We don't like the default in Spring MVC to begin with. This is the current advice we give but we can't change it without causing at least as much pain.

Note that there are two aspects to this issue. One is suffix pattern matching (i.e. "/foo" also implies "/foo.*") and that can be turned off via PathMatchConfigurer. The other is content type determination and that can be either turned off completely via ContentNegotiationConfigurer or specific file extensions may be registered. Registering specific file extensions has the effect of restricting both suffix pattern matching and content type determination to the given file extensions.

Turning off suffix pattern matching and content type resolution by file extension in favor of using a query parameter (if needed) is the ideal place to be. The explicit registration of known extensions may be a good middle ground that significantly limits the feature while also minimizing the impact to existing applications.

One idea for a list of extensions is to see what was done as part of a broader fix for RFD attacks in AbstractMessageConverterMethodProcessor, look for safeExtensions. From the experience with the RFD fix, you can also see the counter-point to the tweet, i.e. why URL-based content type negotiation is still desirable sometimes, but again a query parameter should better serve such requirements.

For what it's worth on the WebFlux side we do not support mapping by file extension. Neither do we support content type negotiation by file extension. By default only HeaderContentTypeResolver is registered and you can add a ParameterContentTypeResolver (i.e. query parameter) if you want URL-based alternative but there is no built-in resolver for file name extensions.

Disable by default suffix pattern matching in Spring MVC #11105

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions