ignore Multipart requests in HttpSessionRequestCache.requestMatcher

[a-sayyed]

references: #7060

[a-sayyed]

I have a question regarding testing, since I'm not very familiar with the test setup.
I found the RequestCacheConfigurerTests class, and thought about writing an extra test method,
something like:

// SEC-7060
@Test
public void postWhenRequestIsMultipartThenRequestShouldNotBeCached() throws Exception {
	this.spring.register(DefaultSecurityConfig.class, MultipartFileController.class).autowire();
	MockMultipartFile aFile = new MockMultipartFile("aFile", "aFile", MediaType.TEXT_PLAIN_VALUE, 
RandomStringUtils.random(1024).getBytes());

	this.mvc.perform(multipart("/upload")
		.file(aFile))
		.andDo(print())
		.andExpect(status().isUnauthorized())
		.andReturn();
	}

@Controller
static class MultipartFileController {
	@PostMapping("/upload")
	public ResponseEntity<String> upload(MultipartFile multipartFile){
		return ResponseEntity.ok().build();
	}
}

I have a few questions:

• is this the way to go?
• do I need to register the controller, or it doesn't matter in this context?
• how do I really check if the request parameters are not cached?

[rwinch]

Thanks for working this issue. See if this test helps https://github.com/spring-projects/spring-security/blob/5.2.0.M4/config/src/test/java/org/springframework/security/config/annotation/web/configurers/RequestCacheConfigurerTests.java#L126

The gist is:

• make a multipart request before authenticating and save that session object
• Authenticate with the session object from before
• ensure you are not redirected to the URL from the multipart request

[a-sayyed]

Thanks for working this issue. See if this test helps https://github.com/spring-projects/spring-security/blob/5.2.0.M4/config/src/test/java/org/springframework/security/config/annotation/web/configurers/RequestCacheConfigurerTests.java#L126

The gist is:

* make a multipart request before authenticating and save that session object

* Authenticate with the session object from before

* ensure you are not redirected to the URL from the multipart request

Thanks @rwinch for the hint, I have added the test as you suggested.

[rwinch]

Thanks for the PR @a-sayyed! This is now merged into master