Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

MultipartHttpServletRequest.getParameterValues does not merge values from query string and body [SPR-16590] #21132

Closed
spring-projects-issues opened this issue Mar 14, 2018 · 1 comment
Assignees
Labels
in: web type: enhancement
Milestone

Comments

@spring-projects-issues
Copy link
Collaborator

@spring-projects-issues spring-projects-issues commented Mar 14, 2018

Jason Joo opened SPR-16590 and commented

Affected method:

DefaultMultipartHttpServletRequest::getParameterValues
DefaultMultipartHttpServletRequest::getParameterMap

getParameterValues is used to return multi values of a same key in request, including query string, post contents.
And DefaultMultipartHttpServletRequest would be used instead of default servlet wrapper when using "multipart/form-data" post method to realize including vars in multipart body. And there is a problem in its getter in dealing values of same keys. It will not merge them to values in query string.

It can be reproduced by following steps:

curl -F "key1=test" "http://test.com/hello?key1=other"

You will get a parameter map like:

key1: [test]

curl -d "key1=test" "http://test.com/hello?key1=other"

And you will get:

key1: [test, other]

Let's sit down to discuss whether fix it?


Affects: 5.0.4

Reference URL: #1740

Referenced from: commits ab6a6f4

@spring-projects-issues
Copy link
Collaborator Author

@spring-projects-issues spring-projects-issues commented Mar 19, 2018

Rossen Stoyanchev commented

I'm scheduling for 5.1, since it represents a change of behavior.

Some extra notes. The Servlet spec, section 3.1 (HTTP Protocol Parameters):

Data from the query string and the post body are aggregated into the request
parameter set. Query string data is presented before post body data. For example, if
a request is made with a query string of a=hello and a post body of a=goodbye&a=
world , the resulting parameter set would be ordered a=(hello, goodbye, world) .

Also section 3.2 (File Upload):

For parts with form-data as the Content-Disposition , but without a filename,
the string value of the part will also be available through the getParameter and
getParameterValues methods on HttpServletRequest , using the name of the
part.

Also note that the StandardMultipartHttpServletRequest (Servlet 3.0 multipart) behaves as expected. It's only DefaultMultipartHttpServletRequest (i.e. Apache FileUpload) that has this behavior.

@spring-projects-issues spring-projects-issues added type: enhancement in: web labels Jan 11, 2019
@spring-projects-issues spring-projects-issues added this to the 5.1 RC1 milestone Jan 11, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
in: web type: enhancement
Projects
None yet
Development

No branches or pull requests

2 participants