Bug 54801 - EL-like expressions in jsp:scriptlet break compilation of JSP XML documents
Summary: EL-like expressions in jsp:scriptlet break compilation of JSP XML documents
Alias: None
Product: Tomcat 7
Classification: Unclassified
Component: Jasper (show other bugs)
Version: 7.0.39
Hardware: PC Windows XP
: P2 normal (vote)
Target Milestone: ---
Assignee: Tomcat Developers Mailing List
Depends on:
Reported: 2013-04-04 22:24 UTC by Konstantin Kolinko
Modified: 2013-04-25 13:21 UTC (History)
0 users

helloWorld.tagx (1018 bytes, text/plain)
2013-04-04 22:24 UTC, Konstantin Kolinko
Stacktrace (current 7.0 = 7.0.39) (5.14 KB, text/plain)
2013-04-04 22:27 UTC, Konstantin Kolinko
2013-04-10_tc8_54801_1.patch (960 bytes, patch)
2013-04-09 22:19 UTC, Konstantin Kolinko
Details | Diff
page1.jspx (1018 bytes, text/plain)
2013-04-09 22:34 UTC, Konstantin Kolinko
page2.jspx (1004 bytes, text/plain)
2013-04-09 22:35 UTC, Konstantin Kolinko

Note You need to log in before you can comment on or make changes to this bug.
Description Konstantin Kolinko 2013-04-04 22:24:00 UTC
Created attachment 30152 [details]

Steps to reproduce:

1. Go to  webapps\examples\WEB-INF\tags\
2. Delete "helloWorld.tag" file and put there "helloWorld.tagx" file attached to this issue.
The file contains the following plus AL header:

<?xml version="1.0" encoding="utf-8" ?>
<jsp:root xmlns:jsp="http://java.sun.com/JSP/Page" version="2.0">
  // ${foo}
  out.println("Hello, world!!");

3. Start Tomcat and try to open the following page in a browser:

ACTUAL result:
in current TC8 trunk:
org.xml.sax.SAXException: Body of scriptlet element must not contain any XML elements

This behaviour is caused by "${foo}" being present inside the scriptlet. If I remove that line, the page is displayed successfully.

I think EL expressions should not be recognized inside of jsp:scriptlet, jsp:declaration or jsp:expression and should not trigger such an error.

As a confirmation, the following "helloWorld.tag" in JSP syntax compiles and executes successfully. Thus this issue is with XML syntax only,

  // ${foo}
Hello, world!++

Alternative solution could be to change the error message, but I think it is not the issue here,
s/ any XML elements / any XML elements or EL expressions/
Comment 1 Konstantin Kolinko 2013-04-04 22:27:18 UTC
Created attachment 30153 [details]
Stacktrace (current 7.0 = 7.0.39)
Comment 2 Konstantin Kolinko 2013-04-09 22:19:03 UTC
Created attachment 30167 [details]

1. The JSP 2.2 specification chapter JSP.1.11 EL Elements says:

"EL expressions can appear in template data and in attribute values."

I deduce that they cannot appear in scripting elements and thus trying to parse them there is a bug.

Scripting elements are represented in Jasper by abstract Node.ScriptingElement class. Its non-abstract derived classes are:  Declaration, Expression, Scriptlet.

2. Parsing of EL here is performed in JspDocumentParser#processChars()

I am attaching patch that fixes processing for scripting elements in processChars().

3. It is strange that processChars() does EL parsing regardless of pageInfo.isELIgnored(). I suspect that it is a bug.

The code in the patch is the same as in "if (tagDependentNesting > 0)" block there, so the two could be merged, and be also used to fix the "isELIgnored" case.

There are no testcases in the patch yet.
Comment 3 Konstantin Kolinko 2013-04-09 22:34:45 UTC
Created attachment 30168 [details]
Comment 4 Konstantin Kolinko 2013-04-09 22:35:14 UTC
Created attachment 30169 [details]
Comment 5 Konstantin Kolinko 2013-04-09 22:47:18 UTC
> helloWorld.tagx

This issue is not specific to tag files and is reproducible with JSP documents as well. I attached "page1.jspx" and "page2.jspx" that reproduce this.

I am changing TITLE of this issue accordingly.

Presence of "CDATA" block is not important.

(In reply to comment #2)
> 3. It is strange that processChars() does EL parsing regardless of
> pageInfo.isELIgnored(). I suspect that it is a bug.

Confirmed as a bug. I filed it separately as bug 54821.
Comment 6 Mark Thomas 2013-04-25 13:21:14 UTC
Fixed in trunk and will be included in 7.0.40 onwards.
I turned the example JSP documents into unit tests.