Jetty version(s)

12.0.27 certainly; likely thru current

Jetty Environment
core

HTTP version
?

Java version/vendor (use: java -version)

openjdk version "21" 2023-09-19 LTS
OpenJDK Runtime Environment Temurin-21+35 (build 21+35-LTS)
OpenJDK 64-Bit Server VM Temurin-21+35 (build 21+35-LTS, mixed mode)

with -Duser.language=az

OS type/version

irrelevant

Description

If Jetty is run with some obscure locales like az, then the Content-Type HTTP header value returned by Jetty might include a character that is itself encoded strangely like so: ıso-8859-1 which has multiple non-ASCII characters in there.

The bug is clearly in org.eclipse.jetty.http.MimeTypes which is calling String.toLowerCase without passing Locale.ROOT, thus using the default/system locale.

Note: this bug was found using Apache Solr's extensive randomized-testing approach in concert with RandomizedTesting's support for locale randomization. Solr itself has been immune to most locale sensitive bugs long ago due to its use of the forbidden-apis build plugin that bans methods that rely on the default locale.

How to reproduce?

I can reproduce it in a Solr test if you're interested.