RequestDataValueProcessor produces non-compliant HTML code [SPR-10103]

[spring-projects-issues]

Paweł Firlej opened SPR-10103 and commented

The org.springframework.web.servlet.support.RequestDataValueProcessor generates hidden html input fields as:

<input type="hidden" name="xxx" value="yyy"></input>

Such closing tag on input element is invalid in HTML 4.01.

Should be:
<input type="hidden" name="xxx" value="yyy">

---

Affects: 3.1.2

[spring-projects-issues]

Rossen Stoyanchev commented

The org.springframework.web.servlet.support.RequestDataValueProcessor generates hidden html input fields

RequestDataValueProcessor is an interface. It doesn't generate any html. What implementation of the interface are you using?

[spring-projects-issues]

Paweł Firlej commented

We use our implementation, which includes:

@Override
public Map<String, String> getExtraHiddenFields(HttpServletRequest request) {
    ...
    hiddenFields.put(csrfToken.getFieldName(), csrfToken.getToken());
    return hiddenFields;
}

And this hidden fields are rendered in wrong way.

[spring-projects-issues]

Rossen Stoyanchev commented

Okay, I see what you mean now. The proposed solution would not work with XHTML. This would be consistent with the form input tag:

<input type="hidden" name="xxx" value="yyy" />

[spring-projects-issues]

Paweł Firlej commented

OK, that will work in HTML 4.01, XHTML and HTML 5.