Tomcat generating random space in jsp

Question

I am maintaining an internal application at work and I am facing random breaking issues in the javascript functions of the jsp pages because of whitespaces from unknown origin. The application runs on Tomcat V8.5.30 and JRE 1.8.0_191.

The jsp pages look correct and the compilation by Tomcat also looks correct. When Tomcat serves the pages to users whitespaces that are not from the code cause script blocks to not load or HTML tags to break (ex: "< input type='hidden'>", "" or ""). This issue seems to happen all the time but the whitespaces appears to be related to the size of the output, changes in output length seem to shift the whitespace (seems like roughly 7600 characters between occurences) and randomly break script blocks of key tags, some other times css or table formatting.

I tried to inspect responses with Wireshark suspecting some fault in transport at fixed frame length but I couldn't find any errors by stitching the transported frames. I searched permutations of whitespace, random, tomcat but all I could find was the trimWhitespace directive for Tomcat (both Web.XML and page specific in jsp) and TrimWhiteSpace Filter ( https://balusc.omnifaces.org/2007/12/whitespacefilter.html ).

I tried the filter and it did what it claimed, but that doesn't match the problem I face.

These are the latest blocking a user:

Edit: Add a screenshot of the error Screenshot of error

proreleaseedit.jsp?doaction=createRelease:673 Uncaught SyntaxError: Invalid or unexpected token

function addPrerequisiteRow(releaseId, releaseCode, releaseTitle, releaseDate, releaseVersion, releaseEdition){
var rowId = generatePrqNextRowId();
var tbody = document.getElementById("prqTable").getElementsByTagName("TBODY")[0];
var row = document.createElement("TR");
row.id = "prqrow_" + rowId;
// delete
var td1 = document.createElement("TD");
td1.title = "Delete";
td1.className = "ColCtr";
td1.innerHTML = "<input type=\"c
heckbox\" name=\"prqcheckbox_" + rowId + "\" id=\"prqcheckbox_" + rowId + "\" value=\"true\" onClick=\"selectRow(this)\" >"
+"<input type=\"hidden\" name=\"prq_id_" + rowId + "\" id=\"prq_id_" + rowId + "\" value=\"" + releaseId + "\">"
+"<input type=\"hidden\" name=\"prq_idx_" + rowId + "\" id=\"prq_idx_" + rowId + "\" value=\"" + rowId + "\">";
// move

proreleaseedit.jsp?doaction=createRelease:1121 Uncaught ReferenceError: nline is not defined

</body>
<script>
CKEDITOR.disableAutoInline = true;
CKEDITOR.inline('r_comment');
CKEDITOR.i
nline('r_description');
</script>

If I try to run the submit function at the end of the form, all these errors prevented the function from being registered: proreleaseedit.jsp?doaction=createRelease:1078 Uncaught ReferenceError: doSave is not defined

I found I could avoid some errors by surrounding every function in a script block, but I know that is highly recommended against.

This is the code as written in the jsp file:

function addPrerequisiteRow(releaseId, releaseCode, releaseTitle, releaseDate, releaseVersion, releaseEdition){
    var rowId = generatePrqNextRowId();
    var tbody = document.getElementById("prqTable").getElementsByTagName("TBODY")[0];
    var row = document.createElement("TR");
    row.id = "prqrow_" + rowId;

    // delete
    var td1 = document.createElement("TD");
    td1.title = "Delete";
    td1.className = "ColCtr";
    td1.innerHTML = "<input type=\"checkbox\" name=\"prqcheckbox_" + rowId + "\" id=\"prqcheckbox_" + rowId + "\" value=\"true\" onClick=\"selectRow(this)\" >"
                +"<input type=\"hidden\" name=\"<%= ReleaseWebImpl.PRE_REQUISITE_ID_F%>" + rowId + "\" id=\"<%= ReleaseWebImpl.PRE_REQUISITE_ID_F%>" + rowId + "\" value=\"" + releaseId + "\">"
                +"<input type=\"hidden\" name=\"<%= ReleaseWebImpl.PRE_REQUISITE_IDX_F%>" + rowId + "\" id=\"<%= ReleaseWebImpl.PRE_REQUISITE_IDX_F%>" + rowId + "\" value=\"" + rowId + "\">";

    // move
    var td2 = document.createElement("TD");
    td2.title = "Move";
    td2.className = "ColCtr";
    td2.innerHTML = "<a href=\"javascript:moveUpRow('" + row.id + "')\"><span class=LogoPrecSuiv title=\"Move Upd\">5</span></a>" 
                    +"<a href=\"javascript:moveDownRow('" + row.id + "')\"><span class=LogoPrecSuiv title=\"Move Down\">6</span></a>";

    // code
    var td3 = document.createElement("TD");
    td3.className = "ColGch";
    td3.innerHTML = releaseCode;

    // title 
    var td4 = document.createElement("TD");
    td4.className = "ColGch";
    td4.innerHTML = releaseTitle;

    // date
    var td5 = document.createElement("TD");
    td5.className = "ColGch";
    td5.innerHTML = releaseDate;

    // version
    var td6 = document.createElement("TD");
    td6.className = "ColGch";
    td6.innerHTML = releaseVersion;

    // edition
    var td7 = document.createElement("TD");
    td7.className = "ColGch";
    td7.innerHTML = releaseEdition;

    row.appendChild(td1);
    row.appendChild(td2);
    row.appendChild(td3);
    row.appendChild(td4);
    row.appendChild(td5);
    row.appendChild(td6);
    row.appendChild(td7);

    tbody.appendChild(row);
    //
};

and

</body>
    <script>
        CKEDITOR.disableAutoInline = true;
        CKEDITOR.inline('<%= ReleaseWebImpl.REL_COMMENT_F%>');
        CKEDITOR.inline('<%= ReleaseWebImpl.REL_DESCRIPTION_F%>');
    <%
    list = release.getDetails().iterator();
    itemIndex = 0;
    while (list.hasNext()) {
        ReleaseDetail item = (ReleaseDetail)list.next();
        itemIndex++;
    %>
            CKEDITOR.inline('<%= ReleaseWebImpl.DET_TITLE_F%><%= itemIndex%>');
            CKEDITOR.inline('<%= ReleaseWebImpl.DET_DESCRIPTION_F%><%= itemIndex%>');
    <%}//end of detailList %>
    </script>

And this is what the jsp compiles as:

  out.write("\tfunction addPrerequisiteRow(releaseId, releaseCode, releaseTitle, releaseDate, releaseVersion, releaseEdition){\r\n");
  out.write("\t\tvar rowId = generatePrqNextRowId();\r\n");
  out.write("\t\tvar tbody = document.getElementById(\"prqTable\").getElementsByTagName(\"TBODY\")[0];\r\n");
  out.write("\t\tvar row = document.createElement(\"TR\");\r\n");
  out.write("\t\trow.id = \"prqrow_\" + rowId;\r\n");
  out.write("\r\n");
  out.write("\t\t// delete\r\n");
  out.write("\t\tvar td1 = document.createElement(\"TD\");\r\n");
  out.write("\t\ttd1.title = \"Delete\";\r\n");
  out.write("\t\ttd1.className = \"ColCtr\";\r\n");
  out.write("\t\ttd1.innerHTML = \"<input type=\\\"checkbox\\\" name=\\\"prqcheckbox_\" + rowId + \"\\\" id=\\\"prqcheckbox_\" + rowId + \"\\\" value=\\\"true\\\" onClick=\\\"selectRow(this)\\\" >\"\r\n");
  out.write("\t\t\t\t\t+\"<input type=\\\"hidden\\\" name=\\\"");
  out.print( ReleaseWebImpl.PRE_REQUISITE_ID_F);
  out.write("\" + rowId + \"\\\" id=\\\"");
  out.print( ReleaseWebImpl.PRE_REQUISITE_ID_F);
  out.write("\" + rowId + \"\\\" value=\\\"\" + releaseId + \"\\\">\"\r\n");
  out.write("\t\t\t\t\t+\"<input type=\\\"hidden\\\" name=\\\"");
  out.print( ReleaseWebImpl.PRE_REQUISITE_IDX_F);
  out.write("\" + rowId + \"\\\" id=\\\"");
  out.print( ReleaseWebImpl.PRE_REQUISITE_IDX_F);
  out.write("\" + rowId + \"\\\" value=\\\"\" + rowId + \"\\\">\";\t\t\t\t\t\r\n");
  out.write("\r\n");

and

      out.write("\t<script>\r\n");
      out.write("\t\tCKEDITOR.disableAutoInline = true;\r\n");
      out.write("\t\tCKEDITOR.inline('");
      out.print( ReleaseWebImpl.REL_COMMENT_F);
      out.write("');\r\n");
      out.write("\t\tCKEDITOR.inline('");
      out.print( ReleaseWebImpl.REL_DESCRIPTION_F);
      out.write("');\r\n");
      out.write("\t");

    list = release.getDetails().iterator();
    itemIndex = 0;
    while (list.hasNext()) {
        ReleaseDetail item = (ReleaseDetail)list.next();
        itemIndex++;
    
      out.write("\r\n");
      out.write("\t\t\tCKEDITOR.inline('");
      out.print( ReleaseWebImpl.DET_TITLE_F);
      out.print( itemIndex);
      out.write("');\r\n");
      out.write("\t\t\tCKEDITOR.inline('");
      out.print( ReleaseWebImpl.DET_DESCRIPTION_F);
      out.print( itemIndex);
      out.write("');\r\n");
      out.write("\t");
}//end of detailList 
      out.write("\r\n");
      out.write("\t</script>\r\n");

Answer 1

It looks to me as the function you claim to be in the JSP

function addPrerequisiteRow(...

is not interpreted on server side but instead sent verbatim to the client. If this is intended as Javascript code to be executed in the browser, there is nothing wrong with it. But be aware the whitespace you see at the beginning of those Javascript lines actually come from your JSP. After all you used whitepace to format your code, and this is just being preserved.

So if you do not like that whitespace, remove it from your JSP and it will be gone.