IBM Support

JR59184: YOU RECEIVE THE SERVLETEXCEPTION UNTERMINATED VARIABLE REFERENCE ERROR WHEN CSRF PROTECTION IS CONFIGURED

Direct link to fix

bpm.8600.cf2018.03.delta.repository

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as fixed if next.

Error description

  • When you configure CSRF protection and use a $ character in the
value of the ProcessServer.CsrfSessionTokenSalt property, you
receive the following javax.servlet.ServletException when you
access an IBM Business Process Manager (BPM) web GUI like BPC
Explorer:

Unterminated variable reference error in
com.ibm.bpm.servlet.filters.GenericSecurityServletFilter.init()

Unhandled Error 500 class java.lang.NullPointerException
:
com.ibm.bpm.servlet.filters.GenericSecurityServletFilter.
isHttpMethodAllowed(GenericSecurityServletFilter.java:248)
com.ibm.bpm.servlet.filters.GenericSecurityServletFilter.doFilte
r
(GenericSecurityServletFilter.java:109)
:

Local fix

  • LOCAL FIX:Ø
- edit cell-bpm.xml and mask XML escape characters as follows:
"   "
'   '
<   &lt;
>   &gt;
&   &amp;
- avoid using a XMP special characters

Problem summary

  • When reading IBM BPM properties, the IBM BPM code uses a
WebSphere API that automatically expands WebSphere variables in
the property value. $ characters in the property value that do
not adhere to the WebSphere variable syntax cause an
Unterminated variable reference error.

Problem conclusion

  • 



Temporary fix


    

  • 



Comments


    

  • 



APAR Information




    

  • APAR number
    JR59184
    • 

  • Reported component name
    BPM STANDARD
    • 

  • Reported component ID
    5725C9500
    • 

  • Reported release
    857
    • 

  • Status
    CLOSED  FIN
    • 

  • PE
    NoPE
    • 

  • HIPER
    NoHIPER
    • 

  • Special Attention
    NoSpecatt / Xsystem
    • 

  • Submitted date
    2018-02-26
    • 

  • Closed date
    2018-03-19
    • 

  • Last modified date
    2018-03-26
    • 





    

  • APAR is sysrouted FROM one or more of the following:
    

    • 

  • APAR is sysrouted TO one or more of the following:
    

    • 



Fix information


    



Applicable component levels


    








      
              
                            

              

              [{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SSFTDH","label":"IBM Business Process Manager Standard"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"857","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}}]
              

                          

          
 
        

      

    

      

        

          

            
Document Information


            

            


                        

            Modified date:
            

            26 March 2018
            

            
                      

        


        

        


      

    

  



    

  

  
    
            

          
Page Feedback