Further clarify ordering of request parameters when accessed through getParameterNames and getParameterMap
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 325
- Forks
- 112
- PR merge metrics
- No merged PRs in 30d
Description
For background, please see this [thread](https://lists.apache.org/thread.html/r4015fc926e8fad8bc1a3e7be70bf474ab1d4a0178028b83562b3cbb3%40%3Cusers.tomcat.apache.org%3E) on the Apache Tomcat users mailing list.
The Servlet Specification specifies in [section 3.1](https://jakarta.ee/specifications/servlet/5.0/jakarta-servlet-spec-5.0.html#http-protocol-parameters) that request parameters coming from the URL query string should be "presented before post body data" to web applications. It does not further specify ordering _within_ the URL-parameter or POST form-data parameters which are parsed by the container.
It seems reasonable for application developers to expect that parameters would be presented in left-to-right order from the URL and top-to-bottom order in POST form-data, but nowhere is that explicitly stated in the Servlet or related specifications.
Apache Tomcat's implementation is such that parameter names will be enumerated in this left-to-right/top-to-bottom fashion and likewise the ordering of map entries coming from HttpServletRequest.getParameterMap will also be in this order. It's likely that other implementations are the same or at least similar.
Clarifying this order explicitly in the Servlet specification would be helpful to application programmers who would like to rely on this behavior.
As justification for codifying this behavior, I would like to refer to HTML 5 section on "Forms" which consistently refers to "tree order" (aka document-order) as the proper way to order form elements in many situations, [specifically when assembling the form-data to submit to the server](https://www.w3.org/TR/html52/sec-forms.html#form-submission-algorithm). Further, [RFC 7578](https://tools.ietf.org/html/rfc7578#section-5.2) specifies that "Form processors given forms with a well-defined ordering SHOULD send back results in order" and specifically forbids intermediaries (e.g. proxies, etc.) from re-ordering form-data.
Given:
1. HTTP and HTML specifications agree that form-element ordering is (always) important
2. HTML form-data can be sent in either URL parameters (i.e. `GET`) or via a request entity (i.e. `POST`)
3. The Servlet Specification requires that parameters from the URL should come before those in the request body
Therefore, the Servlet Specification should explicitly define the ordering of request parameters:
1. First, by source (URL parameter vs request body)
2. Second, by ordering within the set of parameters in each source; that is, from left-to-right for URL parameters and top-to-bottom for request bodies
This will ensure that web applications can reliably predict the ordering of form-data if it is necessary to do so.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading Servlet Specification section 3.1 and the linked mailing-list discussion. Compare the requested ordering rule with the referenced HTML Forms section and RFC 7578. Done means reaching agreement on whether the specification should explicitly define source and within-source parameter ordering, then documenting that clarification in the appropriate specification text.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- documentation
- Issue type
- Documentation
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100