IllegalArgumentException parsing several Accept header variations [SPR-9693]

[spring-projects-issues]

Dan Checkoway opened SPR-9693 and commented

Attached is a file containing several variations of Accept header values that cause Spring to break. There was a prior ticket open for this, which dealt with single-quoted "profile" URLs in Accept headers. That is apparently fixed in 3.2. But these other variations are still broken. The test cases attached are all actual Accept headers we have seen "in the wild" coming from mobile devices.

Here are some examples of the types of exceptions we're seeing:

java.lang.IllegalArgumentException: 'mediaType' must not be empty
        at org.springframework.util.Assert.hasLength(Assert.java:136)
        at org.springframework.http.MediaType.parseMediaType(MediaType.java:638)
        at org.springframework.http.MediaType.parseMediaTypes(MediaType.java:691)
        at org.springframework.web.servlet.mvc.condition.ProducesRequestCondition.getAcceptedMediaTypes(ProducesRequestCondition.java:214)
        at org.springframework.web.servlet.mvc.condition.ProducesRequestCondition.access$4(ProducesRequestCondition.java:211)
        at org.springframework.web.servlet.mvc.condition.ProducesRequestCondition$ProduceMediaTypeExpression.matchMediaType(ProducesRequestCondition.java:283)
        at org.springframework.web.servlet.mvc.condition.AbstractMediaTypeExpression.match(AbstractMediaTypeExpression.java:63)
        at org.springframework.web.servlet.mvc.condition.ProducesRequestCondition.getMatchingCondition(ProducesRequestCondition.java:163)
        at org.springframework.web.servlet.mvc.method.RequestMappingInfo.getMatchingCondition(RequestMappingInfo.java:175)
        at org.springframework.web.servlet.mvc.method.RequestMappingInfoHandlerMapping.getMatchingMapping(RequestMappingInfoHandlerMapping.java:64)
        at org.springframework.web.servlet.mvc.method.RequestMappingInfoHandlerMapping.getMatchingMapping(RequestMappingInfoHandlerMapping.java:1)
        at org.springframework.web.servlet.handler.AbstractHandlerMethodMapping.addMatchingMappings(AbstractHandlerMethodMapping.java:284)
        at org.springframework.web.servlet.handler.AbstractHandlerMethodMapping.lookupHandlerMethod(AbstractHandlerMethodMapping.java:251)
        at org.springframework.web.servlet.handler.AbstractHandlerMethodMapping.getHandlerInternal(AbstractHandlerMethodMapping.java:216)
        at org.springframework.web.servlet.handler.AbstractHandlerMethodMapping.getHandlerInternal(AbstractHandlerMethodMapping.java:1)
        at org.springframework.web.servlet.handler.AbstractHandlerMapping.getHandler(AbstractHandlerMapping.java:288)
        at org.springframework.web.servlet.DispatcherServlet.getHandler(DispatcherServlet.java:1063)
        at org.springframework.web.servlet.DispatcherServlet.getHandler(DispatcherServlet.java:1048)
        at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:886)
        at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:852)
        at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:882)
        at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:778)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:621)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:722)

Or...

java.lang.IllegalArgumentException: ";q=0.5" does not contain '/'
        at org.springframework.http.MediaType.parseMediaType(MediaType.java:648)
        at org.springframework.http.MediaType.parseMediaTypes(MediaType.java:691)
        at org.springframework.web.servlet.mvc.condition.ProducesRequestCondition.getAcceptedMediaTypes(ProducesRequestCondition.java:214)
        at org.springframework.web.servlet.mvc.condition.ProducesRequestCondition.access$4(ProducesRequestCondition.java:211)
        at org.springframework.web.servlet.mvc.condition.ProducesRequestCondition$ProduceMediaTypeExpression.matchMediaType(ProducesRequestCondition.java:283)
...

---

Affects: 3.1.1

Attachments:

• accept-header-test-cases.txt (6.45 kB)

Issue Links:

• Invalid MIME-type causes a 500 error [SPR-9142] #13781 Invalid MIME-type causes a 500 error

0 votes, 5 watchers

[spring-projects-issues]

Dan Checkoway commented

Updated test cases attached (we keep finding more variations that break Spring's parser).

[spring-projects-issues]

Dan Checkoway commented

Yet another variation...some d-bag device is passing us a chunk of a User-Agent in their Accept header. We can blame the device or browser, but hey, Spring barfs and it probably shouldn't:

Accept: text/xml, text/html, application/xhtml+xml, i Mozilla/5.0 (Linux; U; Android 2.3.6; ru-rumage/png, text/plain, */*;q=0.8

[spring-projects-issues]

Rossen Stoyanchev commented

In 3.2 any invalid Content-Type or Accept header should result in a "no match" or a 406 in the case of the Accept header. See #13781 and the corresponding fix. You mentioned 3.2, have you tried the above cases with 3.2 already?

[spring-projects-issues]

Dan Checkoway commented

I haven't tried 3.2 yet since it hasn't officially been released yet. I'll try these test cases against 3.2.0.M1 and will report back...but fwiw, we generally don't run snapshots or milestones in our production environment. Any hints on when 3.2.0.RELEASE slated to be out?

[spring-projects-issues]

Rossen Stoyanchev commented

I'm pretty sure it's fixed in 3.2. Here is the test case for #13781. Essentially we catch any parse error and treat it the same. I did try a few of the test cases you attached and the test passed.

I'll create a task to backport this issue into the next 3.1.x maintenance release.

[spring-projects-issues]

Rossen Stoyanchev commented

Better yet looks like it was already backported to 3.1.2 (see #13786). So just upgrade to 3.1.2.

[spring-projects-issues]

Dan Checkoway commented

FWIW, I tested my cases against both 3.2.0.M1 and 3.1.2.RELEASE, and all the tests passed (no more IllegalArgumentException).

We'll go with 3.1.2.RELEASE in our production environment...thanks!

[spring-projects-issues]

Rossen Stoyanchev commented

Ok, thanks for confirming that.

[spring-projects-issues]

nithin reddy commented

I am recevign this error when passing a wrong header in the request. I am doing this wantedly as part of the negative testing and wanted to handle this gracefully instead of throwing java.lang.IllegalArgumentException: "01" does not contain '/'. I have upgraded to <spring.version>3.1.2.RELEASE</spring.version> in maven but still I am getting it. Is this fixed in 3.1.2 or not?

[spring-projects-issues]

nithin reddy commented

Adding the stack trace
java.lang.IllegalArgumentException: "nithin" does not contain '/'
at org.springframework.http.MediaType.parseMediaType(MediaType.java:676) ~[spring-web-3.1.2.RELEASE.jar:3.1.2.RELEASE]
at org.springframework.http.MediaType.parseMediaTypes(MediaType.java:719) ~[spring-web-3.1.2.RELEASE.jar:3.1.2.RELEASE]
at org.springframework.http.HttpHeaders.getAccept(HttpHeaders.java:149) ~[spring-web-3.1.2.RELEASE.jar:3.1.2.RELEASE]
at org.springframework.web.servlet.mvc.annotation.AnnotationMethodHandlerAdapter$ServletHandlerMethodInvoker.writeWithMessageConverters(AnnotationMethodHandlerAdapter.java:1020) ~[spring-webmvc-3.1.2.RELEASE.jar:3.1.2.RELEASE]
at org.springframework.web.servlet.mvc.annotation.AnnotationMethodHandlerAdapter$ServletHandlerMethodInvoker.handleHttpEntityResponse(AnnotationMethodHandlerAdapter.java:1008) ~[spring-webmvc-3.1.2.RELEASE.jar:3.1.2.RELEASE]
at org.springframework.web.servlet.mvc.annotation.AnnotationMethodHandlerAdapter$ServletHandlerMethodInvoker.getModelAndView(AnnotationMethodHandlerAdapter.java:934) ~[spring-webmvc-3.1.2.RELEASE.jar:3.1.2.RELEASE]
at org.springframework.web.servlet.mvc.annotation.AnnotationMethodHandlerAdapter.invokeHandlerMethod(AnnotationMethodHandlerAdapter.java:438) ~[spring-webmvc-3.1.2.RELEASE.jar:3.1.2.RELEASE]
at org.springframework.web.servlet.mvc.annotation.AnnotationMethodHandlerAdapter.handle(AnnotationMethodHandlerAdapter.java:424) ~[spring-webmvc-3.1.2.RELEASE.jar:3.1.2.RELEASE]
at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:923) ~[spring-webmvc-3.1.2.RELEASE.jar:3.1.2.RELEASE]
at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:852) ~[spring-webmvc-3.1.2.RELEASE.jar:3.1.2.RELEASE]
at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:882) [spring-webmvc-3.1.2.RELEASE.jar:3.1.2.RELEASE]
at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:778) [spring-webmvc-3.1.2.RELEASE.jar:3.1.2.RELEASE]
at javax.servlet.http.HttpServlet.service(HttpServlet.java:617) [servlet-api.jar:na]
at javax.servlet.http.HttpServlet.service(HttpServlet.java:717) [servlet-api.jar:na]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) [catalina.jar:6.0.35]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.35]
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233) [catalina.jar:6.0.35]
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) [catalina.jar:6.0.35]
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:470) [catalina.jar:6.0.35]
at org.apache.catalina.valves.RequestFilterValve.process(RequestFilterValve.java:316) [catalina.jar:6.0.35]
at org.apache.catalina.valves.RemoteHostValve.invoke(RemoteHostValve.java:81) [catalina.jar:6.0.35]
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127) [catalina.jar:6.0.35]
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) [catalina.jar:6.0.35]
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) [catalina.jar:6.0.35]
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293) [catalina.jar:6.0.35]
at org.apache.coyote.http11.Http11AprProcessor.process(Http11AprProcessor.java:877) [tomcat-coyote.jar:6.0.35]
at org.apache.coyote.http11.Http11AprProtocol$Http11ConnectionHandler.process(Http11AprProtocol.java:594) [tomcat-coyote.jar:6.0.35]
at org.apache.tomcat.util.net.AprEndpoint$Worker.run(AprEndpoint.java:1675) [tomcat-coyote.jar:6.0.35]

[spring-projects-issues]

Barbara Rosi-Schwartz commented

nithin,

did you find an answer to your question? I am having a similar issue. Thanks.