Avoid file extension detection in Spring MVC request mapping with floating point number in URI

Question

I used Spring Boot to implement a REST application. I have one resource that is mapped like this

@RequestMapping(value = "/{fromLat}/{fromLon}/{toLat}/{toLon:.+}", method = {RequestMethod.GET},
        produces = {"application/json"})

Thus the path contains coordinates and a request looks like this

$ curl -I -X GET http://localhost:8085/foobar/53.481297/9.900539/53.491691/9.946046

Unfortunatly the last end is interpreted as a file extension which leads to a response header that offers a file download instead of just the plain data.

Content-Disposition: attachment;filename=f.txt

I thought I could handle the situation with a custom WebMvcConfigurerAdapter Bean (and without @EnableWebMvc) annotation like explained here.

public class CustomWebMvcConfigurerAdapter extends WebMvcConfigurerAdapter {
    @Override
    public void configureContentNegotiation(ContentNegotiationConfigurer configurer) {
        configurer.favorPathExtension(false);
    }
}

But that does not do the trick. Unfortunatly the detected file extension is not fix - thus I can not use a rule for a fix extension.

How can I configure the system to just respond with the content and without the Content-Disposition header (which leads to an f.txt download)? I would not like to use a slash ("/") at the end.

I already looked at the following ressource

Rossen Stoyanchev · Accepted Answer · 2015-12-17T16:02:51.193

3

In Spring Framework 4.1.9 and 4.2.3 the Content-Disposition header was fixed to use the "inline" type which only suggests a file download name, should the content end up being downloaded. It won't force a Save As dialog any more.

Note also that the reason for the Content-Disposition header in the first place is to protect applications against RFD attacks. This is a very complex issue but you can see a summary in the CVE-2015-5211 report.

edited Dec 17 '15 at 16:02

answered Dec 09 '15 at 16:49

Rossen Stoyanchev

4,910
23
26

Still `Content-Disposition: attachment;filename=f.txt` with Spring Framework 4.1.8 (when using Spring IO Platfrom 1.1.4) but definitely `Content-Disposition: inline;filename=f.txt` when using Spring IO Platform 2.0.0 (with Spring Framework 4.2.3). Upgrade is the solution for me. Thanks! – FrVaBe Dec 11 '15 at 09:02
Yes indeed it's 4.1.9 (released today) and 4.2.3 that have the fix. I've updated that above. – Rossen Stoyanchev Dec 17 '15 at 16:03

score 1 · Answer 2 · answered Dec 08 '15 at 19:29

1

I had similar issues with Spring Boot as described here.

What worked for me is the following configuration:

@Configuration
public class WebMvcConfig extends WebMvcConfigurerAdapter {

    @Override
    public void configurePathMatch(PathMatchConfigurer configurer) {
        configurer.setUseSuffixPatternMatch(false);

    }


}

answered Dec 08 '15 at 19:29

jny

8,007
3
37
56

Today and for your (Franz') use case i'd propose that as well. A while back i had a similar problem: I wanted to use the file suffix (i.e. .jpg, .xml etc.) inside my controller method (i know that the "right" way is to handle that via different views) and i solved it using my own path matcher: http://info.michael-simons.eu/2011/03/09/creating-a-better-pathmatcher-for-spring-3/ I guess that would work with Boot as well – Michael Simons Dec 08 '15 at 20:35
Unfortunatly this does not work. It is not the problem that the request is not matched proberly to the Controller method but that the response always contains the `Content-Disposition: attachment;filename=f.txt` header wich leads the browser of offer a download instead of just showing the JSON result. – FrVaBe Dec 09 '15 at 07:53
I even do not want to make my `CustomWebMvcConfigurerAdapter` a `@Configuration` class. Instead I would like to follow the advice as documented in the Spring Boot [documentation](https://docs.spring.io/spring-boot/docs/current/reference/html/boot-features-developing-web-applications.html): _If you want to keep Spring Boot MVC features, and you just want to add additional MVC configuration (interceptors, formatters, view controllers etc.) you can add your own @Bean of type WebMvcConfigurerAdapter, but without @EnableWebMvc._ – FrVaBe Dec 09 '15 at 08:01
Are you using `@RestController ` or `@Controller` annotation for your controller? If second, add '@ResponseBody' to your method annotation. – jny Dec 09 '15 at 14:48

score 0 · Answer 3 · edited May 23 '17 at 12:08

0

Did you try to set:

1) Content-Disposition: inline; -> you can use:

return new ResponseEntity(body, headers, statusCode); and set Content-Disposition in headers. Look here: How to set 'Content-Disposition' and 'Filename' when using FileSystemResource to force a file download file? and Return a stream with Spring MVC's ResponseEntity

2) text/x-json - Experimental MIME type for JSON before application/json got officially registered.

@RequestMapping(value = "/{fromLat}/{fromLon}/{toLat}/{toLon:.+}", method = {RequestMethod.GET},
                produces = {"text/x-json"})

It will try to display the content instead of downloading it.

Hope it will help.

edited May 23 '17 at 12:08

Community

1
1

answered Dec 08 '15 at 17:24

m.aibin

3,528
4
28
47

I do not know how tow change the Content-Disposition to inline in a @RestController. If it works it would probably be a good idea. – FrVaBe Dec 08 '15 at 17:31
Thanks. At the moment I would rather not change my @RequestMapping method to return the ResponseEntity object instead of my current _foobar_ object which is converted to JSON automatically. But if I will not find any other options I will probably give it a try. – FrVaBe Dec 09 '15 at 08:26

Avoid file extension detection in Spring MVC request mapping with floating point number in URI

3 Answers3

Linked