jdaugherty commented on PR #16631:
URL: https://github.com/apache/grails-core/pull/16631#issuecomment-6420292135
@jamesfredley, I pushed d0011c6b80 over dcc4f0646e, still a single commit on
9.0.x. It fixes two more problems:
- **Form bodies consumed by attribution:** to describe a request, the
capture read the servlet request's parameter map, even before checking whether
a controller had been resolved. For an `application/x-www-form-urlencoded`
POST, that makes the container parse the body. An application that read the raw
body after a statement had run, for example a filter that queries first, then
got an empty stream. Attribution now never touches the request parameters:
- Before the URL mapping has run, it records only the shape of the path,
as before.
- After that, it uses the parameters the Grails mapping already holds,
plus query-string values it parses itself and decodes as the container does.
- **JSON-escaped MongoDB field names:** the record writer and the CLI
scanned quotes by SQL rules, where a quote is escaped by doubling it. MongoDB
command keys escape a quote with a backslash, so `"a\" b"` and `"a\" b"` were
written as the same statement, and `"a\" from b"` was collapsed as if it were a
SQL select. A recorded MongoDB command is recognised by its shape: a name, an
optional namespace, then a document opening with `{"`. It is now written
exactly as recorded, escaping only tabs, line breaks and backslashes, and the
CLI shows it as recorded instead of reading it as SQL.
Tests:
- **`QueryTailRequestAttributionSpec`:** posts a form to a request whose
parameter getters use up the body, as the Servlet spec says a container does.
It checks that the body is intact before and after the mapping has run, and
that query-string values in the path are still redacted. The existing
query-string features now set a real query string instead of parameters.
- **`QueryTailRecordSpec`, `StatementCollapserSpec`,
`QueryTailSummarySpec`:** cover commands whose names differ only in spaces
after an escaped quote, or hold a clause word. They check the write, read,
normalization and counting paths, plus statements that only resemble a command.
- **`QueryTailCommandListenerSpec`:** runs the two field names against
MongoDB. The database tells them apart, and so does the capture.
- Against the previous code, the new features fail; with the fix they pass.
A real embedded-Tomcat POST also reads its body intact with capture on.
Locally, `:grails-datamapping-core:check` passes, as do the MongoDB, Neo4j,
H5 and H7 query-tail specs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
