[
https://issues.apache.org/jira/browse/CAMEL-24101?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18096810#comment-18096810
]
Claus Ibsen commented on CAMEL-24101:
-------------------------------------
Fixed via https://github.com/apache/camel/pull/24762
> camel-bean: OGNL list index equal to list size escapes bounds handling - raw
> IndexOutOfBoundsException and broken null-safe
> ---------------------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24101
> URL: https://issues.apache.org/jira/browse/CAMEL-24101
> Project: Camel
> Issue Type: Bug
> Components: camel-bean
> Affects Versions: 4.21.0
> Reporter: Federico Mariani
> Assignee: Claus Ibsen
> Priority: Major
> Fix For: 4.22.0
>
> Attachments: BeanOgnlListIndexOutOfBoundsTest.java
>
>
> In {{BeanExpression.lookupResult}} the list bounds check is off by one:
> {code:java}
> if (num != null && num >= 0 && !list.isEmpty() && list.size() > num - 1) {
> return list.get(num);
> }
> {code}
> {{list.size() > num - 1}} is equivalent to {{size >= num}}, so {{num ==
> size}} passes the guard and {{list.get(num)}} throws a *raw JDK*
> {{IndexOutOfBoundsException}}. Two consequences:
> # The friendly error ({{"Index: 3, Size: 3 out of bounds with List from bean
> ... using OGNL path [...]"}}) is replaced by {{"Index 3 out of bounds for
> length 3"}} with no bean/OGNL context — only for this exact boundary value
> (index > size produces the friendly message correctly).
> # *Null-safe OGNL is broken at the boundary*: with the {{?}} null-safe
> operator the code below the guard should return {{null}} instead of throwing;
> the raw exception escapes before that check is reached.
> The condition should be {{list.size() > num}}. Present since 2010 (commit
> 50992943b7cd, survived several refactorings). The existing
> {{SimpleTest.testBodyOGNLOrderListOutOfBounds}} only tests index 3 on a list
> of size 2, skipping the boundary.
> *Reproducer*
> Attached test {{BeanOgnlListIndexOutOfBoundsTest}} fails on main
> (4.22.0-SNAPSHOT): {{getList[3]}} on a 3-element list yields the raw JDK
> message. The companion test with {{getList[4]}} (index > size) passes,
> showing the friendly path works everywhere except the boundary.
> _This issue was found by an AI-assisted code review. Reported by Claude Code
> on behalf of [~fmariani] (GitHub: Croway)._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
