featureUtility: raw NumberFormatException instead of CWWKF1368E when http_proxy/https_proxy has a trailing slash

[ryahiaoui]

Describe the bug

When the http_proxy / https_proxy environment variable ends with a trailing slash — e.g. http_proxy=http://proxy.example.com:8080/ — feature installation fails with a raw java.lang.NumberFormatException: For input string: "8080/" instead of a Liberty diagnostic message.

InstallKernelMap.checkValidProxy() already owns a dedicated message for this exact situation (ERROR_TOOL_INVALID_PROXY_PORT → CWWKF1368E: The proxy server port number {0} is invalid. Port number must be a number that ranges from 1 to 65535.) and it does validate the 1–65535 range. But the Integer.parseInt(port) call that feeds that check is not wrapped in a try/catch, so a non-numeric port escapes as an unchecked NumberFormatException before the intended message can ever be emitted.

Note that http://proxy.example.com:8080/ is a syntactically valid URI (RFC 3986, empty path) and is accepted as-is by curl, apt, pip, npm and Docker, so it is a very common value to find already exported in a corporate environment. Even if Liberty decides the trailing slash must be rejected, the failure should surface as CWWKF1368E, not as a raw JDK exception.

Steps to reproduce

export http_proxy=http://proxy.example.com:8080/     # note the trailing slash
export https_proxy=http://proxy.example.com:8080/

mvn io.openliberty.tools:liberty-maven-plugin:3.12.3:create \
    io.openliberty.tools:liberty-maven-plugin:3.12.3:install-feature

Removing the trailing slash from both variables makes the build succeed.

Expected behaviour

Either:

1. the trailing slash / empty path is tolerated and the port parsed as 8080 (preferred — it is a valid URI); or
2. the value is rejected with the message that already exists for it, CWWKF1368E (or ERROR_IMPROPER_HTTPPROXY_FORMAT / ERROR_IMPROPER_HTTPSPROXY_FORMAT), naming the offending variable.

Actual behaviour

[ERROR] Failed to execute goal io.openliberty.tools:liberty-maven-plugin:3.12.3:install-feature
        (default-cli) on project my-app: Execution default-cli of goal
        io.openliberty.tools:liberty-maven-plugin:3.12.3:install-feature failed:
        For input string: "8080/" -> [Help 1]

Stack trace (mvn -e), abridged to the relevant frames:

Caused by: java.lang.NumberFormatException: For input string: "8080/"
    at java.lang.Integer.parseInt (Integer.java:668)
    at java.lang.Integer.parseInt (Integer.java:786)
    at com.ibm.ws.install.internal.InstallKernelMap.checkValidProxy (InstallKernelMap.java:1200)
    at com.ibm.ws.install.internal.InstallKernelMap.setProxy (InstallKernelMap.java:1165)
    at com.ibm.ws.install.internal.InstallKernelMap.get (InstallKernelMap.java:321)
    at com.ibm.ws.install.map.InstallMap.get (InstallMap.java:275)
    at io.openliberty.tools.common.plugins.util.InstallFeatureUtil.downloadPublicKeys (InstallFeatureUtil.java:1342)
    at io.openliberty.tools.common.plugins.util.InstallFeatureUtil.verifyFeatures (InstallFeatureUtil.java:1319)
    at io.openliberty.tools.common.plugins.util.InstallFeatureUtil.installFeatures (InstallFeatureUtil.java:791)
    at io.openliberty.tools.maven.server.InstallFeatureMojo.installFeatures (InstallFeatureMojo.java:122)

The raw message gives no hint that an environment variable is at fault, which makes this very hard to diagnose — the same complaint was raised in OpenLiberty/ci.maven#1910.

Diagnosis

Two observations from dev/com.ibm.ws.install/src/com/ibm/ws/install/internal/InstallKernelMap.java:

• getProxyVariables(String, String) splits the environment value on @ (credentials) and then on : to derive <protocol>.proxyHost / <protocol>.proxyPort. The last segment is used verbatim as the port, so any path component — including a lone / — is carried into the port string.
• checkValidProxy(String) then calls Integer.parseInt on that string with no try/catch, even though the very next statement is the 1–65535 range check that raises ERROR_TOOL_INVALID_PROXY_PORT.

Because the values are read through System.getenv in getEnvMap(), this cannot be worked around from the caller side: a JVM cannot modify its own environment, and getEnvMap() does not consult already-set https.proxyPort / http.proxyHost system properties, so passing them via MAVEN_OPTS has no effect.

The failure is reached only through feature signature verification (downloadPublicKeys). Setting the Liberty Maven Plugin's <features><verify>skip</verify></features> makes the same build succeed with the unchanged slashed proxy, which confirms the localisation. The feature ESAs themselves download fine, since they go through the Maven resolver and its own settings.xml proxy configuration.

Suggested fix

Parse the environment value with java.net.URI and take getHost() / getPort(), which handles the scheme, optional credentials, and any path or trailing slash uniformly. Failing that, a minimal fix would be to strip anything after the port in getProxyVariables and to wrap the Integer.parseInt in checkValidProxy so that a non-numeric port reports the existing CWWKF1368E instead of escaping as a NumberFormatException.

Diagnostic information

• Open Liberty version: 26.0.0.9 (wlp-1.0.117.cl260920260824-0859)
• Affected bundle: com.ibm.ws.install_1.0.117.jar
• liberty-maven-plugin: reproduced on both 3.12.1 and 3.12.3 (so not a plugin regression)
• ci.common: 1.8.43
• Java: OpenJDK 17.0.7 (Temurin-17.0.7+7)
• Maven: 3.9.5
• OS: Linux (Fedora, x86_64)

Related issues

• plugin execution fails when http_proxy var is set as host:port in the environment ci.maven#1910 — http_proxy=host:port (no scheme) produced envMap is null; fixed in Liberty 25.0.0.8 by adding CWWKF1400E. That validation does not cover a trailing slash, which still reaches parseInt.
• Improper http proxy format  ci.maven#1808 — ERROR_IMPROPER_httpPROXY_FORMAT raised for a proxy configuration the user believed valid.
• Install features behind proxy: http_proxy is not accepted with username and password #15017 — http_proxy with username and password rejected; the comment thread is where the required http://<proxy-host>:<proxy-port> format was stated.

[ryahiaoui]

Here is a candidate fix, offered as a suggestion rather than a pull request (I would need a CLA
signed by my employer first, so please feel free to take, adapt or discard this).

Root cause

The port is the only part of the proxy environment variable that is not sanitized. In
getProxyVariables, the host already has its slashes stripped — and so does proxyUser in the
credentials branch — but the port segment is stored verbatim:

String[] proxyHttpSplit = proxyEnvVar.split(":");
// "http://proxy-server:8080/"  ->  ["http", "//proxy-server", "8080/"]
result.put(protocol + ".proxyHost", proxyHttpSplit[1].replace("/", "")); // slashes stripped
result.put(protocol + ".proxyPort", proxyHttpSplit[2]);                  // "8080/" kept as-is

checkValidProxy then calls Integer.parseInt on that value with no try/catch, even though the
next statement is the 1-65535 range check that raises ERROR_TOOL_INVALID_PROXY_PORT
(CWWKF1368E). So the message intended for exactly this situation can never fire.

This matters beyond the trailing slash: setProxy already catches InstallException and records it
in data[ACTION_ERROR_MESSAGE], so a typed exception would surface as a readable message — the way
the CWWKF1400E fix for OpenLiberty/ci.maven#1910 does. The unchecked NumberFormatException
instead escapes all the way out and fails the build with no indication that an environment variable
is at fault.

Patch

Applies the host's existing treatment to the port, in both branches, plus a guard on the parse:

--- a/dev/com.ibm.ws.install/src/com/ibm/ws/install/internal/InstallKernelMap.java
+++ b/dev/com.ibm.ws.install/src/com/ibm/ws/install/internal/InstallKernelMap.java
@@ -1197,7 +1197,12 @@
     protected void checkValidProxy(String protocol) throws InstallException {
         String proxyPort = (String) envMap.get(protocol + ".proxyPort");
         if (protocol != null) {
-            int proxyPortnum = Integer.parseInt(proxyPort);
+            int proxyPortnum;
+            try {
+                proxyPortnum = Integer.parseInt(proxyPort);
+            } catch (NumberFormatException e) {
+                throw ExceptionUtils.createByKey("ERROR_TOOL_INVALID_PROXY_PORT", proxyPort);
+            }
             if (((String) envMap.get(protocol + ".proxyHost")).isEmpty()) {
                 throw ExceptionUtils.createByKey("ERROR_TOOL_PROXY_HOST_MISSING");
             } else if (proxyPortnum < 0 || proxyPortnum > 65535) {
@@ -2054,6 +2059,22 @@
     }
 
     /**
+     * Removes any path component that follows the port in a proxy environment variable, so that a
+     * value such as http://proxy-server:3128/ yields the port 3128 rather than the unparsable
+     * "3128/". The host part is already sanitized the same way in getProxyVariables.
+     *
+     * @param  port the port segment of the proxy environment variable
+     * @return      the port segment without any trailing path
+     */
+    static String stripPortPath(String port) {
+        if (port == null) {
+            return port;
+        }
+        int slash = port.indexOf('/');
+        return slash < 0 ? port : port.substring(0, slash);
+    }
+
+    /**
      * parses the following format for http/https proxy environment variables:
      * https://user:password@proxy-server:3128
      * http://proxy-server:3128
@@ -2077,7 +2098,7 @@
                 throw new InstallException(Messages.INSTALL_KERNEL_MESSAGES.getLogMessage("ERROR_IMPROPER_" + protocol.toUpperCase() + "PROXY_FORMAT", proxyEnvVar));
             }
             result.put(protocol + ".proxyHost", proxyHttpSplit[1].replace("/", "")); //proxy-server
-            result.put(protocol + ".proxyPort", proxyHttpSplit[2]); ////3128
+            result.put(protocol + ".proxyPort", stripPortPath(proxyHttpSplit[2])); //3128
         } else {
             String[] proxyCredentials = proxyEnvVarSplit[0].split(":"); //[http(s), //user, password]
             if (proxyCredentials.length != 3) {
@@ -2088,7 +2109,7 @@
                 throw new InstallException(Messages.INSTALL_KERNEL_MESSAGES.getLogMessage("ERROR_IMPROPER_HTTPSPROXY_FORMAT", proxyEnvVar));
             }
             result.put(protocol + ".proxyHost", proxyHostPort[0]); //prox-server
-            result.put(protocol + ".proxyPort", proxyHostPort[1]); //3128
+            result.put(protocol + ".proxyPort", stripPortPath(proxyHostPort[1])); //3128
             result.put(protocol + ".proxyUser", proxyCredentials[1].replace("/", "")); //user
             result.put(protocol + ".proxyPassword", proxyCredentials[2]); //password
         }

Test

New file dev/com.ibm.ws.install/test/com/ibm/ws/install/internal/InstallKernelMapProxyTest.java,
following the style of the existing ArtifactDownloaderUtilsTest in the same package (the helper is
package-visible and static so it needs no reflection):

/*******************************************************************************
 * Copyright (c) 2026 IBM Corporation and others.
 * All rights reserved. This program and the accompanying materials
 * are made available under the terms of the Eclipse Public License 2.0
 * which accompanies this distribution, and is available at
 * http://www.eclipse.org/legal/epl-2.0/
 *
 * SPDX-License-Identifier: EPL-2.0
 *
 * Contributors:
 *     IBM Corporation - initial API and implementation
 *******************************************************************************/
package com.ibm.ws.install.internal;

import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertNull;

import org.junit.Test;

/**
 * Tests the parsing of the port segment of the http_proxy / https_proxy environment variables.
 */
public class InstallKernelMapProxyTest {

    /**
     * A trailing slash is valid URI syntax (RFC 3986, empty path) and is accepted by curl, apt and
     * Docker, so it is commonly already exported in a corporate environment. It must not end up in
     * the port string, where it would make Integer.parseInt fail.
     */
    @Test
    public void testStripPortPathTrailingSlash() {
        assertEquals("8080", InstallKernelMap.stripPortPath("8080/"));
        assertEquals("3128", InstallKernelMap.stripPortPath("3128/"));
    }

    /**
     * A bare port is returned unchanged, so the previous behaviour is preserved.
     */
    @Test
    public void testStripPortPathNoPath() {
        assertEquals("8080", InstallKernelMap.stripPortPath("8080"));
        assertEquals("3128", InstallKernelMap.stripPortPath("3128"));
    }

    /**
     * Any longer path following the port is dropped as well.
     */
    @Test
    public void testStripPortPathWithPath() {
        assertEquals("3128", InstallKernelMap.stripPortPath("3128/proxy"));
        assertEquals("80", InstallKernelMap.stripPortPath("80/a/b"));
    }

    /**
     * Degenerate values are handled without throwing; checkValidProxy then reports
     * CWWKF1368E for them rather than letting a NumberFormatException escape.
     */
    @Test
    public void testStripPortPathDegenerate() {
        assertEquals("", InstallKernelMap.stripPortPath("/"));
        assertEquals("", InstallKernelMap.stripPortPath(""));
        assertNull(InstallKernelMap.stripPortPath(null));
    }
}

What I verified, and what I did not

• The three patch anchors each match exactly one occurrence in the current integration HEAD.
• The stripPortPath logic was executed against 8080/, 8080, 3128/, 3128/path, 80/a/b,
  /, "" and null, all giving the expected result.
• I did not run the Liberty Gradle build, so the change is unverified against your build and
  test buckets. The patch adds no imports.
• Behaviour for a well-formed proxy value is unchanged; the only visible change is that a malformed
  port now reports CWWKF1368E instead of throwing NumberFormatException.

An alternative, more thorough approach would be to parse the whole value with java.net.URI and use
getHost() / getPort(), which would cover the scheme, credentials and path uniformly. I kept the
patch minimal and symmetric with the existing code on purpose, but I am happy to rework it that way
if you would prefer.

For transparency: this patch was drafted with AI assistance (Claude Code), and I verified the helper
logic by execution as described above.