This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/9.0.x by this push:
new 49b98db1cb Follow-up to bad types in JspRuntime fix
49b98db1cb is described below
commit 49b98db1cb33fdfd65b6d030e0f4867fc4244e6c
Author: Mark Thomas <[email protected]>
AuthorDate: Mon Jun 1 21:20:40 2026 +0100
Follow-up to bad types in JspRuntime fix
An array created as Object[] cannot be cast to a different array type so
the array needs to be created using the correct type.
Fix the same issue in AstValue
---
java/org/apache/el/parser/AstValue.java | 106 ++++++++++++++++++++-
.../apache/jasper/runtime/JspRuntimeLibrary.java | 7 +-
2 files changed, 106 insertions(+), 7 deletions(-)
diff --git a/java/org/apache/el/parser/AstValue.java
b/java/org/apache/el/parser/AstValue.java
index c67315cc91..ba7c9b512a 100644
--- a/java/org/apache/el/parser/AstValue.java
+++ b/java/org/apache/el/parser/AstValue.java
@@ -290,11 +290,109 @@ public final class AstValue extends SimpleNode {
if (m.isVarArgs()) {
Class<?> varArgType = m.getParameterTypes()[paramCount -
1].getComponentType();
- Object[] varArgs = (Object[]) Array.newInstance(varArgType,
src.length - (paramCount - 1));
- for (int i = 0; i < src.length - (paramCount - 1); i++) {
- varArgs[i] = ELSupport.coerceToType(ctx, src[paramCount - 1 +
i], varArgType);
+ if (varArgType.equals(Integer.class)) {
+ Integer[] varArgs = new Integer[src.length - (paramCount - 1)];
+ for (int i = 0; i < src.length - (paramCount - 1); i++) {
+ varArgs[i] = (Integer) ELSupport.coerceToType(ctx,
src[paramCount - 1 + i], Integer.class);
+ }
+ dest[paramCount - 1] = varArgs;
+ } else if (varArgType.equals(Byte.class)) {
+ Byte[] varArgs = new Byte[src.length - (paramCount - 1)];
+ for (int i = 0; i < src.length - (paramCount - 1); i++) {
+ varArgs[i] = (Byte) ELSupport.coerceToType(ctx,
src[paramCount - 1 + i], Byte.class);
+ }
+ dest[paramCount - 1] = varArgs;
+ } else if (varArgType.equals(Boolean.class)) {
+ Boolean[] varArgs = new Boolean[src.length - (paramCount - 1)];
+ for (int i = 0; i < src.length - (paramCount - 1); i++) {
+ varArgs[i] = (Boolean) ELSupport.coerceToType(ctx,
src[paramCount - 1 + i], Boolean.class);
+ }
+ dest[paramCount - 1] = varArgs;
+ } else if (varArgType.equals(Short.class)) {
+ Short[] varArgs = new Short[src.length - (paramCount - 1)];
+ for (int i = 0; i < src.length - (paramCount - 1); i++) {
+ varArgs[i] = (Short) ELSupport.coerceToType(ctx,
src[paramCount - 1 + i], Short.class);
+ }
+ dest[paramCount - 1] = varArgs;
+ } else if (varArgType.equals(Long.class)) {
+ Long[] varArgs = new Long[src.length - (paramCount - 1)];
+ for (int i = 0; i < src.length - (paramCount - 1); i++) {
+ varArgs[i] = (Long) ELSupport.coerceToType(ctx,
src[paramCount - 1 + i], Long.class);
+ }
+ dest[paramCount - 1] = varArgs;
+ } else if (varArgType.equals(Double.class)) {
+ Double[] varArgs = new Double[src.length - (paramCount - 1)];
+ for (int i = 0; i < src.length - (paramCount - 1); i++) {
+ varArgs[i] = (Double) ELSupport.coerceToType(ctx,
src[paramCount - 1 + i], Double.class);
+ }
+ dest[paramCount - 1] = varArgs;
+ } else if (varArgType.equals(Float.class)) {
+ Float[] varArgs = new Float[src.length - (paramCount - 1)];
+ for (int i = 0; i < src.length - (paramCount - 1); i++) {
+ varArgs[i] = (Float) ELSupport.coerceToType(ctx,
src[paramCount - 1 + i], Float.class);
+ }
+ dest[paramCount - 1] = varArgs;
+ } else if (varArgType.equals(Character.class)) {
+ Character[] varArgs = new Character[src.length - (paramCount -
1)];
+ for (int i = 0; i < src.length - (paramCount - 1); i++) {
+ varArgs[i] = (Character) ELSupport.coerceToType(ctx,
src[paramCount - 1 + i], Character.class);
+ }
+ dest[paramCount - 1] = varArgs;
+ } else if (varArgType.equals(int.class)) {
+ int[] varArgs = new int[src.length - (paramCount - 1)];
+ for (int i = 0; i < src.length - (paramCount - 1); i++) {
+ varArgs[i] = ((Integer) ELSupport.coerceToType(ctx,
src[paramCount - 1 + i], int.class)).intValue();
+ }
+ dest[paramCount - 1] = varArgs;
+ } else if (varArgType.equals(byte.class)) {
+ byte[] varArgs = new byte[src.length - (paramCount - 1)];
+ for (int i = 0; i < src.length - (paramCount - 1); i++) {
+ varArgs[i] = ((Integer) ELSupport.coerceToType(ctx,
src[paramCount - 1 + i], byte.class)).byteValue();
+ }
+ dest[paramCount - 1] = varArgs;
+ } else if (varArgType.equals(boolean.class)) {
+ boolean[] varArgs = new boolean[src.length - (paramCount - 1)];
+ for (int i = 0; i < src.length - (paramCount - 1); i++) {
+ varArgs[i] = ((Boolean) ELSupport.coerceToType(ctx,
src[paramCount - 1 + i], boolean.class)).booleanValue();
+ }
+ dest[paramCount - 1] = varArgs;
+ } else if (varArgType.equals(short.class)) {
+ short[] varArgs = new short[src.length - (paramCount - 1)];
+ for (int i = 0; i < src.length - (paramCount - 1); i++) {
+ varArgs[i] = ((Integer) ELSupport.coerceToType(ctx,
src[paramCount - 1 + i], short.class)).shortValue();
+ }
+ dest[paramCount - 1] = varArgs;
+ } else if (varArgType.equals(long.class)) {
+ long[] varArgs = new long[src.length - (paramCount - 1)];
+ for (int i = 0; i < src.length - (paramCount - 1); i++) {
+ varArgs[i] = ((Integer) ELSupport.coerceToType(ctx,
src[paramCount - 1 + i], long.class)).longValue();
+ }
+ dest[paramCount - 1] = varArgs;
+ } else if (varArgType.equals(double.class)) {
+ double[] varArgs = new double[src.length - (paramCount - 1)];
+ for (int i = 0; i < src.length - (paramCount - 1); i++) {
+ varArgs[i] = ((Integer) ELSupport.coerceToType(ctx,
src[paramCount - 1 + i], double.class)).doubleValue();
+ }
+ dest[paramCount - 1] = varArgs;
+ } else if (varArgType.equals(float.class)) {
+ float[] varArgs = new float[src.length - (paramCount - 1)];
+ for (int i = 0; i < src.length - (paramCount - 1); i++) {
+ varArgs[i] = ((Integer) ELSupport.coerceToType(ctx,
src[paramCount - 1 + i], float.class)).floatValue();
+ }
+ dest[paramCount - 1] = varArgs;
+ } else if (varArgType.equals(char.class)) {
+ char[] varArgs = new char[src.length - (paramCount - 1)];
+ for (int i = 0; i < src.length - (paramCount - 1); i++) {
+ varArgs[i] = ((Character) ELSupport.coerceToType(ctx,
src[paramCount - 1 + i], char.class)).charValue();
+ }
+ dest[paramCount - 1] = varArgs;
+ } else {
+ Object[] varArgs = (Object[]) Array.newInstance(varArgType,
src.length - (paramCount - 1));
+ for (int i = 0; i < src.length - (paramCount - 1); i++) {
+ varArgs[i] = ELSupport.coerceToType(ctx, src[paramCount -
1 + i], varArgType);
+ }
+ dest[paramCount - 1] = varArgs;
}
- dest[paramCount - 1] = varArgs;
} else {
dest[paramCount - 1] = ELSupport.coerceToType(ctx, src[paramCount
- 1], types[paramCount - 1]);
}
diff --git a/java/org/apache/jasper/runtime/JspRuntimeLibrary.java
b/java/org/apache/jasper/runtime/JspRuntimeLibrary.java
index 26b358d2f8..0dcc368b06 100644
--- a/java/org/apache/jasper/runtime/JspRuntimeLibrary.java
+++ b/java/org/apache/jasper/runtime/JspRuntimeLibrary.java
@@ -20,6 +20,7 @@ import java.beans.PropertyEditor;
import java.beans.PropertyEditorManager;
import java.io.IOException;
import java.io.UnsupportedEncodingException;
+import java.lang.reflect.Array;
import java.lang.reflect.Method;
import java.net.URLEncoder;
import java.util.Enumeration;
@@ -566,9 +567,9 @@ public class JspRuntimeLibrary {
try {
if (propertyEditorClass != null) {
- Object[] tmpval = new Object[values.length];
+ Object tmpval = Array.newInstance(t, values.length);
for (int i = 0; i < values.length; i++) {
- tmpval[i] = getValueFromBeanInfoPropertyEditor(t,
propertyName, values[i], propertyEditorClass);
+ Array.set(tmpval, i, getValueFromBeanInfoPropertyEditor(t,
propertyName, values[i], propertyEditorClass));
}
method.invoke(bean, new Object[] { tmpval });
} else if (t.equals(Integer.class)) {
@@ -668,7 +669,7 @@ public class JspRuntimeLibrary {
}
method.invoke(bean, new Object[] { tmpval });
} else {
- Object[] tmpval = new Object[values.length];
+ Object[] tmpval = (Object[]) Array.newInstance(t,
values.length);
for (int i = 0; i < values.length; i++) {
tmpval[i] = getValueFromPropertyEditorManager(t,
propertyName, values[i]);
}
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
