apache / apache/grails-core

CachingLinkGenerator caches invalid link when invalid namespace is provided

Open
#12,171 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Groovy
Stars
2.9k
Forks
975
Avg merge
1d 22h
Merged PRs (30d)
92

Description

### Steps to Reproduce

1. Define a valid endpoint without a namespace, such as `/security/login` (handled by `SecurityController#login`)
2. Use an interceptor to redirect to this endpoint (e.g. when the user isn't logged in) like so: `redirect(controller: "security", action: 'login')`
3. Start the app
4. As the first request to the app, request an invalid login URL such as `/xxx/security/login`

### Expected Behaviour

Redirect to `/security/login`

### Actual Behaviour

Infinite redirect loop to `/xxx/security/login`.

Based on some debugging, it looks like the call to `redirect` ends up invoking `DefaultLinkGenerator`, which interprets `xxx` as the namespace and then returns `/xxx/security/login`.

`CachingLinkGenerator` then ends up mapping `link[controller:security, action:login, contextPath:]` to `/lol/auth/login`, which permanently breaks all future calls to `redirect(controller: "security", action: 'login')`

Note that this only happens if the very first request is invalid, since the first one gets cached. So if someone has already requested the valid URL, `/security/login`, the correct link has been cached, and everything works.

### Environment Information

- **Operating System**: Linux
- **Grails Version:** 3.3.11 and 4.0.12
- **JDK Version:** 1.8.0

### Example Application

- TODO: link to github repository with example that reproduces the issue

Contributor guide

Open the contributing guide

Research direction

Start by tracing the redirect call through DefaultLinkGenerator and CachingLinkGenerator, focusing on how the invalid namespace from the first request becomes cached. Reproduce the sequence with an invalid first URL followed by redirect(controller: "security", action: "login"), then verify that later redirects resolve to /security/login rather than the invalid path.

Written by the indexing model from the issue text.

Assessment

Tech stack
groovy
Domain
backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.