DispatcherServet.checkMultipart() does not consider javax.servlet.error.exception that has a MultipartException cause [SPR-15178]

[spring-projects-issues]

Andy Wilkinson opened SPR-15178 and commented

DispatcherServlet.checkMultipart(HttpServletRequest) attempts to avoid disturbing error rendering. It does so by checking the java.servlet.error.exception request attribute and, if its value is a MultipartException, it skips multipart resolution. As described in the referenced Spring Boot issue, error rendering is still distributed when the error exception was caused by a MultipartException but is not, itself, a MultipartException.

I've tried providing a custom DispatcherServlet that overrides checkMultipart(HttpServletRequest) and searches through all of the causes:

protected HttpServletRequest checkMultipart(HttpServletRequest request) throws MultipartException {
    if (getMultipartResolver() != null && getMultipartResolver().isMultipart(request)) {
        if (WebUtils.getNativeRequest(request, MultipartHttpServletRequest.class) != null) {
            logger.debug("Request is already a MultipartHttpServletRequest - if not in a forward, " +
                    "this typically results from an additional MultipartFilter in web.xml");
        } else {
            Throwable error = (Throwable)request.getAttribute(WebUtils.ERROR_EXCEPTION_ATTRIBUTE);
            while (error != null) {
                if (error instanceof MultipartException) {
                    logger.debug("Multipart resolution failed for current request before - " +
                            "skipping re-resolution for undisturbed error rendering");
                    return request;
                }
                error = error.getCause();
            }
            return getMultipartResolver().resolveMultipart(request);
        }
    }
    // If not returned before: return original request.
    return request;
}

It resolves the problem described above and doesn't appear to have any adverse side-effects.

---

Affects: 4.3.5

Reference URL: spring-projects/spring-boot#7936

Issue Links:

• DispatcherServlet's multipart request parsing fails during Jetty error dispatch [SPR-15231] #19796 DispatcherServlet's multipart request parsing fails during Jetty error dispatch
• HiddenHttpMethodFilter may disturb error rendering when handling malformed multipart request [SPR-15179] #19745 HiddenHttpMethodFilter may disturb error rendering when handling malformed multipart request
• CookieLocaleResolver may disturb error rendering when locale cookie has a malformed value [SPR-15182] #19748 CookieLocaleResolver may disturb error rendering when locale cookie has a malformed value

1 votes, 2 watchers