An invalid character[44] was present in the Cookie value - java

When using Tomcat 8
Getting Error :
java.lang.IllegalArgumentException: An invalid character [44] was present in the Cookie value
at org.apache.tomcat.util.http.Rfc6265CookieProcessor.validateCookieValue(Rfc6265CookieProcessor.java:182)
at org.apache.tomcat.util.http.Rfc6265CookieProcessor.generateHeader(Rfc6265CookieProcessor.java:115)
at org.apache.catalina.connector.Response.generateCookieString(Response.java:986)
at org.apache.catalina.connector.Response.addCookie(Response.java:934)
at org.apache.catalina.connector.ResponseFacade.addCookie(ResponseFacade.java:386)

The character 0x44 is comma character and it is not allowed in cookies:
This string is a sequence of characters excluding semi-colon, comma and white space.
The reference comes from here.

I also had the same error in my project with Tomcat 8 and 9. The easiest but less optimal solution was to change to Tomcat 7, but when this version of Tomcat is deprecated or updated on the server I will have to go find all the commas and replace them in the cookie setting.

Related

Java CSVeed library, option for quote inside unquoted field?

I'm benching several Java libraries to parse csv files. I can't find a solution for the CSVeed library with this line :
af,dekh"iykh'ya,Dekh"iykh'ya,13,,34.60345,69.2405
I have this error :
org.csveed.report.CsvException: Illegal state transition:
Parsing symbol QUOTE_SYMBOL [34] in state INSIDE_FIELD
19970: af,dekh
I understand very well what happen unfortunately I tried different blend of options without succeed. Is there a way?
In fact the perfect line of 7 cols should be :
af,dekh\"iykh\'ya,Dekh\"iykh\'ya,13,,34.60345,69.2405
af,dekh"iykh'ya,Dekh"iykh'ya,13,,34.60345,69.2405
To parse this in the following fields you'll have to turn quoting off in your parser:
af
dekh"iykh'ya
Dekh"iykh'ya
13
<null>
34.60345
69.2405
If quoting can not be turned off, you could use setQuote(char symbol) and provide an unused char as parameter.

Getting error .. Unable to parse EL function ${class} [duplicate]

Currenty I have a web project with JSF 1.2 and Facelets running in tomcat 6.0.18.0. I decided to upgrade the servlet container, thus i deployed in tomcat 7 and all seemed ok until we hit one view using my custome facelet functions.
javax.el.ELException: Failed to parse the expression [{pz:instanceof(object,'com.project.domain.MyClass')}]
Caused by: org.apache.el.parser.ParseException: Encountered " ":" ": "" at line 1, column 5. Was expecting one of:
"}" ...
"." ...
"[" ...
This error occurs when parsing the following code:
<ui:repeat var="object" value="#{objects}">
<ui:fragment rendered="#{pz:instanceof(object,'com.project.domain.MyClass')}">
...
If i understand correctly it throws an error because of the colon in the expression . I have tracked it down to the jasper-el that come with in the tomcat/lib directory, and if I replace jasper.jar and jasper-el.jar with the ones from tomcat 6.0.18 everythign works well.
Has anyone else had this problem before upgrading their tomcat? And How did they resolve it?
Could I deploy in production tomcat 7 with these jasper jar from tomcat 6, or could this cause further problems.
This is actually a misleading exception. It has a different underlying cause. The function name instanceof is invalid.
The EL 2.2 specification says the following:
1.14 Reserved Words
The following words are reserved for the language and must not be used as
identifiers.
and eq gt true instanceof
or ne le false empty
not lt ge null div mod
Note that many of these words are not in the language now, but they may be in the
future, so developers must avoid using these words.
and
1.19 Collected Syntax
...
Identifier ::= Java language identifier
...
Where the Java language identifier stands for keywords like instanceof, if, while, class, return, static, new, etc. They may not be used as variable/function names in EL. In case you have properties with those names, use the brace notation instead like so #{bean['class'].simpleName} instead of #{bean.class.simpleName}.
This was been fixed in Tomcat 7.0.4 or somewhere near before this version as indicated by issue 50147 wherein someone else pointed out the same problem as you have. So, to solve your problem, you have to rename your EL function name to for example isInstanceOf or something.
Add this line in catalina.properties ([tomcat folder]/conf), and it should fix the issue.
org.apache.el.parser.SKIP_IDENTIFIER_CHECK=true
However, you should not use the reserved words.
You can also try changing the syntax. I had the same exact problem with code that I was maintaining when we were moving from Tomcat 6 to 7. I had to change myobject.class.name to myobject['class'].name. After I made this change my code worked perfectly again.
Great hint, indeed! I had to change in my jspx ${instance.class.simpleName == ...} with ${instance['class'].simpleName eq ...}.
I was moving from vFabric on tomcat 6 to vFabric on tomcat 7

how to change header length in esapi properties

i am getting below error when i am running my application
WARNING: [SECURITY FAILURE Anonymous:null#unknown -> 127.0.0.1:8080/ExampleApplication/SecurityWrapperResponse] Attempt to set invalid header denied
org.owasp.esapi.errors.ValidationException: setHeader: Invalid input. The maximum length of 20 characters was exceeded.
at org.owasp.esapi.reference.validation.StringValidationRule.checkLength(StringValidationRule.java:214)
at org.owasp.esapi.reference.validation.StringValidationRule.checkLength(StringValidationRule.java:229)
at org.owasp.esapi.reference.validation.StringValidationRule.getValid(StringValidationRule.java:281)
at org.owasp.esapi.reference.DefaultValidator.getValidInput(DefaultValidator.java:214)
at org.owasp.esapi.reference.DefaultValidator.getValidInput(DefaultValidator.java:185)
at org.owasp.esapi.filters.SecurityWrapperResponse.setHeader(SecurityWrapperResponse.java:447)
i have tried by changing below property but it did not work
Validator.HTTPHeaderName=^[a-zA-Z0-9\-_]{1,32}$ have changed 32 to 50 but it is still throwing same error
my header is response.setHeader("Access-Control-Allow-Origin", "*"); it is working when i comment this line, can you please help me how to change header name length in esapi.properties file
Package contained hard coded length values in SecurityWrapperResponse class, so i have solved the problem by overriding the class and changing the new length.
It is working.

Java regex is working in my system but not in the server

The regular expression is
String regex = "^[\\p{IsHangul}\\p{IsDigit}]+";
And whenever i do
text.matches(regex);
It works fine in my system but not in some of the system.
I am not able to track the issue.
Thank you in advance.
Exception:
Exception in thread "main" java.util.regex.PatternSyntaxException: Unknown character property name {Hangul} near index 13
^[\p{IsHangul}\p{IsDigit}]+
^
at java.util.regex.Pattern.error(Pattern.java:1713)
at java.util.regex.Pattern.charPropertyNodeFor(Pattern.java:2437)
at java.util.regex.Pattern.family(Pattern.java:2412)
at java.util.regex.Pattern.range(Pattern.java:2335)
at java.util.regex.Pattern.clazz(Pattern.java:2268)
at java.util.regex.Pattern.sequence(Pattern.java:1818)
at java.util.regex.Pattern.expr(Pattern.java:1752)
at java.util.regex.Pattern.compile(Pattern.java:1460)
at java.util.regex.Pattern.<init>(Pattern.java:1133)
at java.util.regex.Pattern.compile(Pattern.java:823)
at java.util.regex.Pattern.matches(Pattern.java:928)
at java.lang.String.matches(String.java:2090)
at com.mycompany.helper.ApplicationHelper.main(ApplicationHelper.java:200)
According to Using Regular Expressions in Java:
Java 5 fixes some bugs and adds support for Unicode blocks. ...
Make sure you're using Java 5+ in the server.
It seems that Java version you are using is not able to recognise Hangul as correct script character so you can try to create your own character class which will cover same range as Hongul from newer versions of Java.
From what I see in code in source code of Character.UnicodeScript on Java 8 Hangul refers to Unicode ranges
1100..11FF
302E..302F
3131..318F
3200..321F
3260..327E
A960..A97F
AC00..D7FB
FFA0..FFDF
so maybe try with such pattern
Pattern.compile("^["
+ "\u1100-\u11FF"
+ "\u302E-\u302F"
+ "\u3131-\u318F"
+ "\u3200-\u321F"
+ "\u3260-\u327E"
+ "\uA960-\uA97F"
+ "\uAC00-\uD7FB"
+ "\uFFA0-\uFFDF"
+ "\\p{IsDigit}]+");

Unsupport characters in command line file path

I would linke to call java app from PHP:
exec('LC_ALL=en_US.utf-8 java -jar /test.jar' . $filepath . ');
But always there are unsupported characters in the file path.
For example: # & ; ? * [SPACE]..., after change them to # \& ... it will be ok.
But a full list of these characters could not be find.
Any ideas to solve this problem?
Take a look at escapeshellarg() and escapeshellcmd().
They will take care of all necessary sanitation for you.
If $filepath comes from the outside (e.g. from user input), running escapeshellarg() is mandatory to prevent injections.
My problem resolved.
Useful url:
http://bugs.php.net/bug.php?id=44945

Categories

Resources