validation by file upload fails on tomcat 11 (Unable to process parts as no multi-part configuration has been provided)

[tenzap]

When serving the webapp on tomcat11 an trying to run a validation by file upload (or by direct input), it fails like this:

HTTP Status 500 – Internal Server Error

Type Exception Report

Message Unable to process parts as no multi-part configuration has been provided

Description The server encountered an unexpected condition that prevented it from fulfilling the request.

Exception

java.lang.IllegalStateException: Unable to process parts as no multi-part configuration has been provided
	org.apache.catalina.connector.Request.parseParts(Request.java:2440)
	org.apache.catalina.connector.Request.doParseParameters(Request.java:2805)
	org.apache.catalina.connector.Request.parseParameters(Request.java:2763)
	org.apache.catalina.connector.Request.getParameter(Request.java:1065)
	org.apache.catalina.connector.RequestFacade.getParameter(RequestFacade.java:152)
	org.w3c.css.servlet.CssValidator.doPost(CssValidator.java:512)
	jakarta.servlet.http.HttpServlet.service(HttpServlet.java:649)
	jakarta.servlet.http.HttpServlet.service(HttpServlet.java:710)
	org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)

Note The full stack trace of the root cause is available in the server logs.

Apache Tomcat/11.0.6 (Debian)

Suggest fix, although I don't really understand what it means:
https://lists.apache.org/thread/hjoxo22r3tq91wy2sx50fg493typxrdt

However, using allowCasualMultipartParsing="true" on the Context as suggested reveals another error:

Jul 06 14:35:09 debian tomcat11[1393521]: [DEBUG] looks for boundary in
Jul 06 14:35:09 debian tomcat11[1393521]: [multipart/form-data; boundary=---------------------------33444491373505500661090814999]
Jul 06 14:35:09 debian tomcat11[1393521]: [DEBUG] p is [boundary]
Jul 06 14:35:09 debian tomcat11[1393521]: [START OF DATA]
Jul 06 14:35:09 debian tomcat11[1393521]: [END OF DATA]
Jul 06 14:35:09 debian tomcat11[1393521]: boundary : -----------------------------33444491373505500661090814999&10
Jul 06 14:35:09 debian tomcat11[1393521]: &10
Jul 06 14:35:09 debian tomcat11[1393521]: -----------------------------33444491373505500661090814999&10
Jul 06 14:35:09 debian tomcat11[1393521]: &10
Jul 06 14:35:09 debian tomcat11[1393521]: -----------------------------33444491373505500661090814999--
Jul 06 14:35:09 debian tomcat11[1393521]: Oups! Error in Util/Codecs.java?!?
Jul 06 14:35:09 debian tomcat11[1393521]: java.io.IOException: Starting boundary not found: -----------------------------33444491373505500661090814999
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.w3c.css.util.Codecs.mpFormDataDecode(Codecs.java:169)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.w3c.css.util.Codecs.mpFormDataDecode(Codecs.java:165)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.w3c.css.servlet.CssValidator.doPost(CssValidator.java:582)
Jul 06 14:35:09 debian tomcat11[1393521]:         at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:649)
Jul 06 14:35:09 debian tomcat11[1393521]:         at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:710)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:130)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:109)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:167)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:79)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:483)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:116)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:93)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:666)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:396)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:903)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1744)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:637)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:59)
Jul 06 14:35:09 debian tomcat11[1393521]:         at java.base/java.lang.Thread.run(Thread.java:840)
Jul 06 14:35:09 debian tomcat11[1393521]: error: Cannot invoke "String.toLowerCase()" because "text" is null
Jul 06 14:35:09 debian tomcat11[1393521]: [ERROR VALIDATOR] file://localhost/TextArea
Jul 06 14:35:09 debian tomcat11[1393521]: java.lang.NullPointerException
Jul 06 14:35:09 debian tomcat11[1393521]: java.lang.NullPointerException
Jul 06 14:35:09 debian tomcat11[1393521]:         at java.base/java.io.Reader.<init>(Reader.java:168)
Jul 06 14:35:09 debian tomcat11[1393521]:         at java.base/java.io.InputStreamReader.<init>(InputStreamReader.java:112)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.w3c.css.css.StyleSheetParser.parseStyleElement(StyleSheetParser.java:423)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.w3c.css.servlet.CssValidator.doPost(CssValidator.java:726)
Jul 06 14:35:09 debian tomcat11[1393521]:         at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:649)
Jul 06 14:35:09 debian tomcat11[1393521]:         at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:710)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:130)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:109)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:167)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:79)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:483)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:116)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:93)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:666)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:396)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:903)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1744)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:637)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:59)
Jul 06 14:35:09 debian tomcat11[1393521]:         at java.base/java.lang.Thread.run(Thread.java:840)
Jul 06 14:35:09 debian tomcat11[1393521]: java.lang.NullPointerException
Jul 06 14:35:09 debian tomcat11[1393521]:         at java.base/java.io.Reader.<init>(Reader.java:168)
Jul 06 14:35:09 debian tomcat11[1393521]:         at java.base/java.io.InputStreamReader.<init>(InputStreamReader.java:112)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.w3c.css.css.StyleSheetParser.parseStyleElement(StyleSheetParser.java:423)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.w3c.css.servlet.CssValidator.doPost(CssValidator.java:726)
Jul 06 14:35:09 debian tomcat11[1393521]:         at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:649)
Jul 06 14:35:09 debian tomcat11[1393521]:         at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:710)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:130)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:109)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:167)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:79)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:483)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:116)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:93)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:666)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:396)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:903)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1744)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:637)
Jul 06 14:35:09 debian tomcat11[1393521]:         at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:59)
Jul 06 14:35:09 debian tomcat11[1393521]:         at java.base/java.lang.Thread.run(Thread.java:840)

Same error appears on tomcat10 if we set allowCasualMultipartParsing="true"

[ylafon]

Would it be possible to have the exact payload sent in the request?
Thanks

[tenzap]

Can you please explain what that means? Or tell me exactly how to get that? You could also just reproduce yourself with tomcat Installed?

[tenzap]

Apparently, when running the test suite against a css-validator installed on tomcat10 and tomcat11 also leads to ERROR 500.
This error 500 doesn't happen with jetty9, neither with jetty12.
These errors were actually hiding a "Too many request" and are certainly not related to tomcat. Simply the w3.org replied "Too many request".

[tenzap]

To reproduce the issue:

Command:
curl -v --stderr - -F file=@debian/tests/sample.css -F profile=css3svg -F usermedium=all -F warning=1 -F vextwarning= -F lang=en -o /tmp/tmp.vll4KOoKcw http://localhost:8080/css-validator/validator

Input file: https://salsa.debian.org/java-team/css-validator/-/blob/54340c09df659822e4c9d286c0b4d7c4b0cf37d5/debian/tests/sample.css

[tenzap]

@ylafon , gentle ping on this issue. Maybe you would have a better fix than #492 and that would work with both w3c jigsaw (which is still stuck at servlet api < 3) and recent servers (eg. tomcat11).