From b95362a3fd170a5ee16b90b74d4939efde06db02 Mon Sep 17 00:00:00 2001 From: rstoyanchev Date: Thu, 30 Jun 2022 14:03:21 +0100 Subject: [PATCH] Avoid request params access for form data in logRequest Close gh-28587 --- .../springframework/web/servlet/DispatcherServlet.java | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/spring-webmvc/src/main/java/org/springframework/web/servlet/DispatcherServlet.java b/spring-webmvc/src/main/java/org/springframework/web/servlet/DispatcherServlet.java index cd4dc70872..59a47a07a6 100644 --- a/spring-webmvc/src/main/java/org/springframework/web/servlet/DispatcherServlet.java +++ b/spring-webmvc/src/main/java/org/springframework/web/servlet/DispatcherServlet.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2021 the original author or authors. + * Copyright 2002-2022 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -978,7 +978,8 @@ public class DispatcherServlet extends FrameworkServlet { private void logRequest(HttpServletRequest request) { LogFormatUtils.traceDebug(logger, traceOn -> { String params; - if (StringUtils.startsWithIgnoreCase(request.getContentType(), "multipart/")) { + String contentType = request.getContentType(); + if (StringUtils.startsWithIgnoreCase(contentType, "multipart/")) { params = "multipart"; } else if (isEnableLoggingRequestDetails()) { @@ -987,7 +988,9 @@ public class DispatcherServlet extends FrameworkServlet { .collect(Collectors.joining(", ")); } else { - params = (request.getParameterMap().isEmpty() ? "" : "masked"); + // Avoid request body parsing for form data + params = (StringUtils.startsWithIgnoreCase(contentType, "application/x-www-form-urlencoded") || + !request.getParameterMap().isEmpty() ? "masked" : ""); } String queryString = request.getQueryString();