Project: Tomcat
Bug 44391 SSI handling of escaped characters broken
Reported: 2008-02-11 04:37:40 | Status: resolved fixed

In org.apache.catalina.ssi.SSIProcessor the method parseParamNames is broken. If I have a SSI directive like <!--#set var="test" value="blubb\"\"" --> the method detects three parameters instead of two. This is because there are two consecutive escaped characters. Although the first one \" is detected correctly the next one isn't because the flag escaped is still set to true, although this character isn't escaped anymore. You have to replace boolean escaped = false; for (; bIdx < cmd.length() && quotes != 2; bIdx++) { char c = cmd.charAt(bIdx); // Need to skip escaped characters if (c == '\\' && !escaped) { escaped = true; bIdx++; continue; } escaped = false; if (c == '"') quotes++; } by for (; bIdx < cmd.length() && quotes != 2; bIdx++) { char c = cmd.charAt(bIdx); // Need to skip escaped characters if (c == '\\') { bIdx++; continue; } if (c == '"') quotes++; } Just removing the flag escaped is sufficient, because you don't have to remember whether the last character was escaped and that should have no influence to consecutive characters. The bug still exists in the HEAD revision of the repository.

Files changed in fix:
java/org/apache/catalina/ssi/SSIProcessor.java