apache / apache/grails-core

getMimeTypes() race condition results in content getting served as xhtml and failing in safari

Open
#15,617 0 comments 0 reactions 0 assignees View on GitHub
relates-to: v7
Dominant language
Groovy
Stars
2.9k
Forks
975
Avg merge
1d 22h
Merged PRs (30d)
92

Description

### Expected Behavior

# Grails core should not silently fall back to createDefaults() in getMimeTypes() — when there's no request, it should defer caching, not poison it.

`org.grails.web.mime.HttpServletResponseExtension.getMimeTypes()`

```java
public static MimeType[] getMimeTypes() {
if (mimeTypes == null) { // ← static field, populated once
webRequest = GrailsWebRequest.lookup(); // ← thread-local request lookup
ApplicationContext ctx = webRequest?.getApplicationContext();
if (ctx != null) {
// CORRECT PATH: read app config via Spring
mimeTypes = ctx.getBean(MimeUtility).getKnownMimeTypes();
loadMimeTypeConfig(ctx.getBean(GrailsApplication).config);
} else {
// WRONG-FALLBACK PATH:
mimeTypes = MimeType.createDefaults(); // [XHTML, HTML, XML, ...]
}
}
return mimeTypes;
}
```

### Actual Behaviour

_No response_

### Steps To Reproduce

_No response_

### Environment Information

_No response_

### Example Application

_No response_

### Version

7.0.10

Contributor guide

Open the contributing guide

Research direction

Start in org.grails.web.mime.HttpServletResponseExtension.getMimeTypes() and inspect how the static mimeTypes field is initialized when GrailsWebRequest.lookup() finds no request. Reproduce or test concurrent and requestless access, then verify that application-configured MIME types are not replaced by defaults and that caching is deferred until an application context is available.

Written by the indexing model from the issue text.

Assessment

Tech stack
groovy
Domain
backend, web-dev
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
64/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.