root
/
spring-boot
mirror of https://github.com/spring-projects/spring-boot.git
1
0
Fork 0
Code Issues Actions Packages Projects Releases Wiki Activity

Disable HiddenHttpMethodFilter by default 

HiddenHttpMethodFilter can be problematic as it causes early
consumption of a request body if the body may contain parameters. This
happens as the filter needs to read the parameters to see if an
_method parameter is present. The filter is only beneficial for web
applications that are the hidden HTTP method functionality but is
potentially detriimental to all applications that are not. As such
we no longer believe that it should be enabled by default and users
should be required to opt in.

Closes gh-16953
This commit is contained in:
Andy Wilkinson 2019-07-04 14:50:01 +01:00
parent 2af815f2cf
commit 6a777a7f9b
5 changed files with 19 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/reactive/WebFluxAutoConfiguration.java
View File

@ -86,7 +86,7 @@ public class WebFluxAutoConfiguration {
@Bean
@ConditionalOnMissingBean(HiddenHttpMethodFilter.class)
@ConditionalOnProperty(prefix = "spring.webflux.hiddenmethod.filter", name = "enabled", matchIfMissing = true)
@ConditionalOnProperty(prefix = "spring.webflux.hiddenmethod.filter", name = "enabled", matchIfMissing = false)
public OrderedHiddenHttpMethodFilter hiddenHttpMethodFilter() {
return new OrderedHiddenHttpMethodFilter();
}

2
spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/servlet/WebMvcAutoConfiguration.java
View File

@ -153,7 +153,7 @@ public class WebMvcAutoConfiguration {
@Bean
@ConditionalOnMissingBean(HiddenHttpMethodFilter.class)
@ConditionalOnProperty(prefix = "spring.mvc.hiddenmethod.filter", name = "enabled", matchIfMissing = true)
@ConditionalOnProperty(prefix = "spring.mvc.hiddenmethod.filter", name = "enabled", matchIfMissing = false)
public OrderedHiddenHttpMethodFilter hiddenHttpMethodFilter() {
return new OrderedHiddenHttpMethodFilter();
}

19
spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/reactive/WebFluxAutoConfigurationTests.java
View File

@ -302,22 +302,23 @@ class WebFluxAutoConfigurationTests {
}
@Test
void hiddenHttpMethodFilterIsAutoConfigured() {
this.contextRunner.run((context) -> assertThat(context).hasSingleBean(OrderedHiddenHttpMethodFilter.class));
void hiddenHttpMethodFilterIsDisabledByDefault() {
this.contextRunner.run((context) -> assertThat(context).doesNotHaveBean(HiddenHttpMethodFilter.class));
}
@Test
void hiddenHttpMethodFilterCanBeOverridden() {
this.contextRunner.withUserConfiguration(CustomHiddenHttpMethodFilter.class).run((context) -> {
assertThat(context).doesNotHaveBean(OrderedHiddenHttpMethodFilter.class);
assertThat(context).hasSingleBean(HiddenHttpMethodFilter.class);
});
this.contextRunner.withPropertyValues("spring.webflux.hiddenmethod.filter.enabled=true")
.withUserConfiguration(CustomHiddenHttpMethodFilter.class).run((context) -> {
assertThat(context).doesNotHaveBean(OrderedHiddenHttpMethodFilter.class);
assertThat(context).hasSingleBean(HiddenHttpMethodFilter.class);
});
}
@Test
void hiddenHttpMethodFilterCanBeDisabled() {
this.contextRunner.withPropertyValues("spring.webflux.hiddenmethod.filter.enabled=false")
.run((context) -> assertThat(context).doesNotHaveBean(HiddenHttpMethodFilter.class));
void hiddenHttpMethodFilterCanBeEnabled() {
this.contextRunner.withPropertyValues("spring.webflux.hiddenmethod.filter.enabled=true")
.run((context) -> assertThat(context).hasSingleBean(OrderedHiddenHttpMethodFilter.class));
}
@Test

2
spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/servlet/FilterOrderingIntegrationTests.java
View File

@ -30,6 +30,7 @@ import org.springframework.boot.autoconfigure.context.PropertyPlaceholderAutoCon
import org.springframework.boot.autoconfigure.http.HttpMessageConvertersAutoConfiguration;
import org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration;
import org.springframework.boot.autoconfigure.session.SessionAutoConfiguration;
import org.springframework.boot.test.util.TestPropertyValues;
import org.springframework.boot.testsupport.web.servlet.MockServletWebServer.RegisteredFilter;
import org.springframework.boot.web.server.WebServerFactoryCustomizerBeanPostProcessor;
import org.springframework.boot.web.servlet.context.AnnotationConfigServletWebServerApplicationContext;
@ -89,6 +90,7 @@ class FilterOrderingIntegrationTests {
TestRedisConfiguration.class, WebMvcAutoConfiguration.class, SecurityAutoConfiguration.class,
SessionAutoConfiguration.class, HttpMessageConvertersAutoConfiguration.class,
PropertyPlaceholderAutoConfiguration.class, HttpEncodingAutoConfiguration.class);
TestPropertyValues.of("spring.mvc.hiddenmethod.filter.enabled:true").applyTo(this.context);
this.context.refresh();
}

10
spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/servlet/WebMvcAutoConfigurationTests.java
View File

@ -483,14 +483,14 @@ class WebMvcAutoConfigurationTests {
}
@Test
void hiddenHttpMethodFilterCanBeDisabled() {
this.contextRunner.withPropertyValues("spring.mvc.hiddenmethod.filter.enabled=false")
.run((context) -> assertThat(context).doesNotHaveBean(HiddenHttpMethodFilter.class));
void hiddenHttpMethodFilterCanBeEnabled() {
this.contextRunner.withPropertyValues("spring.mvc.hiddenmethod.filter.enabled=true")
.run((context) -> assertThat(context).hasSingleBean(HiddenHttpMethodFilter.class));
}
@Test
void hiddenHttpMethodFilterEnabledByDefault() {
this.contextRunner.run((context) -> assertThat(context).hasSingleBean(HiddenHttpMethodFilter.class));
void hiddenHttpMethodFilterDisabledByDefault() {
this.contextRunner.run((context) -> assertThat(context).doesNotHaveBean(HiddenHttpMethodFilter.class));
}
@Test