Harden Accept-Encoding parsing to prevent NPE

dev/codeserver/BUILD

@@ -64,6 +64,7 @@ test_suite(
     tests = [
         ":RecompilerTest",
         ":SourceHandlerTest",
+        ":WebServerSecurityTest",
     ],
 )
 
@@ -83,6 +84,14 @@ java_test(
     ],
 )
 
+java_test(
+    name = "WebServerSecurityTest",
+    test_class = "com.google.gwt.dev.codeserver.WebServerSecurityTest",
+    runtime_deps = [
+        ":testlib",
+    ],
+)
+
 # Repackaged codeserver for google3.
 AugmentedJar(
     name = "codeserver",

dev/codeserver/java/com/google/gwt/dev/codeserver/WebServer.java

@@ -39,6 +39,7 @@
 import java.util.Date;
 import java.util.HashMap;
 import java.util.List;
+import java.util.Locale;
 import java.util.Map;
 import java.util.concurrent.ExecutionException;
 import java.util.regex.Matcher;
@@ -372,7 +373,7 @@ public void send(HttpServletRequest request, HttpServletResponse response, TreeL
         }
 
         if (contentEncoding != null) {
-          if (!request.getHeader("Accept-Encoding").contains("gzip")) {
+          if (!acceptsGzipEncoding(request.getHeader("Accept-Encoding"))) {
             response.sendError(HttpServletResponse.SC_NOT_IMPLEMENTED);
             logger.log(TreeLogger.WARN, "client doesn't accept gzip; bailing");
             return;
@@ -543,6 +544,54 @@ static String guessMimeType(String filename) {
     return mimeType != null ? mimeType : "";
   }
 
+  /* visible for testing */
+  static boolean acceptsGzipEncoding(String acceptEncodingHeader) {
+    if (acceptEncodingHeader == null || acceptEncodingHeader.trim().isEmpty()) {
+      return false;
+    }
+
+    Double gzipQValue = null;
+    Double wildcardQValue = null;
+
+    for (String encodingSpec : acceptEncodingHeader.split(",")) {
+      String[] parts = encodingSpec.trim().split(";");
+      if (parts.length == 0) {
+        continue;
+      }
+
+      String encoding = parts[0].trim().toLowerCase(Locale.ROOT);
+      if (encoding.isEmpty()) {
+        continue;
+      }
+
+      double qValue = 1.0;
+      for (int i = 1; i < parts.length; i++) {
+        String parameter = parts[i].trim().toLowerCase(Locale.ROOT);
+        if (parameter.startsWith("q=")) {
+          String qValueText = parameter.substring("q=".length()).trim();
+          try {
+            qValue = Double.parseDouble(qValueText);
+          } catch (NumberFormatException e) {
+            qValue = 0.0;
+          }
+          break;
+        }
+      }
+
+      if (encoding.equals("gzip")) {
+        gzipQValue = qValue;
+      } else if (encoding.equals("*")) {
+        wildcardQValue = qValue;
+      }
+    }
+
+    if (gzipQValue != null) {
+      return gzipQValue > 0.0;
+    }
+
+    return wildcardQValue != null && wildcardQValue > 0.0;
+  }
+
   /**
    * Returns the binding properties from the web page where dev mode is being used. (As passed in
    * by dev_mode_on.js in a JSONP request to "/recompile".)

dev/codeserver/javatests/com/google/gwt/dev/codeserver/WebServerSecurityTest.java

@@ -0,0 +1,56 @@
+/*
+ * Copyright 2026 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package com.google.gwt.dev.codeserver;
+
+import junit.framework.TestCase;
+
+/**
+ * Security-focused tests for request header parsing in {@link WebServer}.
+ */
+public class WebServerSecurityTest extends TestCase {
+
+  public void testAcceptsGzipEncodingRejectsNullOrEmptyHeader() {
+    assertFalse(WebServer.acceptsGzipEncoding(null));
+    assertFalse(WebServer.acceptsGzipEncoding(""));
+    assertFalse(WebServer.acceptsGzipEncoding("   "));
+  }
+
+  public void testAcceptsGzipEncodingAcceptsSimpleGzip() {
+    assertTrue(WebServer.acceptsGzipEncoding("gzip"));
+    assertTrue(WebServer.acceptsGzipEncoding("deflate, gzip"));
+    assertTrue(WebServer.acceptsGzipEncoding("GZIP"));
+  }
+
+  public void testAcceptsGzipEncodingRejectsExplicitGzipZeroQValue() {
+    assertFalse(WebServer.acceptsGzipEncoding("gzip;q=0"));
+    assertFalse(WebServer.acceptsGzipEncoding("deflate, gzip; q=0.0"));
+  }
+
+  public void testAcceptsGzipEncodingHonorsWildcardWhenGzipAbsent() {
+    assertTrue(WebServer.acceptsGzipEncoding("*"));
+    assertTrue(WebServer.acceptsGzipEncoding("br;q=0.2, *;q=0.7"));
+    assertFalse(WebServer.acceptsGzipEncoding("*;q=0"));
+  }
+
+  public void testAcceptsGzipEncodingPrefersExplicitGzipOverWildcard() {
+    assertFalse(WebServer.acceptsGzipEncoding("gzip;q=0, *;q=1"));
+    assertTrue(WebServer.acceptsGzipEncoding("gzip;q=1, *;q=0"));
+  }
+
+  public void testAcceptsGzipEncodingRejectsMalformedQValue() {
+    assertFalse(WebServer.acceptsGzipEncoding("gzip;q=not-a-number"));
+  }
+}