#1776 - Do not expose URL template variable for MultipartFile parameter.

This commit is contained in:
Réda Housni Alaoui
2022-05-09 21:09:12 +02:00
committed by Oliver Drotbohm
parent 7214ef41b8
commit 4be0e28f30
2 changed files with 25 additions and 1 deletions

View File

@@ -46,6 +46,7 @@ import org.springframework.util.StringUtils;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ValueConstants;
import org.springframework.web.multipart.MultipartFile;
import org.springframework.web.util.UriComponents;
import org.springframework.web.util.UriComponentsBuilder;
import org.springframework.web.util.UriTemplate;
@@ -55,6 +56,7 @@ import org.springframework.web.util.UriTemplate;
*
* @author Greg Turnquist
* @author Oliver Drotbohm
* @author Réda Housni Alaoui
*/
public class WebHandler {
@@ -228,7 +230,10 @@ public class WebHandler {
return;
}
if (Map.class.isAssignableFrom(parameterType) && SKIP_VALUE.equals(value)) {
boolean isMap = Map.class.isAssignableFrom(parameterType);
boolean isMultipartFile = MultipartFile.class.isAssignableFrom(parameterType);
if (isMap && SKIP_VALUE.equals(value) || isMultipartFile) {
return;
}

View File

@@ -16,6 +16,7 @@
package org.springframework.hateoas.server.mvc;
import static org.assertj.core.api.Assertions.*;
import static org.mockito.Mockito.*;
import static org.springframework.hateoas.server.mvc.WebMvcLinkBuilder.*;
import java.lang.reflect.Method;
@@ -57,6 +58,7 @@ import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.multipart.MultipartFile;
import org.springframework.web.util.UriComponents;
import org.springframework.web.util.UriComponentsBuilder;
@@ -707,6 +709,18 @@ class WebMvcLinkBuilderUnitTest extends TestUtils {
assertThat(second.hashCode()).isEqualTo(first.hashCode());
}
@Test // #1776
void ignoresRequestParamMultipartFile() {
Stream.of(null, mock(MultipartFile.class)).forEach(it -> {
Link link = linkTo(methodOn(ControllerWithMethods.class).methodWithMultipartFile(it)).withSelfRel();
assertThat(link.getVariables()).isEmpty();
assertThat(link.expand().getHref()).endsWith("/multipart-file");
});
}
private static UriComponents toComponents(Link link) {
return UriComponentsBuilder.fromUriString(link.expand().getHref()).build();
}
@@ -818,6 +832,11 @@ class WebMvcLinkBuilderUnitTest extends TestUtils {
HttpEntity<Void> methodWithRequestBody(@RequestBody Person param) {
return null;
}
@RequestMapping("/multipart-file")
HttpEntity<Void> methodWithMultipartFile(@RequestParam("file") MultipartFile file) {
return null;
}
}
@RequestMapping("/parent")