Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Access to request parameters via @RequestParam within form PUT request handlers is broken (HttpPutFormContentFilter) [SPR-15835] #20390

Closed
spring-issuemaster opened this issue Jul 31, 2017 · 2 comments
Assignees

Comments

@spring-issuemaster
Copy link
Collaborator

@spring-issuemaster spring-issuemaster commented Jul 31, 2017

Jonas Havers opened SPR-15835 and commented

Until spring-web 4.3.9, I used the hidden HTML form parameter _method="put" to submit data for entity changes. After passing the HiddenHttpMethodFilter, the request method is set to PUT. The fix in the HttpPutFormContentFilter for the issue #20308 (spring-web 4.3.10) breaks the possibility to access HTML form field values via @RequestParam in Spring controllers. If this break is intended, how can I make reasonable use of HiddenHttpMethodFilter now?

An example HTML form to showcase the issue:

<form id="form" action="/demo-issue" method="POST" enctype="application/x-www-form-urlencoded">
  <input type="hidden" name="_method" value="PUT">
  <input type="hidden" name="hiddenField" value="testHidden">
  <input name="publicField" value="testPublic">
  <button>Post form</button>
</form>

The given enctype "application/x-www-form-urlencoded" is the default and can therefore be left out.

A corresponding controller:

@Controller
@RequestMapping("/demo-issue")
class DemoIssueController {
  @PutMapping
  public ResponseEntity<String> demoIssue(HttpServletRequest request, @RequestParam String hiddenField, @RequestParam String publicField) {
    return ResponseEntity.ok(String.format("hidden=%s;public=%s", hiddenField, publicField));
  }
}

The result after submitting the form is:

There was an unexpected error (type=Bad Request, status=400).
Required String parameter 'hiddenField' is not present

The expected result in the response body is:

hidden=testHidden;public=testPublic

There is a workaround by using enctype="multipart/form-data in the form because it does not match the condition in the HttpPutFormContentFilter#isFormContentType method (which might be another issue).


Affects: 4.3.10

Issue Links:

  • #20383 Parameter values are null when making a PUT request ("duplicates")
  • #20308 MockMvc duplicates PUT Parameter value
@spring-issuemaster
Copy link
Collaborator Author

@spring-issuemaster spring-issuemaster commented Jul 31, 2017

Jonas Havers commented

Just noticed the duplicate #20383 and contributed my findings in the comments there.

@spring-issuemaster
Copy link
Collaborator Author

@spring-issuemaster spring-issuemaster commented Jul 31, 2017

Rossen Stoyanchev commented

The HttpPutFormContentFilter is completely unnecessary for this request since the actual HTTP method is POST and the Servlet container parses the body as usual. So you may be able to simply remove it. However if you do have requests, from non-browser clients that are actually HTTP PUT or PATCH those wouldn't work any more. In any case it looks like the change for #20308 has made it impossible to have both HiddenHttpMethodFilter and HttpPutFormContentFilter and it's something we need to fix.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
2 participants
You can’t perform that action at this time.