codeconsole opened a new pull request, #16759: URL: https://github.com/apache/grails-core/pull/16759
Fixes #15921. Once any filter reads a request parameter, the servlet container decodes the request body, and it uses ISO-8859-1 unless a character encoding has been set by then. Grails registers its character encoding filter at order -180, so a filter ordered ahead of it that reads a parameter garbles every non-ASCII form field for the rest of the request: a controller receives `Café – ðŸ‚` for `Café – 🍂`. The CAS plugin's single sign-out filter is one such filter. It is registered at `Ordered.HIGHEST_PRECEDENCE` and reads `logoutRequest` from every POST, so any app with single sign-out enabled (the default) has this bug, which is what #15921 reports. Spring Boot registers its own encoding filter at `Ordered.HIGHEST_PRECEDENCE` for this reason. This PR does the same for Grails': - `GrailsFilters.CHARACTER_ENCODING_FILTER` is now `Ordered.HIGHEST_PRECEDENCE`. - The CAS plugin registers its single sign-out filter one order after the encoding filter. Moving the encoding filter alone isn't enough: a `FilterRegistrationBean` at the same order still runs first. I checked this by putting CAS back at `HIGHEST_PRECEDENCE`, and the CAS reproducer below failed again. One side effect: with `grails.filter.forceEncoding: true`, the response encoding is now set before filters that used to run ahead of the encoding filter, including on responses those filters write themselves. The upgrade notes mention it. #### Tests - app1: `CharacterEncodingSpec` posts a form, with no charset, through a filter at `HIGHEST_PRECEDENCE + 1` that reads one of its parameters, and checks that the filter and the controller both get the text as typed. - CAS example: `SingleSignOutEncodingSpec` posts `Café – 🍂` to an echo action with single sign-out enabled. Both specs fail without the fix (`Café – ðŸ‚`) and pass with it. These also pass: `codeStyle`, `rat`, the `grails-web-common` and `grails-controllers` tests, app1's integration tests, and the CAS example's. #### Docs - The filter-ordering section of the plugin guide now says where the encoding filter sits. Its example moved to `HIGHEST_PRECEDENCE + 1`. - The upgrade guide has a new section, "21. The character encoding filter runs first". #### Merging up 8.0.x restructured the CAS example, which now runs a CAS container and has its specs in `grails.plugin.springsecurity.cas.test`. At the 7.2.x → 8.0.x merge, `EchoController` and `SingleSignOutEncodingSpec` need to move into that structure. For 9.0.x, a separate PR (link to follow) drops Grails' encoding filter in favour of Spring Boot's. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
