<p dir="auto"><strong><a href="https://jira.spring.io/secure/ViewProfile.jspa?name=jberry" rel="nofollow">James Berry</a></strong> opened <strong><a href="https://jira.spring.io/browse/SPR-4229?redirect=false" rel="nofollow">SPR-4229</a></strong> and commented</p>
<p dir="auto">in CommonsMultipartResolver.isMultipart, the following call is made:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="return ServletFileUpload.isMultipartContent(new ServletRequestContext(request));"><pre class="notranslate"><code class="notranslate">return ServletFileUpload.isMultipartContent(new ServletRequestContext(request));
</code></pre></div>
<p dir="auto">instead, this call should be made:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="return ServletFileUpload.isMultipartContent(request);"><pre class="notranslate"><code class="notranslate">return ServletFileUpload.isMultipartContent(request);
</code></pre></div>
<p dir="auto">Not only does this save an object allocation, but it actually works: the ServletRequestContext is wrapped around the request in the first call doesn't have enough information to do a good test of the request to determine whether it actually is multipart. In particular, the request type is not verified to be a post, which results in a hang during processing of what ends up being a bogus multipart request due to a redirect, for instance.</p>
<p dir="auto">The second call (without the ServletRequestContext wrapper) does a more thorough check of the request to verify that it is actually valid.</p>
<p dir="auto">The described problem manifests for me when when I do a 303 redirect from a POSTed form. For some browsers, the subsequent GET operation continues to include the content-type multipart header, which triggers a sequence of events leading to a read that HANGS on a kept-alive request as the servlet tries to parse the bogus multipart content.</p>
<hr>
<p dir="auto"><strong>Affects:</strong> 2.5 final</p>
<p dir="auto"><strong><a href="https://jira.spring.io/secure/ViewProfile.jspa?name=jberry" rel="nofollow">James Berry</a></strong> opened <strong><a href="https://jira.spring.io/browse/SPR-4228?redirect=false" rel="nofollow">SPR-4228</a></strong> and commented</p>
<p dir="auto">in CommonsMultipartResolver.isMultipart, the following call is made:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="return ServletFileUpload.isMultipartContent(new ServletRequestContext(request));"><pre class="notranslate"><code class="notranslate">return ServletFileUpload.isMultipartContent(new ServletRequestContext(request));
</code></pre></div>
<p dir="auto">instead, this call should be made:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="return ServletFileUpload.isMultipartContent(request);"><pre class="notranslate"><code class="notranslate">return ServletFileUpload.isMultipartContent(request);
</code></pre></div>
<p dir="auto">Not only does this save an object allocation, but its actually works: the ServletRequestContext is wrapped around the request in the first call doesn't have enough information to do a good test of the request to determine whether it actually is multipart. In particular, the request type is not verified to be a post, which results in a hang during processing of what ends up being a bogus multipart request due to a redirect, for instance.</p>
<p dir="auto">The second call (without the ServletRequestContext wrapper) does a more thorough check of the request to verify that it is actually valid.</p>
<p dir="auto">The described problem manifests for me when when I do a 303 redirect from a posted form. For some browsers, the subsequent GET operation continues to include the content-type multipart header, which triggers a sequence of events leading to a read that HANGS on a kept-alive request as the servlet tries to parse the bogus multipart content.</p>
<hr>
<p dir="auto"><strong>Affects:</strong> 2.0.7, 2.5 final</p>
<p dir="auto"><strong>Issue Links:</strong></p>
<ul dir="auto">
<li><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="398088599" data-permission-text="Title is private" data-url="https://github.com/spring-projects/spring-framework/issues/9525" data-hovercard-type="issue" data-hovercard-url="/spring-projects/spring-framework/issues/9525/hovercard" href="https://github.com/spring-projects/spring-framework/issues/9525">#9525</a> Safari 3.x problem with redirect after file upload</li>
</ul>
<p dir="auto"><strong>Backported to:</strong> <a href="https://github.com/spring-projects/spring-framework/milestone/45?closed=1">2.0.8</a></p>