Document type support in JSP <form:input> and point to <form:password>

Prior to this commit, the reference manual mentioned that the JSP
<form:input> tag supports HTML5-specific types, but the Javadoc and
spring-form.tld did not document the `type` attribute at all, and none
of the documentation explained which types are supported or that
<form:password> must be used for password fields.

This commit updates the documentation as follows.

- Document in InputTag, spring-form.tld, and the reference manual that
  a `type` can be supplied as a dynamic attribute, that `checkbox` and
  `radio` are not supported, and that the bound value is rendered as-is.
- Add notes to InputTag, the reference manual, and spring-form.tld
  stating that <form:input type="password"> must not be used and that
  <form:password> should be used instead.
- Document in PasswordInputTag, spring-form.tld, and the reference
  manual that <form:password> does not render the bound value by default.

Closes gh-37376

framework-docs/modules/ROOT/pages/web/webmvc-view/mvc-jsp.adoc

@@ -45,10 +45,10 @@ or see the tag library description.
 [[mvc-view-jsp-formtaglib]]
 == Spring's form tag library
 
-As of version 2.0, Spring provides a comprehensive set of data binding-aware tags for
-handling form elements when using JSP and Spring Web MVC. Each tag provides support for
-the set of attributes of its corresponding HTML tag counterpart, making the tags
-familiar and intuitive to use. The tag-generated HTML is HTML 4.01/XHTML 1.0 compliant.
+Spring provides a comprehensive set of data binding-aware tags for handling form elements
+when using JSP and Spring Web MVC. Each tag provides support for the set of attributes of
+its corresponding HTML tag counterpart, making the tags familiar and intuitive to use.
+The tag-generated HTML is HTML 4.01/XHTML 1.0 compliant.
 
 Unlike other form/input tag libraries, Spring's form tag library is integrated with
 Spring Web MVC, giving the tags access to the command object and reference data your
@@ -74,7 +74,7 @@ page:
 where `form` is the tag name prefix you want to use for the tags from this library.
 
 [[mvc-view-jsp-formtaglib-formtag]]
-=== The Form Tag
+=== The `form` Tag
 
 This tag renders an HTML 'form' element and exposes a binding path to inner tags for
 binding. It puts the command object in the `PageContext` so that the command object can
@@ -163,9 +163,14 @@ following example shows:
 [[mvc-view-jsp-formtaglib-inputtag]]
 === The `input` Tag
 
-This tag renders an HTML `input` element with the bound value and `type='text'` by default.
-For an example of this tag, see <<mvc-view-jsp-formtaglib-formtag,The Form Tag>>. You can also use
-HTML5-specific types, such as `email`, `tel`, `date`, and others.
+This tag renders an HTML `input` element with the bound value and `type='text'` by
+default. For an example of this tag, see <<mvc-view-jsp-formtaglib-formtag>>. You can
+also use HTML5-specific types, such as `email`, `tel`, `date`, and others, by supplying a
+`type` attribute. See <<mvc-view-jsp-formtaglib-html5>> for details.
+
+NOTE: Do not use the `input` tag with `type='password'`. Use the
+<<mvc-view-jsp-formtaglib-passwordtag,`password` tag>> instead, since it does not render
+the bound value by default.
 
 [[mvc-view-jsp-formtaglib-checkboxtag]]
 === The `checkbox` Tag
@@ -374,6 +379,8 @@ by using `itemValue` and the label by using `itemLabel`, as the following exampl
 === The `password` Tag
 
 This tag renders an HTML `input` tag with the type set to `password` with the bound value.
+Use this tag, instead of the <<mvc-view-jsp-formtaglib-inputtag,`input` tag>> with
+`type='password'`, for password fields.
 
 [source,xml,indent=0,subs="verbatim,quotes"]
 ----
@@ -805,7 +812,15 @@ Kotlin::
 The Spring form tag library allows entering dynamic attributes, which means you can
 enter any HTML5 specific attributes.
 
-The form `input` tag supports entering a type attribute other than `text`. This is
-intended to allow rendering new HTML5 specific input types, such as `email`, `date`,
-`range`, and others. Note that entering `type='text'` is not required, since `text`
-is the default type.
+The form `input` tag supports entering a `type` attribute other than `text`. This is
+intended to allow rendering HTML5 specific input types, such as `email`, `date`, `range`,
+and others. Note that entering `type='text'` is not required, since `text` is the default
+type.
+
+The `input` tag does not support `type='checkbox'` or `type='radio'`. Use the
+<<mvc-view-jsp-formtaglib-checkboxtag,`checkbox`>> and
+<<mvc-view-jsp-formtaglib-radiobuttontag,`radiobutton`>> tags instead. For any supported
+type, the bound value is rendered as-is.
+
+NOTE: Do not use `type='password'` with the `input` tag. Use the
+<<mvc-view-jsp-formtaglib-passwordtag,`password` tag>> for password fields.

spring-webmvc/src/main/java/org/springframework/web/servlet/tags/form/InputTag.java

@@ -25,6 +25,16 @@ import org.jspecify.annotations.Nullable;
  * The {@code <input>} tag renders an HTML 'input' tag with type 'text' using
  * the bound value.
  *
+ * <p>A different {@code type}, such as {@code email}, {@code tel}, {@code date},
+ * or {@code range}, may be supplied as a dynamic attribute. The bound value is
+ * rendered as-is for any supported {@code type}. {@code checkbox} and
+ * {@code radio} are not supported; use the {@code <checkbox>} and {@code <radio>}
+ * tags instead.
+ *
+ * <p><strong>NOTE:</strong> Do not use this tag with {@code type="password"}.
+ * Use the {@code <password>} tag ({@link PasswordInputTag}) for password fields,
+ * since it does not render the bound value unless explicitly configured to do so.
+ *
  * <h3>Attribute Summary</h3>
  * <table>
  * <thead>
@@ -381,6 +391,8 @@ public class InputTag extends AbstractHtmlInputElementTag {
 	/**
 	 * Flags {@code type="checkbox"} and {@code type="radio"} as illegal
 	 * dynamic attributes.
+	 * <p>Any other {@code type} is permitted, but {@code type="password"} should
+	 * not be used with this tag. Use {@link PasswordInputTag} instead.
 	 */
 	@Override
 	protected boolean isValidDynamicAttribute(String localName, Object value) {

spring-webmvc/src/main/java/org/springframework/web/servlet/tags/form/PasswordInputTag.java

@@ -22,6 +22,10 @@ import jakarta.servlet.jsp.JspException;
  * The {@code <password>} tag renders an HTML 'input' tag with type 'password'
  * using the bound value.
  *
+ * <p>Use this tag instead of the {@code <input>} tag ({@link InputTag}) with
+ * {@code type="password"} for password fields. By default, the bound value is
+ * not rendered.
+ *
  * <h3>Attribute Summary</h3>
  * <table>
  * <thead>

spring-webmvc/src/main/resources/META-INF/spring-form.tld

@@ -198,7 +198,7 @@
 	</tag>
 
 	<tag>
-		<description>Renders an HTML 'input' tag with type 'text' using the bound value.</description>
+		<description>Renders an HTML 'input' tag with type 'text' using the bound value. A different type (for example, 'email' or 'date') may be supplied as a dynamic attribute, but 'checkbox' and 'radio' are not supported. Do not use this tag for passwords; use the 'password' tag instead.</description>
 		<name>input</name>
 		<tag-class>org.springframework.web.servlet.tags.form.InputTag</tag-class>
 		<body-content>empty</body-content>
@@ -395,7 +395,7 @@
 	</tag>
 
 	<tag>
-		<description>Renders an HTML 'input' tag with type 'password' using the bound value.</description>
+		<description>Renders an HTML 'input' tag with type 'password'. The bound value is not rendered unless 'showPassword' is true. Use this tag instead of 'input' with type 'password'.</description>
 		<name>password</name>
 		<tag-class>org.springframework.web.servlet.tags.form.PasswordInputTag</tag-class>
 		<body-content>empty</body-content>