[jetty-dev] [jira] (JETTY-1541) ArrayIndexOutOfBoundsException with AJP

Rob Winch
edited a comment on JETTY-1541

ArrayIndexOutOfBoundsException with AJP

The problem is that Jetty's HttpOutput/Ajp13Generator treats a invocation of ServletOutputStream.write(byte[] b, int off, int len) differently than ServletOutputStream.write(byte b). You can see this with the sample project I have attached. To reproduce the problem setup Jetty with AJP and visit the index page (i.e. http://localhost/JETTY-1541/ ). There will be two links on the index page. The first link demonstrates that write(byte[] b, int off, int len) works properly using the WorksServlet . The second link demonstrates that write(byte b) fails using the FailsServlet . As you can see the FailsServlet fails with the same error you are seeing in your application, yet there are no Spring or Spring Security dependencies. Try again over HTTP (i.e. directly against Jetty) and both links work properly.

So why does removing Spring Security 3.1.2 cause the issue? This is because Spring Security is overriding the ServletOutputStream which delegates to the original stream. However, rather than overriding all the methods of ServletOutputStream Spring Security is only overriding the abstract methods and delegating to the original ServletOutputStream. This means that when write(byte[] b, int off, int len) is invoked, Spring Security implements that by invoking ServletOutputStream.write(byte b) on the original ServletOutputStream implementation. This conversion is how the JDK implements ServletOutputStream. As the project I have attached demonstrates, the write(byte b) method is broken when using Jetty's AJP support. Spring Security is just revealing this existing issue in Jetty.

This message is automatically generated by JIRA.

If you think it was sent incorrectly, please contact your JIRA administrators .

For more information on JIRA, see: http://www.atlassian.com/software/jira

---------------------------------------------------------------------
To unsubscribe from this list, please visit:

http://xircles.codehaus.org/manage_email