3286 Commits
Author SHA1 Message Date
rstoyanchev 33988a4621 Refine lost connection checks in DefaultHandlerExceptionResolver
This commit adds additional "disconnected client" checks for
HttpMessageNotReadableException and HttpMessageNotWriteableException,
both of which wrap I/O errors and could be due to a lost connection.

Closes gh-37151
2026-09-15 16:26:37 +01:00
Brian Clozel c1d4a76692 Merge branch '7.0.x' 2026-09-10 16:59:22 +02:00
Brian Clozel bcd78a2ccc Add implementation note in DefaultAsyncServerResponse
See gh-37257
2026-09-10 16:59:06 +02:00
Brian Clozel 30a07ed551 Merge branch '7.0.x' 2026-09-08 11:59:09 +02:00
Brian Clozel 3c6b001349 Reuse existing async timeout in DefaultAsyncServerResponse
Prior to this commit, calling `DefaultAsyncServerResponse.writeAsync()`
would  unconditionally create a new `AsyncWebRequest` and install it
on the `WebAsyncManager`, even when one is already present for the
current request.
The functional web framework can do such a thing when returning a
`ServerResponse.async(future)` from a `HandlerFunction`; the
`HandlerFunctionAdapter` does install an async web request already.

This means that the async timeout configured at the application level
would be ignored and instead falling back to the Servlet container
default.

This commit makes the `DefaultAsyncServerResponse` skip async web
request creation it there is an existing one.

Fixes gh-37257
2026-09-08 11:48:40 +02:00
Sunghyun Shin 19fdc0b77c Migrate responseBodyAdvice test to Jackson 3 converter
Migrate RequestMappingHandlerAdapterTests#responseBodyAdvice from the
deprecated MappingJackson2HttpMessageConverter to
JacksonJsonHttpMessageConverter.

The test advice now implements ResponseBodyAdvice directly and returns a
map body that is written by the selected converter.

This maintains the test coverage for gh-22638, verifying that a
ControllerAdvice implementing both ResponseBodyAdvice and
RequestBodyAdvice is not registered twice.

Signed-off-by: Sunghyun Shin <froggy0m0a@gmail.com>
2026-09-04 18:21:37 +02:00
Brian Clozel 60e5abff7f Enforce "data: " prefix for outgoing SSE data payloads
Prior to this commit, SSE support in Spring would write payloads with
the "data:" prefix (without space). While this is OK with the standard,
this makes it harder for implementations to support reading and writing
payloads with Spring (the round trip use case).

This commit introduces a breaking change and now enforces "data: " in
all variants. This has the potential of breaking some low level test
suites with text/plain or custom media types, but this should overall
make the situation better for developers.

Closes gh-37242
2026-09-04 16:21:13 +02:00
froggy0m0 0de56c41df Remove stray TODO in exception handler tests
Closes gh-37003

Signed-off-by: Sunghyun Shin <79225728+froggy0m0@users.noreply.github.com>
2026-09-03 13:55:58 +02:00
rstoyanchev e2235b702a Merge branch '7.0.x' 2026-09-02 10:00:49 +01:00
rstoyanchev 7da197de66 More updates for Data Binding doc restructuring
Closes gh-37228
2026-09-02 10:00:14 +01:00
Sam Brannen ee19b96ee9 Merge branch '7.0.x' 2026-08-31 17:17:01 +02:00
kogun dcc24a2325 Avoid int overflow in expiration calculations in MockMvc and FlashMap
FlashMap.startExpirationPeriod(int) and MockMvcWebConnection's cookie
handling both multiplied an int number of seconds by 1000 without
widening to long. Above 2_147_483 seconds (about 24.9 days) the
multiplication overflows to a negative offset, so the computed
expiration time lands in the past.

For FlashMap, a flash map configured through
AbstractFlashMapManager.setFlashMapTimeout(int) with a large timeout is
then treated as expired immediately. For MockMvcWebConnection, a cookie
with a large max-age is removed from the CookieManager instead of being
stored.

This applies the same widening already used for this pattern in
gh-25613.

Closes gh-37208

Signed-off-by: kogun <akogun@gmail.com>
2026-08-31 17:05:20 +02:00
Brian Clozel df72838ce1 Merge commit 'v7.1.0-M1~1' 2026-08-20 18:18:13 +02:00
Mario Daniel Ruiz Saavedra 4a64537ac6 Add QUERY HTTP method
Signed-off-by: Mario Daniel Ruiz Saavedra <desiderantes93@gmail.com>
2026-08-20 14:13:55 +02:00
rstoyanchev d31f7a5a80 Apply ResourceHandlerUtils checks in XsltView
Closes gh-37029
2026-08-14 09:19:58 +02:00
rstoyanchev 9312e25e24 Check viewName for special prefixes in UrlFilenameViewController
Closes gh-37027
2026-08-14 09:19:58 +02:00
Brian Clozel 5abe6d3e5f Centralize Server Sent Event utility methods
Prior to this commit, many classes would support writing Server Sent
Events in some way to the response output stream. This has lead to some
code duplication.

This commit refactors the duplicated code in a shared `SseUtils` class.

Closes gh-37065
2026-08-14 09:19:58 +02:00
Brian Clozel fd50270b8d Escape SSE view fragments
Prior to this commit, the MVC and WebFlux view fragments rendering would
only partially escape rendered view fragments before sending then as SSE
events. This could in some cases break the SSE stream with invalid data.

This commit ensures that the rendered views are properly escaped before
they are sent as SSE events.

Fixes gh-37061
2026-08-14 09:19:58 +02:00
rstoyanchev 692dbc9160 Apply ResourceHandlerUtils checks in XsltView
Closes gh-37029
2026-08-14 09:11:50 +02:00
rstoyanchev b9379e33d5 Check viewName for special prefixes in UrlFilenameViewController
Closes gh-37027
2026-08-14 09:11:50 +02:00
Brian Clozel 35921cc01f Centralize Server Sent Event utility methods
Prior to this commit, many classes would support writing Server Sent
Events in some way to the response output stream. This has lead to some
code duplication.

This commit refactors the duplicated code in a shared `SseUtils` class.

Closes gh-37065
2026-08-14 09:11:50 +02:00
Brian Clozel 1994e0ebd0 Escape SSE view fragments
Prior to this commit, the MVC and WebFlux view fragments rendering would
only partially escape rendered view fragments before sending then as SSE
events. This could in some cases break the SSE stream with invalid data.

This commit ensures that the rendered views are properly escaped before
they are sent as SSE events.

Fixes gh-37061
2026-08-14 09:11:50 +02:00
rstoyanchev 50f923ace4 Restore MatchableHandlerMapping
See gh-36481
2026-07-30 12:07:17 +03:00
rstoyanchev 8bc5e11ec3 Remove HandlerMappingIntrospector
Closes gh-36481
2026-07-29 18:03:09 +03:00
rstoyanchev f53674d582 Replace HandlerMappingIntrospector with DefaultPreFlightRequestHandler
See gh-36481
2026-07-29 18:03:08 +03:00
rstoyanchev 181a5d3403 Allow choice between Forwarded and X-Forwarded headers
This commit introduces a constructor argument to select whether
to use the standard "Forwarded" header or the "X-Forwarded-*"
alternative headers. A separate property to control support for
X-Forwarded-Prefix.

Closes gh-37090
2026-07-27 12:46:43 +03:00
rstoyanchev 31c37d4f2c Require choice between Forwarded and X-Forwarded headers
This commit introduces a constructor argument to select whether
to use the standard "Forwarded" header or the "X-Forwarded-*"
alternative headers. A separate property enables support for
X-Forwarded-Prefix.

Closes gh-37072
2026-07-23 12:15:24 +03:00
Brian Clozel 5ac20a8104 Reinstate invalid resource location checks
This checks was removed previously because the location was considered
as invalid in #36695, but they were later reinstated in #36692.

This commit also reinstates the check that prevents static resource
resolution in those locations.

Closes gh-37063
2026-07-17 13:41:38 +02:00
Sébastien Deleuze 28bf619887 Merge branch '7.0.x' 2026-07-08 17:23:42 +02:00
Sébastien Deleuze ed13afa0d4 Ensure consistent ButtonTag value attribute processing
Closes gh-37017
2026-07-08 15:08:51 +02:00
Sam Brannen bb34bf6dc6 Merge branch '7.0.x' 2026-06-27 18:09:31 +02:00
Sam Brannen 78f05d8f8e Address deprecation warnings
This commit addresses warnings across the code base related to:

- internal and public deprecations in Spring Framework
- deprecated Locale constructors
- deprecated URL constructors
- deprecated Thread#getId method
2026-06-27 18:08:53 +02:00
Sam Brannen 787f9e1cbb Merge branch '7.0.x' 2026-06-25 13:57:56 +02:00
Sam Brannen b00f691655 Preserve parameter order in DefaultServerRequest's ServletParametersMap
Prior to this commit, DefaultServerRequest's ServletParametersMap lost
the original parameter order when entrySet() was invoked.

To address that, this commit revises ServletParametersMap.entrySet() so
that it stores the results in a LinkedHashSet, thereby retaining the
original order.

Closes gh-36966
2026-06-25 13:57:34 +02:00
Juergen Hoeller 0dc2d03093 Merge branch '7.0.x'
# Conflicts:
#	spring-context/src/main/java/org/springframework/validation/DataBinder.java
2026-06-22 21:55:43 +02:00
Juergen Hoeller d0331a049a Refine various javadoc notes 2026-06-22 21:52:57 +02:00
rstoyanchev 0fbe714bd1 Merge branch '7.0.x' 2026-06-22 13:50:10 +01:00
rstoyanchev 12f9a5c2a5 Apply ResourceHandlerUtils to Groovy markup templates
Closes gh-36902
2026-06-22 11:57:12 +01:00
rstoyanchev ad5bd67b31 Improve ambiguous preflight checks in AbstractHandlerMethodMapping
Closes gh-36903
2026-06-22 10:42:51 +01:00
rstoyanchev 0ee636af7f Improve Javadoc of UrlFilenameViewController
Closes gh-36906
2026-06-22 10:42:51 +01:00
Yanming Zhou cdc3c52640 Replace isAssignableFrom() with isInstance() where feasible
Closes gh-36899

Signed-off-by: Yanming Zhou <zhouyanming@gmail.com>
2026-06-15 15:16:18 +02:00
Sam Brannen 2b08e6e1d3 Merge branch '7.0.x' 2026-06-08 18:29:20 +02:00
Sébastien Deleuze e8f10244e3 Ensure consistent JSP tag attribute processing
Closes gh-36797
2026-06-08 15:13:44 +02:00
Sébastien Deleuze 7add5243b9 Prevent special prefixes in default view name resolution
This commit updates the default view name generation logic in
both Spring WebMVC and Spring WebFlux to prevent "redirect:"
and "forward:" (for MVC) prefixes from the incoming request path.

Closes gh-36793
2026-06-08 15:13:43 +02:00
rstoyanchev 98ed1dfcf8 Revise disconnected client error handling in Spring MVC
DisconnectedClientHelper identifies lost connection issues, but it's
not always easy to know if it is the connection to the client or to
another remote host. DisconnectedClientHelper does recognize and
filter out common client exceptions, but there is a possibility for
other similar custom exceptions.

DefaultHandlerExceptionResolver now attempts to set the status to
500, which won't impact a client that has gone away, but it will
set the status correct on the off chance that the exception is
actually a server side issue.

Closes gh-34481
2026-06-04 11:10:58 +01:00
Juergen Hoeller 2fc99eb12f Merge branch '7.0.x' 2026-06-03 23:04:51 +02:00
Juergen Hoeller 2e653246b5 Fix concurrency issue against shared cookie field in setLocaleContext
Closes gh-36869
2026-06-03 23:03:39 +02:00
Brian Clozel 783388e9f8 Merge branch '7.0.x' 2026-06-03 11:23:03 +02:00
Brian Clozel 86a68a77c4 Support multi-line comments in Server Sent Events
Prior to this commit, comments sent with Server Sent Events could break
the wire format when sent over the network when comments contained line
breaks.
While comments are mainly used for sending keepalive messages, they can
also be used for sending debug data. This commit ensures that line
breaks are properly handled in comments.

Fixes gh-36866
2026-06-03 11:13:32 +02:00
Brian Clozel e6590aa1a8 Merge branch '7.0.x'
Closes gh-36753
2026-05-05 11:59:37 +02:00