FormTagLib.form passes wrong method to RequestDataValueProcessor
- Dominant language
- Groovy
- Stars
- 2.9k
- Forks
- 975
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 92
Description
### Steps to Reproduce
1. Create a Grails web application and add Spring Security Web as a dependency
2. Configure CSRF protection in resources.groovy:
```
requestDataValueProcessor(org.springframework.security.web.servlet.support.csrf.CsrfRequestDataValueProcessor)
csrfFilter(org.springframework.security.web.csrf.CsrfFilter, new org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository())
```
3. Create a GSP file containing a g:form element
### Expected Behaviour
I expect that the CSRF token is added to the form.
### Actual Behaviour
It isn't added.
### Environment Information
- **Operating System**: Linux
- **Grails Version:** 2.5.1 (the relevant code did not change since then however)
- **JDK Version:** 8
- **Container Version (If Applicable):** 2.5
### -
I think the problem is https://github.com/grails/grails-gsp/blob/af8bfebd63936fe29ef7abe833386b0ed00e01f3/grails-plugin-gsp/src/main/groovy/org/grails/plugins/web/taglib/FormTagLib.groovy#L395
Here the method of the form should be passed, not the method used to request the page containing the form.
See also the [documentaton for the RequestDataValueProcessor interface](https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/web/servlet/support/RequestDataValueProcessor.html).
Contributor guide
Research direction
Start in grails-plugin-gsp/src/main/groovy/org/grails/plugins/web/taglib/FormTagLib.groovy at the referenced line, then read the RequestDataValueProcessor documentation linked in the issue. Reproduce the g:form case with the supplied CSRF configuration and verify that the form receives its CSRF token when the correct form method is passed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- groovy
- Domain
- web-dev
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100