From 6a777a7f9bd7c9ae8ecf7f3dd3554bfe88f21913 Mon Sep 17 00:00:00 2001 From: Andy Wilkinson Date: Thu, 4 Jul 2019 14:50:01 +0100 Subject: [PATCH] Disable HiddenHttpMethodFilter by default HiddenHttpMethodFilter can be problematic as it causes early consumption of a request body if the body may contain parameters. This happens as the filter needs to read the parameters to see if an _method parameter is present. The filter is only beneficial for web applications that are the hidden HTTP method functionality but is potentially detriimental to all applications that are not. As such we no longer believe that it should be enabled by default and users should be required to opt in. Closes gh-16953 --- .../reactive/WebFluxAutoConfiguration.java | 2 +- .../web/servlet/WebMvcAutoConfiguration.java | 2 +- .../WebFluxAutoConfigurationTests.java | 19 ++++++++++--------- .../FilterOrderingIntegrationTests.java | 2 ++ .../servlet/WebMvcAutoConfigurationTests.java | 10 +++++----- 5 files changed, 19 insertions(+), 16 deletions(-) diff --git a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/reactive/WebFluxAutoConfiguration.java b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/reactive/WebFluxAutoConfiguration.java index 39f3779841..18a25fc81e 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/reactive/WebFluxAutoConfiguration.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/reactive/WebFluxAutoConfiguration.java @@ -86,7 +86,7 @@ public class WebFluxAutoConfiguration { @Bean @ConditionalOnMissingBean(HiddenHttpMethodFilter.class) - @ConditionalOnProperty(prefix = "spring.webflux.hiddenmethod.filter", name = "enabled", matchIfMissing = true) + @ConditionalOnProperty(prefix = "spring.webflux.hiddenmethod.filter", name = "enabled", matchIfMissing = false) public OrderedHiddenHttpMethodFilter hiddenHttpMethodFilter() { return new OrderedHiddenHttpMethodFilter(); } diff --git a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/servlet/WebMvcAutoConfiguration.java b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/servlet/WebMvcAutoConfiguration.java index d6f0d0a65f..ba442c32af 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/servlet/WebMvcAutoConfiguration.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/servlet/WebMvcAutoConfiguration.java @@ -153,7 +153,7 @@ public class WebMvcAutoConfiguration { @Bean @ConditionalOnMissingBean(HiddenHttpMethodFilter.class) - @ConditionalOnProperty(prefix = "spring.mvc.hiddenmethod.filter", name = "enabled", matchIfMissing = true) + @ConditionalOnProperty(prefix = "spring.mvc.hiddenmethod.filter", name = "enabled", matchIfMissing = false) public OrderedHiddenHttpMethodFilter hiddenHttpMethodFilter() { return new OrderedHiddenHttpMethodFilter(); } diff --git a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/reactive/WebFluxAutoConfigurationTests.java b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/reactive/WebFluxAutoConfigurationTests.java index 22f1bbe010..fa017ddea8 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/reactive/WebFluxAutoConfigurationTests.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/reactive/WebFluxAutoConfigurationTests.java @@ -302,22 +302,23 @@ class WebFluxAutoConfigurationTests { } @Test - void hiddenHttpMethodFilterIsAutoConfigured() { - this.contextRunner.run((context) -> assertThat(context).hasSingleBean(OrderedHiddenHttpMethodFilter.class)); + void hiddenHttpMethodFilterIsDisabledByDefault() { + this.contextRunner.run((context) -> assertThat(context).doesNotHaveBean(HiddenHttpMethodFilter.class)); } @Test void hiddenHttpMethodFilterCanBeOverridden() { - this.contextRunner.withUserConfiguration(CustomHiddenHttpMethodFilter.class).run((context) -> { - assertThat(context).doesNotHaveBean(OrderedHiddenHttpMethodFilter.class); - assertThat(context).hasSingleBean(HiddenHttpMethodFilter.class); - }); + this.contextRunner.withPropertyValues("spring.webflux.hiddenmethod.filter.enabled=true") + .withUserConfiguration(CustomHiddenHttpMethodFilter.class).run((context) -> { + assertThat(context).doesNotHaveBean(OrderedHiddenHttpMethodFilter.class); + assertThat(context).hasSingleBean(HiddenHttpMethodFilter.class); + }); } @Test - void hiddenHttpMethodFilterCanBeDisabled() { - this.contextRunner.withPropertyValues("spring.webflux.hiddenmethod.filter.enabled=false") - .run((context) -> assertThat(context).doesNotHaveBean(HiddenHttpMethodFilter.class)); + void hiddenHttpMethodFilterCanBeEnabled() { + this.contextRunner.withPropertyValues("spring.webflux.hiddenmethod.filter.enabled=true") + .run((context) -> assertThat(context).hasSingleBean(OrderedHiddenHttpMethodFilter.class)); } @Test diff --git a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/servlet/FilterOrderingIntegrationTests.java b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/servlet/FilterOrderingIntegrationTests.java index 69a6b083d4..c63320b747 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/servlet/FilterOrderingIntegrationTests.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/servlet/FilterOrderingIntegrationTests.java @@ -30,6 +30,7 @@ import org.springframework.boot.autoconfigure.context.PropertyPlaceholderAutoCon import org.springframework.boot.autoconfigure.http.HttpMessageConvertersAutoConfiguration; import org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration; import org.springframework.boot.autoconfigure.session.SessionAutoConfiguration; +import org.springframework.boot.test.util.TestPropertyValues; import org.springframework.boot.testsupport.web.servlet.MockServletWebServer.RegisteredFilter; import org.springframework.boot.web.server.WebServerFactoryCustomizerBeanPostProcessor; import org.springframework.boot.web.servlet.context.AnnotationConfigServletWebServerApplicationContext; @@ -89,6 +90,7 @@ class FilterOrderingIntegrationTests { TestRedisConfiguration.class, WebMvcAutoConfiguration.class, SecurityAutoConfiguration.class, SessionAutoConfiguration.class, HttpMessageConvertersAutoConfiguration.class, PropertyPlaceholderAutoConfiguration.class, HttpEncodingAutoConfiguration.class); + TestPropertyValues.of("spring.mvc.hiddenmethod.filter.enabled:true").applyTo(this.context); this.context.refresh(); } diff --git a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/servlet/WebMvcAutoConfigurationTests.java b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/servlet/WebMvcAutoConfigurationTests.java index 3d0f7cb054..e3f4d29d21 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/servlet/WebMvcAutoConfigurationTests.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/servlet/WebMvcAutoConfigurationTests.java @@ -483,14 +483,14 @@ class WebMvcAutoConfigurationTests { } @Test - void hiddenHttpMethodFilterCanBeDisabled() { - this.contextRunner.withPropertyValues("spring.mvc.hiddenmethod.filter.enabled=false") - .run((context) -> assertThat(context).doesNotHaveBean(HiddenHttpMethodFilter.class)); + void hiddenHttpMethodFilterCanBeEnabled() { + this.contextRunner.withPropertyValues("spring.mvc.hiddenmethod.filter.enabled=true") + .run((context) -> assertThat(context).hasSingleBean(HiddenHttpMethodFilter.class)); } @Test - void hiddenHttpMethodFilterEnabledByDefault() { - this.contextRunner.run((context) -> assertThat(context).hasSingleBean(HiddenHttpMethodFilter.class)); + void hiddenHttpMethodFilterDisabledByDefault() { + this.contextRunner.run((context) -> assertThat(context).doesNotHaveBean(HiddenHttpMethodFilter.class)); } @Test