MultipartHttpServletRequest.getParameterValues does not merge values from query string and body [SPR-16590]

[spring-projects-issues]

Jason Joo opened SPR-16590 and commented

Affected method:

DefaultMultipartHttpServletRequest::getParameterValues
DefaultMultipartHttpServletRequest::getParameterMap

getParameterValues is used to return multi values of a same key in request, including query string, post contents.
And DefaultMultipartHttpServletRequest would be used instead of default servlet wrapper when using "multipart/form-data" post method to realize including vars in multipart body. And there is a problem in its getter in dealing values of same keys. It will not merge them to values in query string.

It can be reproduced by following steps:

curl -F "key1=test" "http://test.com/hello?key1=other"

You will get a parameter map like:

key1: [test]

curl -d "key1=test" "http://test.com/hello?key1=other"

And you will get:

key1: [test, other]

Let's sit down to discuss whether fix it?

---

Affects: 5.0.4

Reference URL: #1740

Referenced from: commits ab6a6f4

[spring-projects-issues]

Rossen Stoyanchev commented

I'm scheduling for 5.1, since it represents a change of behavior.

Some extra notes. The Servlet spec, section 3.1 (HTTP Protocol Parameters):

Data from the query string and the post body are aggregated into the request
parameter set. Query string data is presented before post body data. For example, if
a request is made with a query string of a=hello and a post body of a=goodbye&a=
world , the resulting parameter set would be ordered a=(hello, goodbye, world) .

Also section 3.2 (File Upload):

For parts with form-data as the Content-Disposition , but without a filename,
the string value of the part will also be available through the getParameter and
getParameterValues methods on HttpServletRequest , using the name of the
part.

Also note that the StandardMultipartHttpServletRequest (Servlet 3.0 multipart) behaves as expected. It's only DefaultMultipartHttpServletRequest (i.e. Apache FileUpload) that has this behavior.