codeconsole opened a new pull request, #16186:
URL: https://github.com/apache/grails-core/pull/16186
> **Stacked on #16152.** GitHub will show this against `8.0.x` with #16152's
(and #16149's)
> commits included until that merges, at which point this rebases to just
its own commit.
`HiddenHttpMethodFilter.getHttpMethodOverride` reads `_method` on every
POST, including
multipart ones, which makes the container parse the request body. #16152
makes that read
tolerant of a parse failure, so an oversized upload no longer aborts the
filter chain - but
the read, and the parse it triggers, is still attempted every time, even for
a request
already declared (via `Content-Length`) larger than the configured
`grails.controllers.upload.maxRequestSize`.
This adds a size check ahead of the read: when `Content-Length` is known and
already over
the configured limit, skip straight to the `X-HTTP-Method-Override` header
fallback instead
of attempting a read that's going to fail anyway. Anything the check can't
rule out up front
- chunked transfer-encoding, no `Content-Length` - still goes through the
existing tolerant
read from #16152, so that safety net is unchanged. This only avoids the
doomed attempt for
the common case: a standard browser multipart form submission always declares
`Content-Length` up front, which is what `<g:uploadForm method="PUT">`
produces.
## Notes
- Legitimate uploads under the configured limit still take the existing
eager read - this
doesn't remove the read, only skips it for requests already known to
exceed the limit.
- A client that omits `Content-Length` (chunked encoding) gets no benefit
from the guard,
but is no worse off than today: the tolerant read still applies.
- `<g:uploadForm method="PUT">` keeps working; there's a test for it with
the guard
configured and a within-limit body.
## Verified
- `HiddenHttpMethodFilterTests`: a mock request whose `getParameter()`
throws (mirroring
what the container does on a real parse failure) reaches `"POST"` without
the read ever
happening for an over-limit `Content-Length`; a within-limit multipart
request with the
guard configured still honours `_method`.
- `grails-test-examples-app1`'s `FileUploadSpec` against a real embedded
Tomcat: the
oversized-upload and method-override-on-multipart cases both pass
unchanged.
- `:grails-controllers:test` passes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
