Replacing default multipart filter implementation (problematic com.oreilly.servlet package license terms) (MAGNOLIA-540)

[MAGNOLIA-2033] MultipartRequestFilter chockes on requests with an action URL with a parameter without value Created: 01/Feb/08  Updated: 04/Nov/15  Resolved: 04/Nov/15

Status: Closed
Project: Magnolia
Component/s: core
Affects Version/s: 3.5.3
Fix Version/s: None

Type: Sub-task Priority: Minor
Reporter: Philippe Marschall Assignee: Philipp Bärfuss
Resolution: Won't Do Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified
Environment:

Windows XP, Java 1.6.0_03, Tomcat 6.0.13


Template:
Date of First Response:

 Description   

A paragraph with the following JSP

<jsp:root version="2.0"
  xmlns="http://www.w3.org/1999/xhtml"
  xmlns:jsp="http://java.sun.com/JSP/Page">
  
  <form method="POST" action="?aParamter" enctype="multipart/form-data" accept-charset="utf-8">
    <input type="hidden" name="a_hidden_field" value="a_hidden_value" />
    <input type="submit"/>
  </form>
  
</jsp:root>

will create the following stack trace

java.lang.IllegalArgumentException
	javax.servlet.http.HttpUtils.parseQueryString(HttpUtils.java:103)
	com.oreilly.servlet.MultipartRequest.<init>(MultipartRequest.java:230)
	info.magnolia.cms.filters.CosMultipartRequestFilter.parseParameters(CosMultipartRequestFilter.java:94)
	info.magnolia.cms.filters.CosMultipartRequestFilter.doFilter(CosMultipartRequestFilter.java:81)
	info.magnolia.cms.filters.AbstractMgnlFilter.doFilter(AbstractMgnlFilter.java:70)
	info.magnolia.cms.filters.MgnlFilterChain.doFilter(MgnlFilterChain.java:71)
	info.magnolia.cms.security.BaseSecurityFilter.doFilter(BaseSecurityFilter.java:60)
	info.magnolia.cms.filters.AbstractMgnlFilter.doFilter(AbstractMgnlFilter.java:70)
	info.magnolia.cms.filters.MgnlFilterChain.doFilter(MgnlFilterChain.java:71)
	info.magnolia.cms.security.LogoutFilter.doFilter(LogoutFilter.java:81)
	info.magnolia.cms.filters.OncePerRequestAbstractMgnlFilter.doFilter(OncePerRequestAbstractMgnlFilter.java:62)
	info.magnolia.cms.filters.MgnlFilterChain.doFilter(MgnlFilterChain.java:71)
	info.magnolia.cms.security.auth.login.LoginFilter.doFilter(LoginFilter.java:76)
	info.magnolia.cms.filters.AbstractMgnlFilter.doFilter(AbstractMgnlFilter.java:70)
	info.magnolia.cms.filters.MgnlFilterChain.doFilter(MgnlFilterChain.java:71)
	info.magnolia.enterprise.registration.RegistrationFilter.doFilter(RegistrationFilter.java:54)
	info.magnolia.cms.filters.AbstractMgnlFilter.doFilter(AbstractMgnlFilter.java:70)
	info.magnolia.cms.filters.MgnlFilterChain.doFilter(MgnlFilterChain.java:71)
	info.magnolia.cms.filters.ContentTypeFilter.doFilter(ContentTypeFilter.java:73)
	info.magnolia.cms.filters.AbstractMgnlFilter.doFilter(AbstractMgnlFilter.java:70)
	info.magnolia.cms.filters.MgnlFilterChain.doFilter(MgnlFilterChain.java:71)
	info.magnolia.cms.filters.ContextFilter.doFilter(ContextFilter.java:72)
	info.magnolia.cms.filters.AbstractMgnlFilter.doFilter(AbstractMgnlFilter.java:70)
	info.magnolia.cms.filters.MgnlFilterChain.doFilter(MgnlFilterChain.java:71)
	info.magnolia.cms.filters.CompositeFilter.doFilter(CompositeFilter.java:64)
	info.magnolia.cms.filters.AbstractMgnlFilter.doFilter(AbstractMgnlFilter.java:70)
	info.magnolia.cms.filters.MgnlMainFilter.doFilter(MgnlMainFilter.java:98)
	info.magnolia.cms.filters.MgnlMainFilter.doFilter(MgnlMainFilter.java:195)


 Comments   
Comment by Philippe Marschall [ 01/Feb/08 ]

Removed curly braces around JSP, multi line monospace doesn't seem to work
-> you can use the

{ code }

macro to surround code snippets

Comment by Philipp Bracher [ 01/Feb/08 ]

Decreased priority. Ether you do a post, so you should provide the additional parameter in a field or you use get.

As the exception occurs in javax.servlet.http.HttpUtils (deprecated) by a call from com.oreilly.servlet.MultipartRequest there is little we can/should do against it.

It is planed to move to commons fileupload anyway (filter is already in place)

Comment by Michael Mühlebach [ 04/Nov/15 ]

Given the thousands of other issues we have open that are more highly requested, we won't be able to address this issue in the foreseeable future. Instead we will focus on issues with a higher impact, and more votes.
Thanks for taking the time to raise this issue. As you are no doubt aware this issue has been on our backlog for some time now with very little movement.
I'm going to close this to set expectations so the issue doesn't stay open for years with few updates. If the issue is still relevant please feel free to reopen it or create a new issue.

Generated at Mon Feb 12 03:32:45 CET 2024 using Jira 9.4.2#940002-sha1:46d1a51de284217efdcb32434eab47a99af2938b.