Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.Sign up
Flawed implementations of ResourceResolverChain and ResourceTransformerChain [SPR-16862] #21401
The ResourceResolverChain and ResourceTransformerChain implementations in WebFlux use a List with a mutable index. This works as expected as long as resolvers and transformers use the chain instance when first called. However, if they use the chain from a nested, potentially asynchronous call that executes later, the chain index would almost certainly have a different value.
Looking at the implementations, those that make a nested call, and are impacted, include VersionResourceResolver, WebJarsResourceResolver, CssLinkResourceTransformer and AppCacheManifestTransformer.
Unfortunately the issue went undetected by any tests since in many cases delegating to the chain from any point might still produce the right end results, with the PathResourceResolver at the end.
Rossen Stoyanchev commented
This should be now fixed. In master (5.1+) both Spring MVC and WebFlux have been updated with the same immutable implementations for consistency with each other going forward. For the backport to 5.0.x only WebFlux has been updated, since technically it's not an issue in Spring MVC.