Error with View State with JSF2

Question

Hi I am getting the following error with my application developed using Mojara 2.1.14 and Primefaces 3.3.1. I have no clew where this is coming from. Please help. It's been weeks I have been trying to find a solution.

java.lang.StringIndexOutOfBoundsException: String index out of range: -1
•       at java.lang.String.substring(String.java:1949)
•       at com.sun.faces.renderkit.ServerSideStateHelper.getState(ServerSideStateHelper.java:273)
•       at com.sun.faces.renderkit.ResponseStateManagerImpl.getState(ResponseStateManagerImpl.java:100)
•       at com.sun.faces.application.view.FaceletPartialStateManagementStrategy.restoreView(FaceletPartialStateManagementStrategy.java:353)
•       at com.sun.faces.application.StateManagerImpl.restoreView(StateManagerImpl.java:138)
•       at com.sun.faces.application.view.ViewHandlingStrategy.restoreView(ViewHandlingStrategy.java:123)
•       at com.sun.faces.application.view.FaceletViewHandlingStrategy.restoreView(FaceletViewHandlingStrategy.java:531)
•       at com.sun.faces.application.view.MultiViewHandler.restoreView(MultiViewHandler.java:141)
•       at com.sun.faces.lifecycle.RestoreViewPhase.execute(RestoreViewPhase.java:192)
•       at com.sun.faces.lifecycle.Phase.doPhase(Phase.java:101)
•       at com.sun.faces.lifecycle.RestoreViewPhase.doPhase(RestoreViewPhase.java:116)
•       at com.sun.faces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:118)
•       at javax.faces.webapp.FacesServlet.service(FacesServlet.java:593)
•       at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305)
•       at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
•       at org.primefaces.webapp.filter.FileUploadFilter.doFilter(FileUploadFilter.java:79)
•       at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
•       at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
•       at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:83)
•       at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:76)
•       at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
•       at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
•       at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:225)
•       at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:169)
•       at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472)
•       at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:168)
•       at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:98)
•       at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:927)
•       at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
•       at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:407)
•       at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:999)
•       at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:565)
•       at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:307)
•       at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1110)
•       at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:603)
•       at java.lang.Thread.run(Thread.java:679)

Here is my web.xml

<web-app id="WebApp_ID" version="2.5"
    xmlns="http://java.sun.com/xml/ns/j2ee">
    <filter>
        <filter-name>PrimeFaces FileUpload Filter</filter-name>
        <filter-class>org.primefaces.webapp.filter.FileUploadFilter</filter-class>
        <init-param>
            <param-name>thresholdSize</param-name>
            <param-value>2097152</param-value>
        </init-param>
    </filter>
    <filter-mapping>
        <filter-name>PrimeFaces FileUpload Filter</filter-name>
        <servlet-name>Faces Servlet</servlet-name>
    </filter-mapping>

    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>

    <listener>
        <listener-class>org.springframework.web.context.request.RequestContextListener</listener-class>
    </listener>

    <servlet>
        <servlet-name>Faces Servlet</servlet-name>
        <servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
        <load-on-startup>1</load-on-startup>
    </servlet>
     <servlet-mapping>
        <servlet-name>Faces Servlet</servlet-name>
        <url-pattern>/faces/*</url-pattern>
    </servlet-mapping>  
    <welcome-file-list>
        <welcome-file>faces/index.xhtml</welcome-file>
    </welcome-file-list>
    <context-param>
        <param-name>javax.faces.PROJECT_STAGE</param-name>
    <!--   <param-value>Development</param-value>   -->
      <param-value>Production</param-value> 
    </context-param> 

    <context-param>
        <param-name>primefaces.THEME</param-name>
        <param-value>bluesky</param-value>
    </context-param>
    <context-param>
        <param-name>javax.faces.STATE_SAVING_METHOD</param-name>
        <param-value>server</param-value>
    </context-param>

    <context-param>
        <param-name>javax.faces.FACELETS_REFRESH_PERIOD</param-name>
        <param-value>-1</param-value>
    </context-param>

    <context-param>
        <param-name>javax.faces.PARTIAL_STATE_SAVING</param-name>
        <param-value>true</param-value>
    </context-param>

     <context-param>        
        <param-name>com.sun.faces.COMPRESS_STATE</param-name>
        <param-value>false</param-value>
     </context-param>


    <context-param>
      <param-name>javax.faces.FACELETS_LIBRARIES</param-name>
      <param-value>/META-INF/components.taglib.xml</param-value>
    </context-param>
    <context-param>
        <param-name>facelets.SKIP_COMMENTS</param-name>
        <param-value>true</param-value>
    </context-param>    
    <context-param>
        <param-name>defaultHtmlEscape</param-name>
        <param-value>true</param-value>
    </context-param>

    <context-param>
        <param-name>javax.faces.CONFIG_FILES</param-name>
        <param-value>/WEB-INF/jsf-beans.xml</param-value>
    </context-param>

    <session-config>
        <session-timeout>15</session-timeout>
    </session-config>    

     <security-constraint>
        <web-resource-collection> 
            <url-pattern>/views/*</url-pattern>
            <http-method>GET</http-method>      
        </web-resource-collection>
        <auth-constraint />
    </security-constraint>  
<!--    
    <context-param>
        <param-name>com.sun.faces.numberOfViewsInSession</param-name>
        <param-value>1</param-value>
    </context-param>

    <context-param>
        <param-name>com.sun.faces.numberOfLogicalViews</param-name>
        <param-value>1</param-value>
    </context-param> -->

  </web-app>

Thanks for your help.

It'd be helpful if you show us how we could reproduce exactly this problem starting off with a completely blank JSF project with everything set to default. At least, the necessary code and the detailed use case is missing in the question. — BalusC, Jan 08 '13 at 19:26
Hi BalusC. Sorry I didn't provide much details. The project is full of components and I don't know where this error is triggered from. I am getting it only in production. Can you take a look at my web.xml ? Thanks for taking time to look into it. — alpha2011, Jan 08 '13 at 19:33
Okay, the exception at least tells that the value of `javax.faces.ViewState` request parameter is missing or in invalid format. Does this occur on a legitimate request or an attacker attempt? If on a legitimate request, then you really need to show the smallest possible code snippet which reproduces exactly this problem. — BalusC, Jan 08 '13 at 19:38
I am experiencing the same issue with the latest (before, too) JSF 2.1, RF 4, Seam 2.3 and Primefaces. My exception report, which is being sent by mail, contains a list of request parameters where `javax.faces.ViewState` has the value "-". The request is a simple POST request on an arbitrary form. The issue appears on random views but only with POST requests. — Roben, Oct 06 '15 at 07:54
Here is the latest stack trace I received: http://pastebin.com/MqpGqxnr. I am running Jboss AS 7. And sadly, my application is rather complex, too, so I have no clue what to isolate to reproduce the error. — Roben, Oct 06 '15 at 07:58
It just came back into my mind that I am using the script from http://stackoverflow.com/questions/11408130/hcommandbutton-hcommandlink-does-not-work-on-first-click-works-only-on-second to fix ajax requests and at least the latest error appeared on a form with ajax rendered regions, but still on a regular POST-request, though, which could in fact explain, why the view id was missing. — Roben, Oct 06 '15 at 08:06
Oh, now I saw it: The issue only happens on IE 11 for me. Still not reproducible for me using a Windows 10 VirtualBox, though :( — Roben, Oct 06 '15 at 08:24

Error with View State with JSF2

0 Answers0

Linked