spring-framework

Spring Framework

Tree: c77993acac

Brian Clozel a3f7179ab3 Fix InvalidMimeTypeException for compatible media types The `AbstractMessageConverterMethodProcessor` is in charge of handling controller method return values and to write those as HTTP response messages. The content negotiation process is an important part. The `MimeTypeUtils#sortBySpecificity` is in charge of sorting inbound "Accept" media types by their specificity and reject them if the list is too large, in order to protect the application from ddos attacks. Prior to this commit, the content negotiation process would first get the sorted "Accept" media types, the producible media types as advertized by message converters - and collect the intersection of both in a new list (also sorted by specificity). If the "Accept" list is large enough (but under the limit), the list of compatible media types could exceed that limit because duplicates could be introduced in that list: several converters can produce the same content type. This commit ensures that compatible media types are collected in a set to avoid duplicates. Without that, exceeding the limit at this point will throw an `InvalidMimeTypeException` that's not handled by the processor and result in a server error. Fixes gh-36300	1 month ago
..
src	Fix InvalidMimeTypeException for compatible media types	1 month ago
spring-webmvc.gradle	Fix collection support in AbstractKotlinSerializationHttpMessageConverter	10 months ago

Brian Clozel a3f7179ab3 Fix InvalidMimeTypeException for compatible media types

The `AbstractMessageConverterMethodProcessor` is in charge of handling
controller method return values and to write those as HTTP response
messages. The content negotiation process is an important part.

The `MimeTypeUtils#sortBySpecificity` is in charge of sorting inbound
"Accept" media types by their specificity and reject them if the list
is too large, in order to protect the application from ddos attacks.

Prior to this commit, the content negotiation process would first get
the sorted "Accept" media types, the producible media types as
advertized by message converters - and collect the intersection of both
in a new list (also sorted by specificity). If the "Accept" list is
large enough (but under the limit), the list of compatible media types
could exceed that limit because duplicates could be introduced in that
list: several converters can produce the same content type.

This commit ensures that compatible media types are collected in a set
to avoid duplicates. Without that, exceeding the limit at this point
will throw an `InvalidMimeTypeException` that's not handled by the
processor and result in a server error.

Fixes gh-36300

1 month ago

src

Fix InvalidMimeTypeException for compatible media types

1 month ago

spring-webmvc.gradle

Fix collection support in AbstractKotlinSerializationHttpMessageConverter

10 months ago