid null return values

Consider this rule:
RewriteRule ^/docs(/rest)?$ /docs$1/ [redirect=307,L]

A GET on http://localhost:8080/app/docs redirects to http://localhost:8080/tedab-services-webapp/docsnull/

The reason is m.group(n) returns a null when the capturing group is not present. Worse than that, this null value is passed to ENCODER.encode() which may result in a NPE.

Attached is a patched which resolves the issue by returning empty strings on null. Feel free to improve the patch.
Comment 1 Mark Thomas 2016-11-28 14:06:44 UTC
Thanks for the report and the patch.

Fixed in:
- trunk for 9.0.0.M14 onwards
- 8.5.x for 8.5.9 onwards
- 8.0.x for 8.0.40 onwards

The patch was applied with the addition of a simple test case.