Do not attempt to decode wildcard content-types as form-data

Prior to this commit, the `DefaultServerWebExchange` would attempt to
decode request bodies as form-data or multipart of the request
content-type was compatible with the expected media types.

If requests are sent with an invalid wildcard content-type such as "*/*"
or "multipart/*", we should not attempt to decode here.

Fixes gh-34660
This commit is contained in:
Brian Clozel
2025-06-16 15:51:47 +02:00
parent faada70d59
commit 696692f1ed
2 changed files with 17 additions and 5 deletions

View File

@@ -21,6 +21,7 @@ import org.junit.jupiter.api.Test;
import org.springframework.http.HttpHeaders;
import org.springframework.http.MediaType;
import org.springframework.http.codec.ServerCodecConfigurer;
import org.springframework.http.codec.multipart.Part;
import org.springframework.util.MultiValueMap;
import org.springframework.web.server.ServerWebExchange;
import org.springframework.web.server.i18n.AcceptHeaderLocaleContextResolver;
@@ -60,14 +61,25 @@ class DefaultServerWebExchangeTests {
}
@Test // gh-34660
void useFormDataMessageReaderWhenAllContentType() {
void shouldNotDecodeFormDataWhenContentTypeNotConcrete() {
MockServerHttpRequest request = MockServerHttpRequest
.post("https://example.com")
.header(HttpHeaders.CONTENT_TYPE, MediaType.ALL_VALUE)
.body("project=spring");
ServerWebExchange exchange = createExchange(request);
MultiValueMap<String, String> body = exchange.getFormData().block();
assertThat(body.get("project")).contains("spring");
assertThat(body).isEmpty();
}
@Test // gh-34660
void shouldNotDecodeMultipartWhenContentTypeNotConcrete() {
MockServerHttpRequest request = MockServerHttpRequest
.post("https://example.com")
.header(HttpHeaders.CONTENT_TYPE, "multipart/*")
.body("project=spring");
ServerWebExchange exchange = createExchange(request);
MultiValueMap<String, Part> body = exchange.getMultipartData().block();
assertThat(body).isEmpty();
}