Use concrete form-data type when reading request body

Prior to this commit, the WebFlux server support would try reading
form-data from the request by:

* first, checking that request content-type is compatible with a
  form-data content-type
* then by selecting a message reader that is compatible with the given
  request content-type

This approach is flawed because if the content-type provided by the
request is too broad, another message reader could be selected that's
not meant to be used for reading form-data. Typically, a JSON message
reader could be selected and would fail when reading the request.
This problem was previously hidden because message readers would not
support `MultiValueMap` as a target type. Now that some readers support
this type, this can lead to deserialization errors.

This commit now ensures that in all cases, we attempt to read form-data
with a message reader that supports the
"application/x-www-form-urlencoded" media type.

Fixes gh-34660
This commit is contained in:
Brian Clozel
2025-06-13 16:45:46 +02:00
parent 722333f0f1
commit 8dee7d8fb6
2 changed files with 16 additions and 2 deletions
@@ -153,7 +153,7 @@ public class DefaultServerWebExchange implements ServerWebExchange {
return EMPTY_FORM_DATA;
}
HttpMessageReader<MultiValueMap<String, String>> reader = getReader(configurer, contentType, FORM_DATA_TYPE);
HttpMessageReader<MultiValueMap<String, String>> reader = getReader(configurer, MediaType.APPLICATION_FORM_URLENCODED, FORM_DATA_TYPE);
if (reader == null) {
return Mono.error(new IllegalStateException("No HttpMessageReader for " + contentType));
}