Spring MVC controller browser downloads "f.txt"

[TianhuaRainbow]

The maven version 1.2.7:

@RequestMapping("/a.html")
@ResponseBody
public String a() {
    return "abcd";
}

As shown above:
If visit *.html,it will return "f.txt" to download.

[wilkinsona]

Sorry, but I don't think I understand the problem you're having. Where's f.txt coming from? If you'd like us to help, please provide a sample project that reproduces the problem.

[vpavic]

f.txt is coming from Content-Disposition response header. This is a consequence of fix for RFD Attack in Spring Framework.

Simple Hello World app reproduces the issue:

@RestController
@SpringBootApplication
public class DemoApplication {

    public static void main(String[] args) {
        SpringApplication.run(DemoApplication.class, args);
    }

    @RequestMapping("/hello")
    public String home() {
        return "Hello World!";
    }

}

curl -I http://localhost:8080/hello.html returns:

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Disposition: attachment;filename=f.txt
Content-Type: text/html;charset=UTF-8
Content-Length: 12

Same happens with request for a missing resource, curl -I http://localhost:8080/world.html returns:

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Disposition: attachment;filename=f.txt
Content-Type: application/json;charset=UTF-8
Content-Length: 114

[snicoll]

ping @rstoyanchev

[wilkinsona]

This breaks accessing an individual metric using a browser. In 1.2.6.RELEASE, pointing a browser to http://localhost:8080/metrics/mem.free displays the value of the metric in the browser window. In 1.2.7.RELEASE, it downloads a file named f.txt.

[rstoyanchev]

I've created SPR-13587 to consider an improvement for the metrics case and also SPR-13588 to consider an improvement for the error dispatch case mentioned by @vpavic.

As for the @ResponseBody with String return value case, we explicitly chose not to whitelist "html". The StringHttpMessageConverter and ByteArrayHttpMessageConverter are the only converters configured very openly out of the box (*/*) to accept any requested content type. This means in many cases simply adding ".html" will cause the method to render as "text/html". If the response contains some user input, like a URI variable, request parameter, or other, this can easily result in XSS or RFD attack. This can be surprising if the controller method returns String with the intention to render "text/plain".

An application can explicitly register "html" is an extension for content negotiation purposes. It's the application's responsibility then to sanitize any input included in the response. Spring Boot can help to make this easy to configure through an application property but it shouldn't be hard otherwise either.

I'm also wondering about the use cases that lead to rendering HTML with the StringHttpMessageConverter. If you could please share some feedback on that.

[snicoll]

@TianhuaRainbow any insight?

[bartolom]

If you decide to not whitelist ".html" in @RespnseMapping by default due to security concerns, I'm ok with this as I like the fact that Java people take security more serious then other communities.

BUT, please try to make at least the necessary configuration steps more obvious. I think that most people that run a web application don't do it to serve suspicious "forced f.txt downloads". If you within the Spring Framework already know that this response will cause this maybe you could

• Write out a logging line at INFO level saying somethink like "You are about to cause a response that will create a f.txt file, you can do this and that..."
• Maybe throwing an exception is even better
• Improve documentation that is really necessray to configure/whitelist
• Write a Spring getting started guide that points this out. (As a side note http://spring.io/guides/gs/serving-web-content/ uses a templating setup, so it's different).

I have a setup where the response with the .html is part of a pipeline that pre-arranges Polymer Web Components at the server side which are imported as fragments with a CORS call from a Polymer application. Maybe in 2015 still an exotic setup but surely a growing niche. I was looking at so many places before I found this out.

It's odd that you can still write a helloWorld.json web-server based on Spring Boot in 140 characters but for serving a helloWorld.html you need to add a call to RequestMappingHandlerMapping.setUseRegisteredSuffixPatternMatch(). For a long time Spring user thats OK, and I can live with it, but for people new to the technology?

I'm really not an expert on Spring internals but maybe you could use the "produces" parameter. In my example I used

@RequestMapping(value = "/with.html", produces = MediaType.TEXT_HTML_VALUE)

So I as a developer stated that I really wanted to serve html files for this controller method call.

Or you can force me to state that I'm responsible to be aware of the risk with a isSanitized or similar:

@RequestMapping(value = "/with.html", isSanitized=true)

(A better name can surely be found, isSafe=true, iKnowAboutTheRisk=true, ... )