codeconsole commented on PR #16146:
URL: https://github.com/apache/grails-core/pull/16146#issuecomment-5303473093
It seems like there is still 1 issue with oversized on this PR. I came up
with a proposal that doesn't require any extra infrastructure. It just ignores
the multipart and kicks it down the line to where it is normally handled in the
Spring Dispatcher Servlet.
Unfortunately, the PR had to be stacked on top of my other performance PR so
you can't see a clean diff, but if you compare the changes between the two it
will be more obvious. Feel free to take whatever you want from It, expand on
it, or bring any of the ideas over here.
I think we should consider exploring default disabling the Hidden Method
Filter like Spring Boot does. What are your thoughts?
# Test Results
What an application actually receives when a multipart upload exceeds the
configured limit
(200 KB payload against the default 128000-byte `maxRequestSize`).
- **No fix** — `8.0.x` @ `a83f87480e`
- **#16146** — `fix/issue-16145` @ `6fe63b8486` (early `MultipartFilter`)
- **#16152** — `fix/multipart-lean-8.0.x` (tolerate the parse failure, defer
to `checkMultipart`)
Every row is same-app, same-config, same probe — only the framework code
differs.
| Container | Case | No fix | #16146 | #16152 |
|---|---|---|---|---|
| Tomcat 11 | Oversized, no security, `"413"` mapping | `500` raw Tomcat
HTML | `500` raw Tomcat HTML | **`413`** `{"error":"Content Too
Large","handledBy":"errors.tooLarge"}` |
| Tomcat 11 | Oversized, Spring Security on the chain | `413` raw Tomcat
HTML | `413` raw Tomcat HTML | **`413`** application's handler |
| Tomcat 11 | Normal upload | `200` | `200` | `200` |
| Tomcat 11 | `<g:uploadForm method="PUT">` | `200`, method `PUT` | `200`,
method `PUT` | `200`, method `PUT` |
| Jetty 12 | Oversized | `400` "Bad Request" — Boot's generic error,
indistinguishable from a malformed request | *not measured* | **`413`**
application's handler |
| Undertow 2.4 | Oversized | `413`, empty body | *not measured* | `413`,
empty body — **unchanged** |
`#16146` was run on Tomcat only. Its Jetty and Undertow cells are blank
because they were not measured,
not because they are known to be unchanged.
Undertow applies the limit while reading the request entity, so no filter
and no servlet run. Nothing the
framework does can influence it; the limitation is documented and pinned by
a spec.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
