From 40f74dd1e700c2ca8b0117dda3cbe0ee55f770b3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9da=20Housni=20Alaoui?= <reda-alaoui@hey.com>
Date: Mon, 9 May 2022 21:09:12 +0200
Subject: [PATCH] #1780 - Do not expose URL template variable for MultipartFile
 parameter.

---
 .../hateoas/server/core/WebHandler.java       |  6 +++++-
 .../server/mvc/WebMvcLinkBuilderUnitTest.java | 19 +++++++++++++++++++
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/src/main/java/org/springframework/hateoas/server/core/WebHandler.java b/src/main/java/org/springframework/hateoas/server/core/WebHandler.java
index 8888e923..2de64943 100644
--- a/src/main/java/org/springframework/hateoas/server/core/WebHandler.java
+++ b/src/main/java/org/springframework/hateoas/server/core/WebHandler.java
@@ -46,6 +46,7 @@ import org.springframework.util.StringUtils;
 import org.springframework.web.bind.annotation.PathVariable;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.ValueConstants;
+import org.springframework.web.multipart.MultipartFile;
 import org.springframework.web.util.UriComponents;
 import org.springframework.web.util.UriComponentsBuilder;
 import org.springframework.web.util.UriTemplate;
@@ -228,7 +229,10 @@ public class WebHandler {
 			return;
 		}
 
-		if (Map.class.isAssignableFrom(parameterType) && SKIP_VALUE.equals(value)) {
+		boolean isMap = Map.class.isAssignableFrom(parameterType);
+		boolean isMultipartFile = MultipartFile.class.isAssignableFrom(parameterType);
+
+		if (isMap && SKIP_VALUE.equals(value) || isMultipartFile) {
 			return;
 		}
 
diff --git a/src/test/java/org/springframework/hateoas/server/mvc/WebMvcLinkBuilderUnitTest.java b/src/test/java/org/springframework/hateoas/server/mvc/WebMvcLinkBuilderUnitTest.java
index 4d959d38..3f45732e 100644
--- a/src/test/java/org/springframework/hateoas/server/mvc/WebMvcLinkBuilderUnitTest.java
+++ b/src/test/java/org/springframework/hateoas/server/mvc/WebMvcLinkBuilderUnitTest.java
@@ -16,6 +16,7 @@
 package org.springframework.hateoas.server.mvc;
 
 import static org.assertj.core.api.Assertions.*;
+import static org.mockito.Mockito.*;
 import static org.springframework.hateoas.server.mvc.WebMvcLinkBuilder.*;
 
 import java.lang.reflect.Method;
@@ -57,6 +58,7 @@ import org.springframework.web.bind.annotation.RequestMethod;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RestController;
 import org.springframework.web.context.request.RequestContextHolder;
+import org.springframework.web.multipart.MultipartFile;
 import org.springframework.web.util.UriComponents;
 import org.springframework.web.util.UriComponentsBuilder;
 
@@ -707,6 +709,18 @@ class WebMvcLinkBuilderUnitTest extends TestUtils {
 		assertThat(second.hashCode()).isEqualTo(first.hashCode());
 	}
 
+	@Test // #1776
+	void ignoresRequestParamMultipartFile() {
+
+		Stream.of(null, mock(MultipartFile.class)).forEach(it -> {
+
+			Link link = linkTo(methodOn(ControllerWithMethods.class).methodWithMultipartFile(it)).withSelfRel();
+
+			assertThat(link.getVariables()).isEmpty();
+			assertThat(link.expand().getHref()).endsWith("/multipart-file");
+		});
+	}
+
 	private static UriComponents toComponents(Link link) {
 		return UriComponentsBuilder.fromUriString(link.expand().getHref()).build();
 	}
@@ -818,6 +832,11 @@ class WebMvcLinkBuilderUnitTest extends TestUtils {
 		HttpEntity<Void> methodWithRequestBody(@RequestBody Person param) {
 			return null;
 		}
+
+		@RequestMapping("/multipart-file")
+		HttpEntity<Void> methodWithMultipartFile(@RequestParam("file") MultipartFile file) {
+			return null;
+		}
 	}
 
 	@RequestMapping("/parent")