Commit Graph

246 Commits

Author SHA1 Message Date
Rossen Stoyanchev 7387cb990e Disable ext entities in SourceHttpMessageConverter
This change disables the processing of external entities in
SourceHttpMessageConverter by default and provides an option to enable
it if required.
2013-11-05 09:49:13 -05:00
Rossen Stoyanchev f9081bedb4 Add timeout async request handling to OSIV components
This change adds async web request timeout handling to OSIV filters
and interceptors to ensure the session or entity manager is released.

Issue: SPR-10874
2013-10-30 23:12:09 -04:00
Juergen Hoeller a302c4ac45 Polishing
(cherry picked from commit 52cca48)
2013-10-04 23:31:18 +02:00
Juergen Hoeller 5a49d657d8 AnnotationConfigWebApplicationContext allows for repeated register/scan calls
Restoring consistency with AnnotationConfigApplicationContext.

Issue: SPR-10852
(cherry picked from commit 01b8d93)
2013-08-28 00:24:22 +02:00
Gabriel Axel a17912d19e Fix NPE in ResourceHttpMessageConverter
ResourceHttpMessageConverter tries to use the filename to determine the
media type, but for Resource implementations such as ByteArrayResource
it is null, which causes NullPointerException. The fix checks whether
getFilename returns null before attempting to determine the media type
by it.

Issue: SPR-10848
2013-08-22 16:14:03 -04:00
Rossen Stoyanchev 2b628a1a0d Fix bug that ignored custom json prefix
Issue: SPR-10817
2013-08-08 09:39:08 -04:00
Arjen Poutsma 434735fbf6 Fix potential security risk when using Spring OXM
Disable by default external entity resolution when using Spring OXM
with jaxb. This prevents a XML entity from being able to resolve a
local file on the host system.

See:
https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing

Issue: SPR-10806
(cherry picked from commit 7576274)
2013-08-06 15:10:05 -07:00
Juergen Hoeller 20ddd3254b DelegatingFilterProxy avoids synchronization for pre-resolved delegate
Issue: SPR-10413
(cherry picked from commit c26272c)
2013-08-05 22:24:58 +02:00
Rossen Stoyanchev b0675c031e Make date methods in HttpHeaders public
Issue: SPR-10713
2013-08-05 12:46:33 -04:00
Rossen Stoyanchev 0f71da5be6 Return -1 after parse error for Expires header
Issue: SPR-10648
2013-08-05 12:38:53 -04:00
Juergen Hoeller ae0f23e942 Polishing
Issue: SPR-10752
Issue: SPR-10627
2013-07-31 22:42:27 +02:00
Rossen Stoyanchev dc87a2211c Make HTTP scheme parsing case-insensitive
Issue: SPR-10779
2013-07-30 12:33:22 -04:00
Rossen Stoyanchev cce74b8ba2 Make the JSON prefix used in converters configurable
Issue: SPR-10627
2013-07-19 17:23:33 -04:00
Rossen Stoyanchev a0f8a894f2 Cache constructor instance in WebAsyncUtils
Issue: SPR-10673
2013-07-18 17:48:18 -04:00
Phillip Webb 55f02db18e 'Rename' HttpHeaders.getIfNotModifiedSince()
Effectively rename HttpHeaders.getIfNotModifiedSince() to
getIfModifiedSince() by adding a new method and deprecating the
old one.

Issue: SPR-10600
2013-06-26 10:45:33 -07:00
Rossen Stoyanchev abfb439bfe Reverse SPR-10402 change that caused 3.2.3 regression
SPR-10402 in Spring Framework 3.2.3 treated empty request parameter
values as missing values, if the empty value was turned into a null
by a PropertyEditor or Converter. This caused the regression.

Issue: SPR-10578, SPR-10402, SPR-10584
2013-06-20 16:25:30 -04:00
Juergen Hoeller faa8430fd7 Avoid NPE in ContextLoader when dealing with an untyped ApplicationContextInitializer
Issue: SPR-10449
(cherry picked from commit a19c976)
2013-05-16 16:11:25 +02:00
Juergen Hoeller 115442242f Replaced Map synchronization with ConcurrentHashMap to avoid session access deadlocks
Issue: SPR-10436
(cherry picked from commit cd3d0c3)
2013-05-16 14:34:38 +02:00
Rossen Stoyanchev 92bbd8103b Make removal of jsessionid case insensitive
Issue: SPR-10398
2013-05-14 22:07:52 -04:00
Rossen Stoyanchev 25701ef984 Fix deadlock issue in DeferredResult
Previously DeferredResult locked around the setting of the result
including handling up to the part of submitting a dispatch. This
can cause a deadlock if a timeout occurs at the same time since
the Tomcat timeout thread has its own locking that permits only
one thread to do timeout or dispatch processing.

The fix reduces the locking to cover only the attempt to set the
DeferredResult but not the dispatching.

Issue: SPR-10485
2013-05-14 17:06:00 -04:00
Rossen Stoyanchev ad272a0c87 Close InputStream in ResourceHttpMessageConverter
Spring 3.2.2 introduced a change to avoid closing the response stream
in HttpMessageConverters (SPR-10095). However, the InputStream of
resources being written, for example as part of a multi-part request
should be closed. This change ensures that.

Issue: SPR-10460
2013-05-10 17:31:48 -04:00
Juergen Hoeller be224e1f30 ServletContextResourcePatternResolver uses encoded jar file location for UrlResource
Adding overloaded constructors for URI specification to UrlResource, as a convenience.

Issue: SPR-10471
(cherry picked from commit 1f0f46f)
2013-05-10 22:13:17 +02:00
Rossen Stoyanchev d3eda09c01 Allow treating empty @RequestParam as missing value
If type conversion turns an empty request parameter value (i.e. "") to
null, we should treat it as a missing value. By default the
ConversionService doesn't change empty strings and therefore one must
explicitly convert them to null for example by registering a
StringTrimmerEditor with emptyAsNull=true.

Issue: SPR-10402
2013-05-10 12:51:31 -04:00
Rossen Stoyanchev 4d005b6987 Improve default content type selection
Previously ContentNegotiationManager continued with the next
ContentNegotiationStrategy only if the current one returned an empty
list. Now it also does that if the current ContentNegotiationStrategy
returns "*/*". Since the absence of an Accept header and "*/*" have
the same meaning, this allows a default content type to be used in
either case.

Issue: SPR-10513
2013-05-10 12:51:08 -04:00
Juergen Hoeller 7bbd38b9e0 Fixed javadoc warnings
Issue: SPR-10373
(cherry picked from commit 1ca943c)
2013-05-07 22:06:33 +02:00
Juergen Hoeller b962239e11 Polishing 2013-05-03 13:47:54 +02:00
Juergen Hoeller 872cf6b076 Removed unnecessary HttpUrlTemplate subclass of UriTemplate 2013-05-03 13:38:31 +02:00
Juergen Hoeller b2bd319d47 Polished UriComponents implementation
(cherry picked from commit c3b624d)
2013-05-03 13:23:48 +02:00
Juergen Hoeller e3fa49063e Added note on non-thread-safety of Jackson's DateFormat support 2013-05-02 16:06:51 +02:00
Juergen Hoeller 5bdd2d245c Consistent Map/Set ordering
Use LinkedHashMaps/Sets wherever exposed to users, and code tests defensively in terms of expected Map/Set ordering. Otherwise, there'll be runtime order differences between JDK 7 and JDK 8 due to internal HashMap/Set implementation differences.

Issue: SPR-9639
(cherry picked from commit 9c09a0a)
2013-04-30 23:29:03 +02:00
Sam Brannen 12db873002 Polish Javadoc in RequestAttributes 2013-03-13 14:11:08 +01:00
Sam Brannen bf6ee1631c Fix copy-n-paste errors in NativeWebRequest 2013-03-13 13:00:57 +01:00
Rossen Stoyanchev 8ab8e4f7c2 Make the methodParameter field of HandlerMethod final
Previously the methodParameter array field was initialized lazily since
it requires reflection. However, in practice the field is always used
and there is not much benefit from the lazy initialization.

In Spring Framework 3.2, the methodParameter field was copied when a
new HandlerMethod instance (with the resolved bean) is created for
performance reasons. That introduced a synchronization issue since
the lazy initialization was not synchronized.

Issue: SPR-10365
2013-03-10 12:54:03 -04:00
Oliver Gierke 3eb3610660 UriComponentsBuilder parse of empty fragments
Check for an empty fragment in UriComponentsBuilder.fromUriString(...)
to prevent the invocation of fragment(...).

Previously, UriComponentsBuilder.fromUriString(...) threw an exception
in the case of an empty fragment being provided (e.g. /example#).

Issue: SPR-10363
2013-03-08 22:15:26 -08:00
Rossen Stoyanchev 8e4e0f3531 Use null in MockServletContext for unknown mime types
MockServletContext.getMimeTypes now returns null if the Java Activation
Framework returns "application/octet-stream", which is the default
media type it returns if the mime type is unknown. This enforces the
contract for ServletContext.getMimeTypes (return null for uknown mime
types) but does mean "application/octet-stream" cannot be returned.

Issue: SPR-10334
2013-03-07 12:33:44 -05:00
Phillip Webb 05765d7520 Replace EasyMock with Mockito
Issue: SPR-10126
2013-03-06 11:06:15 -08:00
Rossen Stoyanchev 3abe05c65e Update @RequestParam javadoc
Issue: SPR-10180
2013-03-01 16:30:02 -05:00
Chris Beams 0e8c950f7d Re-enable JaxWsSupportTests
These tests still fail under Eclipse for unknown reasons, but do work
under Gradle, so are thus re-enabled by removing the @Ignore.

Issue: SPR-10074
2013-02-26 14:26:32 +01:00
Phillip Webb e2e4cbe6b3 Deprecate HttpStatus.MOVED_TEMPORARILY
Deprecate HttpStatus.MOVED_TEMPORARILY in favor of HttpStatus.FOUND
since HttpStatus.valueOf(302) will always return FOUND.

The name of the 302 status code was changed between HTTP 1.0 and
HTTP 1.1 but the underlying meaning remains the same.

Issue: SPR-10300
2013-02-25 11:56:57 -08:00
Phillip Webb 5b7969e726 Fix UriComponents.equals() method
Fix HierarchicalUriComponents and OpaqueUriComponents .equals() methods.

Issue: SPR-10313
2013-02-19 13:19:42 -08:00
Rossen Stoyanchev 5b1165b102 Ignore path parameters in request mappings
Before this change the presence of path params (e.g. "/foo;q=1/bar")
expected the request mapping to contain a URI variable in the place of
semicolon content (e.g. either "/{foo}/bar" or "/{foo};{fooParams}").

The change ensures path params are ignored in @RequestMapping patterns
so that "/foo/bar" matches to "/foo;q=1/bar" as well as
"/foo;q=1;p=2/bar".

Along with this change, the RequestMappingHandlerMapping no longer
defaults to having semicolon content removed from the URL, which means
@MatrixVariable is supported by default without the need for any
further configuration.

Issue: SPR-10234
2013-02-15 11:31:32 -05:00
Juergen Hoeller ff15534211 Log4jWebConfigurer supports resolving placeholders against ServletContext init-parameters as well
Introducing a ServletContextPropertyUtils helper (analogous to SystemPropertyUtils) along the way.

Issue: SPR-10284
2013-02-15 13:32:44 +01:00
Rossen Stoyanchev 221562dbeb Use default value for empty values in @RequestParam
Issue: SPR-10180
2013-02-15 07:25:26 -05:00
Rossen Stoyanchev f5c9fe69a4 Update JavaScriptUtils
Add escaping for <, >, and PS/LS line terminators

Issue: SPR-9983
2013-02-15 06:38:40 -05:00
Phillip Webb 6e5cb7fbcd Protect against '//' in UriComponentsBuilder
Refactor UriComponentsBuilder to ensure that paths do not contain empty
segments.

For example, prior to this commit:

    fromUriString("http://example.com/abc/").path("/x/y/z")

would build the URL "http://example.com/abc//x/y/z" where as it will
now build "http://example.com/abc/x/y/z".

Issue: SPR-10270
2013-02-14 21:10:23 -08:00
Phillip Webb 92ad66bf10 Add setOutputStreaming option for HTTP factory
Add setOutputStreaming on SimpleClientHttpRequestFactory to allow the
disabling of 'output streaming' mode on the underlying connection so
that authentication and redirection can be handled automatically.

Issue: SPR-9617
2013-02-13 11:52:23 -08:00
Phillip Webb 6661788748 Ensure HTTP classes don't close streams
Prior to this commit several HTTP classes made use of FileCopyUtils
when reading from or writing to streams. This has the unfortunate
side effect of closing streams that should really be left open.

The problem is particularly noticeable when dealing with a
FormHttpMessageConverter that is writing a multi-part response.

Relevant HTTP classes have now been refactored to make use of a new
StreamUtils class that works in a similar way FileCopyUtils but does
not close streams.

The NonClosingOutputStream class from SimpleStreamingClientHttpRequest
has also been refactored to a StreamUtils method.

Issue: SPR-10095
2013-02-11 19:04:53 -08:00
Phillip Webb 2ca75386f1 Align UriComponents.toUri() with toUriString()
Update HierarchicalUriComponents.toUri() to only prepend a missing '/'
when the scheme, user info, host or port are specified. This makes
the toUri() method behave in the same way as .toUriString() and allows
relative URIs to be created.

Issue: SPR-10231
2013-02-11 12:14:06 -08:00
Phillip Webb 203b22b246 UriComponentsBuilder supports query without value
Fix UriComponentsBuilder to support query parameters that do not
include a value without losing '='. The following styles are now
supported:

    http://example.com/foo?bar=baz
    http://example.com/foo?bar=
    http://example.com/foo?bar

Issue: SPR-10215
2013-02-11 12:13:54 -08:00
Phillip Webb f32ce3a613 Make HierarchicalUriComponents Serializable
(fix apache header copyright dates)

Issue: SPR-10266
2013-02-11 09:25:30 -08:00