ForwardedHeaderFilter garbles query params during sendRedirect() [SPR-16506]

[spring-projects-issues]

Timothy Aitken opened SPR-16506 and commented

The ForwardedHeaderFilter garbles the query-string provided to sendRedirect(). If both the original request and the provided location both contain a query, then the two are improperly concatenated (with a extra "?" between them) making the resulting location redirect invalid, eg:

http://hostname:port/path?newqp=1?oldqp=2

The expected behavior should be one of:

1. fail-out explicitly, rather than returning garbage
2. properly concatenate the two lists of params
3. replace the old params with the new ones if provided

I'm not sure which of these are preferable, but #3 seems most consistent with the behavior when this filter is removed.

---

Affects: 4.3.10

Referenced from: commits 6920a1f, 608ef46, ac495d7

Backported to: 4.3.15

[spring-projects-issues]

Rossen Stoyanchev commented

#3 it is. This was a bug, never the intent to propagate the query from the current request at this level. RedirectView does have a property that an application can use to opt into #2.