MultiActionController with ParameterMethodNameResolver can result in stack overflow [SPR-1696]

[spring-projects-issues]

Erik Rozendaal opened SPR-1696 and commented

Using the following configuration:

<bean name="/view.html" class="day2.mvc.DoEverythingController">
	<property name="methodNameResolver" ref="methodNameResolver"/>
</bean>

<bean id="methodNameResolver" class="org.springframework.web.servlet.mvc.multiaction.ParameterMethodNameResolver">
	<property name="paramName" value="action"/>
</bean>

where DoEverythingController extends the MultiActionController, a user can cause a stack overflow by specifying an URL like: http://server/view.html?action=handleRequest. Maybe the handleRequest method should not be available when using the ParameterMethodNameResolver?

---

Affects: 1.2.6

[spring-projects-issues]

Juergen Hoeller commented

Thanks for pointing this out! We explicitly exclude handleRequest from the list of candidate methods now.

Juergen