From 59084354e2277c4244e8949128466b33e7c9206d Mon Sep 17 00:00:00 2001 From: Rossen Stoyanchev Date: Mon, 14 May 2012 11:38:58 -0400 Subject: [PATCH] Add validation of HTTP method in form tag SPR-6945 --- .../web/servlet/tags/form/FormTag.java | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/spring-webmvc/src/main/java/org/springframework/web/servlet/tags/form/FormTag.java b/spring-webmvc/src/main/java/org/springframework/web/servlet/tags/form/FormTag.java index 464d7086d7..365afd1268 100644 --- a/spring-webmvc/src/main/java/org/springframework/web/servlet/tags/form/FormTag.java +++ b/spring-webmvc/src/main/java/org/springframework/web/servlet/tags/form/FormTag.java @@ -27,6 +27,7 @@ import javax.servlet.jsp.PageContext; import org.springframework.beans.PropertyAccessor; import org.springframework.core.Conventions; +import org.springframework.http.HttpMethod; import org.springframework.util.ObjectUtils; import org.springframework.util.StringUtils; import org.springframework.web.servlet.support.RequestDataValueProcessor; @@ -319,7 +320,6 @@ public class FormTag extends AbstractHtmlElementTag { return ("get".equalsIgnoreCase(method) || "post".equalsIgnoreCase(method)); } - /** * Writes the opening part of the block 'form' tag and exposes * the form object name in the {@link javax.servlet.jsp.PageContext}. @@ -345,6 +345,7 @@ public class FormTag extends AbstractHtmlElementTag { tagWriter.forceBlock(); if (!isMethodBrowserSupported(getMethod())) { + assertHttpMethod(getMethod()); String inputName = getMethodParameter(); String inputType = "hidden"; tagWriter.startTag(INPUT_TAG); @@ -369,6 +370,15 @@ public class FormTag extends AbstractHtmlElementTag { return EVAL_BODY_INCLUDE; } + private void assertHttpMethod(String method) { + for (HttpMethod httpMethod : HttpMethod.values()) { + if (httpMethod.name().equalsIgnoreCase(method)) { + return; + } + } + throw new IllegalArgumentException("Invalid HTTP method: " + method); + } + /** * Autogenerated IDs correspond to the form object name. */