Problem with parsing of form parameters without values in Jetty 12?

[gormpaulsen]

Jetty version(s)
12.0.5

Jetty Environment
ee10

Java version/vendor (use: java -version)

openjdk version "21.0.1" 2023-10-17 LTS
OpenJDK Runtime Environment Temurin-21.0.1+12 (build 21.0.1+12-LTS)
OpenJDK 64-Bit Server VM Temurin-21.0.1+12 (build 21.0.1+12-LTS, mixed mode)

OS type/version
macOS Sonoma 14.2.1

Description

POST-ing a form which contains parameters without values causes the request.getParameterNames() to return wrong values for parameter names.

How to reproduce?

I have this simple servlet running with jetty-ee10-maven-plugin
and Jetty 12.0.5:

package test;

import java.io.IOException;
import java.io.PrintWriter;
import java.util.Enumeration;
import jakarta.servlet.ServletException;
import jakarta.servlet.annotation.WebServlet;
import jakarta.servlet.http.HttpServlet;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;

@WebServlet(value="/", name="helloWorldServlet")
public class HelloWorldServlet extends HttpServlet {

    @Override
    protected void service(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        resp.setStatus(200);
        resp.setHeader("Content-Type", "text/plain;charset=utf-8");
        
        try (PrintWriter writer = resp.getWriter()) {
            writer.write("Method: " + req.getMethod() + "\n");
            writer.write("Parameters:\n");
            Enumeration<String> names = req.getParameterNames();
            while (names.hasMoreElements()) {
                String name = names.nextElement();
                writer.write("   " + name + " = '" + req.getParameter(name) + "'\n");
            }
        }
    }
}

When I try this with curl, I get the following output:

> curl -X POST 'http://localhost:8080/?param0=value0&param1' -d 'param2&param3=value3&param4=value4&param5'
Method: POST
Parameters:
   param0 = 'value0'
   param1 = ''
   param2&param3 = 'value3'
   param4 = 'value4'

The parameters supplied in the query string (param0, param1) seem
OK, however there is something strange with the parsing of the form
parameters in the request body (param2&param3 should be separated,
param5 is missing).

This is the output when running the same curl command with the same servlet (only modified to use javax.servlet) running under Jetty 9:

Method: POST
Parameters:
   param5 = ''
   param0 = 'value0'
   param3 = 'value3'
   param4 = 'value4'
   param1 = ''
   param2 = ''

[sbordet]

Your query string is pretty wrong, as query parameter values must be encoded.

We'll fix the parsing error, but likely we should reject such bad query strings entirely.

[sbordet]

Doh, completely misread the single quotes in your example.
I'll try to reproduce.

[joakime]

Ah, the old application/x-www-form-urlencoded parsing of blank values issue.

Did you know that the behavior of how to parse blank values is not specified in any spec around application/x-www-form-urlencoded (ietf, w3c, servlet, etc)?

In fact, many languages and libs default to excluding blank values.
You often have to do extra work to get the blank values to be seen.

[sbordet]

@joakime the parser was broken, it's more than just blank values.

PR #11255 should fix this issue.

[gregw]

@sbordet does this need to be back ported to 10 and 11?