ResourceUrlEncodingFilter throws StringIndexOutOfBoundsException when %ED%B6 is in the URL path

[mixcloud-downloader]

Affects: 5.1.6

A request with %ED%B6 in the path (e.g. http://example.org/%ED%B6) will fail with a 500 http response code and this exception:

java.lang.StringIndexOutOfBoundsException: begin 0, end -1, length 2
at java.base/java.lang.String.checkBoundsBeginEnd(String.java:3319) ~[na:na]
at java.base/java.lang.String.substring(String.java:1874) ~[na:na]
at org.springframework.web.servlet.resource.ResourceUrlEncodingFilter$ResourceUrlEncodingRequestWrapper.initLookupPath(ResourceUrlEncodingFilter.java:99) ~[spring-webmvc-5.1.6.RELEASE.jar:5.1.6.RELEASE]
at org.springframework.web.servlet.resource.ResourceUrlEncodingFilter$ResourceUrlEncodingRequestWrapper.setAttribute(ResourceUrlEncodingFilter.java:86) ~[spring-webmvc-5.1.6.RELEASE.jar:5.1.6.RELEASE]
at org.springframework.web.servlet.resource.ResourceUrlProviderExposingInterceptor.preHandle(ResourceUrlProviderExposingInterceptor.java:51) ~[spring-webmvc-5.1.6.RELEASE.jar:5.1.6.RELEASE]
at org.springframework.web.servlet.HandlerExecutionChain.applyPreHandle(HandlerExecutionChain.java:136) ~[spring-webmvc-5.1.6.RELEASE.jar:5.1.6.RELEASE]
…

This only happens when having these two dependencies (managed versions by spring-boot-2.1.4.RELEASE) in the pom:

• spring-boot-starter-thymeleaf
• webjars-locator-core

See spring-attic/spring-framework-issues#190 for an example.

Also for context, the complete path was %CE%D2%BA%C3%CF%EB%C4%E3%C8%C3%C8%AB%CA%C0%BD%E7%D6%AA%B5%C0%CE%D2%B0%AE%C4%E3%D0%ED%B6%E0%C4%EA%D2%D4%BA%F3%C0%CB%D7%D3%BB%D8%CD%B7%C5%AE%C8%CB%B5%C4%D1%A1%D4%F1, but it appears that only having %ED%B6 is enough for that bug.

[rstoyanchev]

There is some kind of mismatch between the way UrlPathHelper and the Servlet container decode the given request path. The requestUri decoded by UrlPathHelper is shorter than Servlet path returned by the container resulting in the index exception. We need to prevent the exception but also understand the reason for the mismatch.

[rstoyanchev]

There appears to be an invalid encoded char sequence in the given URL:

2019-05-01 03:36:22.471  WARN 3171 --- [tp1338065644-20] org.eclipse.jetty.util.URIUtil           : /%ED%B6 org.eclipse.jetty.util.Utf8Appendable$NotUtf8Exception: Not valid UTF8! byte B6 in state 0

Servlet containers fall back on different encoding (Jetty falls back on ISO-8859-1 but Tomcat appears to fall back on US ASCII) and so the Servlet path can't be compared to the decoded request URI. I've added an assertion to fail proactively with a more helpful message.