StringIndexOutOfBoundsException in StaticResourcesProcessor with META-INF/resources-only JARs

[LucienBrule]

Describe the bug

Description
When including certain jars (e.g., the GraalVM Python runtime jar) that contain only a META-INF/resources entry without any files or subpaths, the quarkusAppPartsBuild task fails with:

java.lang.StringIndexOutOfBoundsException: Range [18, 17) out of bounds for length 17
    at io.quarkus.vertx.http.deployment.StaticResourcesProcessor.lambda$getClasspathResources$1(StaticResourcesProcessor.java:113)
    ...

Expected behavior

The build succeeds.

Actual behavior

The build fails with above error.

Root Cause
StaticResourcesProcessor#getClasspathResources() unconditionally calls:

rel.substring(META_INF_RESOURCES.length())

on every relativePath, even when relativePath.equals(META_INF_RESOURCES), causing an out‑of‑bounds substring call.

How to Reproduce?

Reproducer
A fully automated reproduction script is available in the quarkus-graalpy-demo repo:
https://github.com/LucienBrule/quarkus-graalpy-demo/blob/main/REPRODUCTION.md

Output of uname -a or ver

Linux aibox 6.13.10-200.fc41.x86_64 #1 SMP PREEMPT_DYNAMIC Mon Apr 7 19:01:38 UTC 2025 x86_64 GNU/Linux

Output of java -version

java version "23.0.2" 2025-01-21 Java(TM) SE Runtime Environment Oracle GraalVM 23.0.2+7.1 (build 23.0.2+7-jvmci-b01) Java HotSpot(TM) 64-Bit Server VM Oracle GraalVM 23.0.2+7.1 (build 23.0.2+7-jvmci-b01, mixed mode, sharing)

Quarkus version or git rev

3.22.1

Build tool (ie. output of mvnw --version or gradlew --version)

------------------------------------------------------------ Gradle 8.13 ------------------------------------------------------------ Build time: 2025-02-25 09:22:14 UTC Revision: 073314332697ba45c16c0a0ce1891fa6794179ff Kotlin: 2.0.21 Groovy: 3.0.22 Ant: Apache Ant(TM) version 1.10.15 compiled on August 25 2024 Launcher JVM: 23.0.2 (Oracle Corporation 23.0.2+7-jvmci-b01) Daemon JVM: /home/developer/.sdkman/candidates/java/23.0.2-graal (no JDK specified, using current Java home) OS: Linux 6.13.10-200.fc41.x86_64 amd64

Additional information

Proposed Fix
Add a guard to verify the path is longer than the prefix before calling substring:

if (rel.startsWith(prefix)) {
    String subPath = rel.substring(prefix.length());
    knownPaths.add(new Entry(subPath, false));
}

This ensures jars with only the META-INF/resources directory are skipped safely.

Benefits

• Prevents OOB errors in the static resources build step.
• Allows inclusion of additional GraalVM polyglot language runtime jars (Python, Ruby, JavaScript) in both JVM and native modes.
• Opens the door for richer polyglot language support in Quarkus extensions going forward.

[quarkus-bot]

/cc @geoand (kotlin)

[lcgal]

Greetings,

Any plans to backport this to the current LTS version?