Do not attempt to decode wildcard content-types as form-data
Prior to this commit, the `DefaultServerWebExchange` would attempt to decode request bodies as form-data or multipart of the request content-type was compatible with the expected media types. If requests are sent with an invalid wildcard content-type such as "*/*" or "multipart/*", we should not attempt to decode here. Fixes gh-34660
This commit is contained in:
@@ -21,6 +21,7 @@ import org.junit.jupiter.api.Test;
|
||||
import org.springframework.http.HttpHeaders;
|
||||
import org.springframework.http.MediaType;
|
||||
import org.springframework.http.codec.ServerCodecConfigurer;
|
||||
import org.springframework.http.codec.multipart.Part;
|
||||
import org.springframework.util.MultiValueMap;
|
||||
import org.springframework.web.server.ServerWebExchange;
|
||||
import org.springframework.web.server.i18n.AcceptHeaderLocaleContextResolver;
|
||||
@@ -60,14 +61,25 @@ class DefaultServerWebExchangeTests {
|
||||
}
|
||||
|
||||
@Test // gh-34660
|
||||
void useFormDataMessageReaderWhenAllContentType() {
|
||||
void shouldNotDecodeFormDataWhenContentTypeNotConcrete() {
|
||||
MockServerHttpRequest request = MockServerHttpRequest
|
||||
.post("https://example.com")
|
||||
.header(HttpHeaders.CONTENT_TYPE, MediaType.ALL_VALUE)
|
||||
.body("project=spring");
|
||||
ServerWebExchange exchange = createExchange(request);
|
||||
MultiValueMap<String, String> body = exchange.getFormData().block();
|
||||
assertThat(body.get("project")).contains("spring");
|
||||
assertThat(body).isEmpty();
|
||||
}
|
||||
|
||||
@Test // gh-34660
|
||||
void shouldNotDecodeMultipartWhenContentTypeNotConcrete() {
|
||||
MockServerHttpRequest request = MockServerHttpRequest
|
||||
.post("https://example.com")
|
||||
.header(HttpHeaders.CONTENT_TYPE, "multipart/*")
|
||||
.body("project=spring");
|
||||
ServerWebExchange exchange = createExchange(request);
|
||||
MultiValueMap<String, Part> body = exchange.getMultipartData().block();
|
||||
assertThat(body).isEmpty();
|
||||
}
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user