apache / apache/grails-core

FormTagLib.form passes wrong method to RequestDataValueProcessor

Open
#14,260 0 comments 0 reactions 0 assignees View on GitHub
relates-to: grails-gsp
Dominant language
Groovy
Stars
2.9k
Forks
975
Avg merge
1d 22h
Merged PRs (30d)
92

Description

### Steps to Reproduce
1. Create a Grails web application and add Spring Security Web as a dependency
2. Configure CSRF protection in resources.groovy:
```
requestDataValueProcessor(org.springframework.security.web.servlet.support.csrf.CsrfRequestDataValueProcessor)
csrfFilter(org.springframework.security.web.csrf.CsrfFilter, new org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository())
```
3. Create a GSP file containing a g:form element

### Expected Behaviour

I expect that the CSRF token is added to the form.

### Actual Behaviour

It isn't added.

### Environment Information

- **Operating System**: Linux
- **Grails Version:** 2.5.1 (the relevant code did not change since then however)
- **JDK Version:** 8
- **Container Version (If Applicable):** 2.5

### -

I think the problem is https://github.com/grails/grails-gsp/blob/af8bfebd63936fe29ef7abe833386b0ed00e01f3/grails-plugin-gsp/src/main/groovy/org/grails/plugins/web/taglib/FormTagLib.groovy#L395
Here the method of the form should be passed, not the method used to request the page containing the form.
See also the [documentaton for the RequestDataValueProcessor interface](https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/web/servlet/support/RequestDataValueProcessor.html).

Contributor guide

Open the contributing guide

Research direction

Start in grails-plugin-gsp/src/main/groovy/org/grails/plugins/web/taglib/FormTagLib.groovy at the referenced line, then read the RequestDataValueProcessor documentation linked in the issue. Reproduce the g:form case with the supplied CSRF configuration and verify that the form receives its CSRF token when the correct form method is passed.

Written by the indexing model from the issue text.

Assessment

Tech stack
groovy
Domain
web-dev
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.