RequestDataValueProcessor inserts hidden fields at the beginning of the form, not the end

[adrianpillinger]

Thymeleaf 3.0.12
Spring boot 2.3.6.RELEASE
Spring 5

Thymeleaf documentation states under section 11.1 that hidden fields will be injected at the end of the form.

th:action calls RequestDataValueProcessor.processAction(...) before rendering the form’s action attribute, and additionally it detects when this attribute is being applied on a

tag —which should be the only place, anyway—, and in such case calls RequestDataValueProcessor.getExtraHiddenFields(...) and adds the returned hidden fields just before the closing tag.

However the behaviour is that the hidden fields are inserted after the opening form tag instead of before the end tag.

This caused us a migration issue from Thymeleaf 2 where it broke some CSS using a :before sudo class on the form content. We fixed this via CSS, but fixing the inconsistent behaviour in the thymeleaf spring code to be the same as version 2 will make a smoother upgrade path for others.