[jboss-jira] [JBoss JIRA] (WFLY-12692) [18.0.x] Exception with web.xml url-pattern

[18.0.x] Exception with web.xml url-pattern ------------------------------------------- Key: WFLY-12692 URL: https://issues.jboss.org/browse/WFLY-12692 Project: WildFly Issue Type: Bug Components: Web (Undertow) Affects Versions: 18.0.0.Final Reporter: Frank Heldt Assignee: Flavia Rainone Priority: Blocker Fix For: 18.0.1.Final Attachments: app.war Defining and securing 2 folders in a war with similar names given this Exception on deployment: {code} 12:38:37,994 ERROR [org.jboss.msc.service.fail] (MSC service thread 1-3) MSC000001: Failed to start service jboss.deployment.unit."java-web-project.war".jboss.security.jacc: org.jboss.msc.service.StartException in service jboss.deployment.unit."java-web-project.war".jboss.security.jacc: WFLYSEC0012: Unable to start the JaccService service at org.jboss.as.security@18.0.0.Final//org.jboss.as.security.service.JaccService.start(JaccService.java:107) at org.jboss.msc@1.4.11.Final//org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1739) at org.jboss.msc@1.4.11.Final//org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1701) at org.jboss.msc@1.4.11.Final//org.jboss.msc.service.ServiceControllerImpl$ControllerTask.run(ServiceControllerImpl.java:1559) at org.jboss.threads@2.3.3.Final//org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35) at org.jboss.threads@2.3.3.Final//org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1982) at org.jboss.threads@2.3.3.Final//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1486) at org.jboss.threads@2.3.3.Final//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1377) at java.base/java.lang.Thread.run(Thread.java:834) Caused by: java.lang.IllegalArgumentException: Invalid prefix pattern in URLPatternList at javax.security.jacc.api@2.0.0.Final//javax.security.jacc.URLPatternSpec.setURLPatternArray(URLPatternSpec.java:308) at javax.security.jacc.api@2.0.0.Final//javax.security.jacc.URLPatternSpec.<init>(URLPatternSpec.java:79) at javax.security.jacc.api@2.0.0.Final//javax.security.jacc.WebResourcePermission.<init>(WebResourcePermission.java:160) at org.wildfly.extension.undertow@18.0.0.Final//org.wildfly.extension.undertow.security.jacc.WarJACCService.createPermissions(WarJACCService.java:303) at org.wildfly.extension.undertow@18.0.0.Final//org.wildfly.extension.undertow.security.jacc.WarJACCService.createPermissions(WarJACCService.java:64) at org.jboss.as.security@18.0.0.Final//org.jboss.as.security.service.JaccService.start(JaccService.java:86) ... 8 more {code} This is the corresponding part of the web.xml: {code} <security-constraint> <web-resource-collection> <web-resource-name>Area</web-resource-name> <url-pattern>/area/*</url-pattern> </web-resource-collection> <auth-constraint> <role-name>role1</role-name> <role-name>role2</role-name> </auth-constraint> <user-data-constraint> <transport-guarantee>CONFIDENTIAL</transport-guarantee> </user-data-constraint> </security-constraint> <security-constraint> <web-resource-collection> <web-resource-name>Area 51</web-resource-name> <url-pattern>/area51/*</url-pattern> </web-resource-collection> <auth-constraint> <role-name>role1</role-name> </auth-constraint> <user-data-constraint> <transport-guarantee>CONFIDENTIAL</transport-guarantee> </user-data-constraint> </security-constraint> {code} Looks like this only happens when the url-pattern starts with the same characters (eg /area/* and /area51/*). The same war under WildFly 17.0.1 works as expected.