StringIndexOutOfBoundsException when rewriting links in CSS resources [SPR-16526]

[spring-projects-issues]

Ravish Bhagdev opened SPR-16526 and commented

Scenario,

• CSS with relative paths to PNG files within.
• Happens regardless of versioning strategy used (Fixed and Content)
• Fails for the web service with relatively longer context path when trying to parse URL for PNG with the CSS :

2018-02-22T11:27:31.721017610Z java.lang.StringIndexOutOfBoundsException: String index out of range: -2
2018-02-22T11:27:31.721022567Z  at java.lang.String.substring(String.java:1967) ~[na:1.8.0_161]
2018-02-22T11:27:31.721027608Z  at org.springframework.web.servlet.resource.ResourceUrlProvider.getForRequestUrl(ResourceUrlProvider.java:187) ~[spring-webmvc-4.3.13.RELEASE.jar!/:4.3.13.RELEASE]
2018-02-22T11:27:31.721032196Z  at org.springframework.web.servlet.resource.ResourceTransformerSupport.resolveUrlPath(ResourceTransformerSupport.java:80) ~[spring-webmvc-4.3.13.RELEASE.jar!/:4.3.13.RELEASE]
2018-02-22T11:27:31.721037033Z  at org.springframework.web.servlet.resource.CssLinkResourceTransformer.transform(CssLinkResourceTransformer.java:105) ~[spring-webmvc-4.3.13.RELEASE.jar!/:4.3.13.RELEASE]
2018-02-22T11:27:31.721041105Z  at org.springframework.web.servlet.resource.DefaultResourceTransformerChain.transform(DefaultResourceTransformerChain.java:67) ~[spring-webmvc-4.3.13.RELEASE.jar!/:4.3.13.RELEASE]
2018-02-22T11:27:31.721045190Z  at org.springframework.web.servlet.resource.CachingResourceTransformer.transform(CachingResourceTransformer.java:76) ~[spring-webmvc-4.3.13.RELEASE.jar!/:4.3.13.RELEASE]
2018-02-22T11:27:31.721049282Z  at org.springframework.web.servlet.resource.DefaultResourceTransformerChain.transform(DefaultResourceTransformerChain.java:67) ~[spring-webmvc-4.3.13.RELEASE.jar!/:4.3.13.RELEASE]
2018-02-22T11:27:31.721053655Z  at org.springframework.web.servlet.resource.ResourceHttpRequestHandler.getResource(ResourceHttpRequestHandler.java:538) ~[spring-webmvc-4.3.13.RELEASE.jar!/:4.3.13.RELEASE]
2018-02-22T11:27:31.721058140Z  at org.springframework.web.servlet.resource.ResourceHttpRequestHandler.handleRequest(ResourceHttpRequestHandler.java:433) ~[spring-webmvc-4.3.13.RELEASE.jar!/:4.3.13.RELEASE]
2018-02-22T11:27:31.721063672Z  at org.springframework.web.servlet.mvc.HttpRequestHandlerAdapter.handle(HttpRequestHandlerAdapter.java:51) ~[spring-webmvc-4.3.13.RELEASE.jar!/:4.3.13.RELEASE]
2018-02-22T11:27:31.721068193Z  at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:967) ~[spring-webmvc-4.3.13.RELEASE.jar!/:4.3.13.RELEASE]

It seems like the relative paths to PNG files within my CSS are processed incorrectly. Prefix and suffix generated in ResourceUrlProvider.java on line number 183 and 184 and then incorrect:
int prefixIndex = getLookupPathIndex(request);
int suffixIndex = getEndPathIndex(requestUrl);

Suffix index is often > prefix index. Causing above exception.

Here is my configuration:

VersionResourceResolver versionResourceResolver = new VersionResourceResolver()
.addVersionStrategy(new ContentVersionStrategy(), "/**");

registry.addResourceHandler("/js/**", "/css/**", "/images/**", "/favicon.ico")
        .addResourceLocations(
                "classpath:static/js/", "static/js/",
                "classpath:static/css/", "static/css/",
                "classpath:static/images/", "static/images/"
        )
        .setCachePeriod(CACHE_PERIOD)
        .resourceChain(true)
        .addResolver(versionResourceResolver);

Works fine if I remove versionResourceResolver from above resource handler registry.

There was a similar issue fixed earlier with ResourceUrlEncodingFilter :
#18420

I wonder if this is similar to that but in ResourceUrlProvider? 

 I've now created a sample project and reproduced the exception reported. There is a Readme on this project with steps for testing:
https://github.com/RavBhagdev/sample

Will appreciate any help or advice with this. 

---

Affects: 4.3.13

Reference URL: #18420

Issue Links:

• Regression: ResourceUrlEncodingFilter can throw StringIndexOutOfBoundsException with relative URL [SPR-13847] #18420 Regression: ResourceUrlEncodingFilter can throw StringIndexOutOfBoundsException with relative URL

Referenced from: commits 56fdda1, 6d26e61

Backported to: 4.3.15

[spring-projects-issues]

Brian Clozel commented

Could you at least provide an example of CSS file importing a PNG file, like mentioned in your issue (relative paths as written in those files, and the locations of those files on disk)?

[spring-projects-issues]

Ravish Bhagdev commented

Hey Brian, I've now created a sample project and reproduced the exception reported. There is a Readme on this project with steps for testing:

https://github.com/RavBhagdev/sample

Note that this is a quick and dirty project created with sole purpose of testing above issue, so doesn't have much meat, just a CSS that can be accessed via a URL and spring configurations.

[spring-projects-issues]

Ravish Bhagdev commented

Hi Brian. Did you get a chance to confirm this issue? Just checking if you need me to provide any further details. Thanks.

[spring-projects-issues]

Brian Clozel commented

Hi Ravish Bhagdev, the issue is confirmed.
I just wanted to make sure that you know that the setup demonstrated by that sample can't work properly in the first place.
For example, the following file "http://localhost:8080/project-setup-management/css/screen.css" is referencing absolute URLs which are missing the context path and won't be mapped to the application: "/images/govuk-crest.png".

I'm preparing a fix for the StringIndexOutOfBoundsException that you've noticed, but this won't fix the setup in the sample application.

If you wish to fix your app, you should in my opinion use relative links in the CSS file, like "../images/govuk-crest.png".

[spring-projects-issues]

Ravish Bhagdev commented

That's fine. Thanks Brian . I only provided bare minimum necessary to reproduce the issue.

Hope you noticed in instructions that I suggest switching context in application.properties from project-setup-management to project-setup and see It working.

I assumed it was enough to reproduce the parsing issue at least. I know rest is my problem to deal with.

Appreciate your help in verifying and fixing this!