Spring-cloud-gateway: Error with Spring Cloud Gateway Greenwich.SR2, Spring Boot 2.1.5.RELEASE and Multipart

[rgarciapariente]

Hello,

If we do a multipart request with Spring Cloud Gateway Greenwich.SR2 and Spring Boot 2.1.5.RELEASE then we get a 400 BAD_REQUEST

We hava a sample of the error in https://github.com/rgarciapariente/demo-gateway-error

There is no problem with Spring Boot 2.1.4.RELEASE.

Maybe is not a Spring Boot 2.1.5.RELEASE isssue because if we do the test directly to a micro without Gateway with Spring Boot 2.1.5 then also it work properly.

Many thanks

[spencergibb]

Can you try with boot 2.1.6?

[rgarciapariente]

Yes, same error :___(

[spencergibb]

So, If I run the downstream application separately, rather than a controller embedded in the same application, I don't get any errors.

[rgarciapariente]

I have the same error if I run the micro separately. I update the repo of the gw https://github.com/rgarciapariente/demo-gateway-error and I create a new repo with the micro to test https://github.com/rgarciapariente/demo-gateway-error-micro

If I run the gateway and the micro, and after that I execute the test DemoGatewayApplicationTests(in gw repo) the request against gw return an error but the request directy agains the micro run correctly.

And again if I downgrade to Spring Boot 2.1.4 all works ok

[spencergibb]

Update to boot 2.1.6

[rgarciapariente]

With 2.1.6 error again:

POST http://localhost:8080/gw/test/post
WebTestClient-Request-Id: [1]
Content-Type: [multipart/form-data;boundary=10HWMZ3RAVe1zpa8v_Q1LuK9CoTKQOZiJYJQay3U;charset=UTF-8]

--10HWMZ3RAVe1zpa8v_Q1LuK9CoTKQOZiJYJQay3U
Content-Disposition: form-data; name="file"; filename="test.txt"
Content-Type: text/plain
Content-Length: 738

TestFile content for multipart request test.
¼script¾alert(¢XSS¢)¼/script¾
' UNION SELECT 1, 'anothercolumn', 'doesnt matter', 1--
ValueLDAP)(|(cn=*)
&xxe; &xxe; &xxe; &xxe;
--10HWMZ3RAVe1zpa8v_Q1LuK9CoTKQOZiJYJQay3U--

< 400 BAD_REQUEST Bad Request
< content-length: [0]

0 bytes of content (unknown content-type).

at org.springframework.test.web.reactive.server.ExchangeResult.assertWithDiagnostics(ExchangeResult.java:200)
at org.springframework.test.web.reactive.server.StatusAssertions.assertStatusAndReturn(StatusAssertions.java:227)
at org.springframework.test.web.reactive.server.StatusAssertions.isOk(StatusAssertions.java:67)
at com.example.demogateway.DemoGatewayApplicationTests.testGW(DemoGatewayApplicationTests.java:47)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:50)
at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:47)
at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)
at org.springframework.test.context.junit4.statements.RunBeforeTestExecutionCallbacks.evaluate(RunBeforeTestExecutionCallbacks.java:74)
at org.springframework.test.context.junit4.statements.RunAfterTestExecutionCallbacks.evaluate(RunAfterTestExecutionCallbacks.java:84)
at org.springframework.test.context.junit4.statements.RunBeforeTestMethodCallbacks.evaluate(RunBeforeTestMethodCallbacks.java:75)
at org.springframework.test.context.junit4.statements.RunAfterTestMethodCallbacks.evaluate(RunAfterTestMethodCallbacks.java:86)
at org.springframework.test.context.junit4.statements.SpringRepeat.evaluate(SpringRepeat.java:84)
at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:325)
at org.springframework.test.context.junit4.SpringJUnit4ClassRunner.runChild(SpringJUnit4ClassRunner.java:251)
at org.springframework.test.context.junit4.SpringJUnit4ClassRunner.runChild(SpringJUnit4ClassRunner.java:97)
at org.junit.runners.ParentRunner$3.run(ParentRunner.java:290)
at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:71)
at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:288)
at org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)
at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)
at org.springframework.test.context.junit4.statements.RunBeforeTestClassCallbacks.evaluate(RunBeforeTestClassCallbacks.java:61)
at org.springframework.test.context.junit4.statements.RunAfterTestClassCallbacks.evaluate(RunAfterTestClassCallbacks.java:70)
at org.junit.runners.ParentRunner.run(ParentRunner.java:363)
at org.springframework.test.context.junit4.SpringJUnit4ClassRunner.run(SpringJUnit4ClassRunner.java:190)
at org.junit.runner.JUnitCore.run(JUnitCore.java:137)
at com.intellij.junit4.JUnit4IdeaTestRunner.startRunnerWithArgs(JUnit4IdeaTestRunner.java:68)
at com.intellij.rt.execution.junit.IdeaTestRunner$Repeater.startRunnerWithArgs(IdeaTestRunner.java:47)
at com.intellij.rt.execution.junit.JUnitStarter.prepareStreamsAndStart(JUnitStarter.java:242)
at com.intellij.rt.execution.junit.JUnitStarter.main(JUnitStarter.java:70)

Caused by: java.lang.AssertionError: Status expected:<200 OK> but was:<400 BAD_REQUEST>
at org.springframework.test.util.AssertionErrors.fail(AssertionErrors.java:59)
at org.springframework.test.util.AssertionErrors.assertEquals(AssertionErrors.java:98)
at org.springframework.test.web.reactive.server.StatusAssertions.lambda$assertStatusAndReturn$4(StatusAssertions.java:227)
at org.springframework.test.web.reactive.server.ExchangeResult.assertWithDiagnostics(ExchangeResult.java:197)
... 33 more

[Actonian1187]

My company was affected by this issue as well. We had a working gateway implementation running in production and using spring boot 2.1.4 and spring-cloud Greenwich.RELEASE. We made a small change and update to spring boot 2.1.6 at the same time. After deploying, all multipart upload requests started failing with a 400 Bad Request. Falling back 2.1.4 resolved the issue.

[spencergibb]

I'm unable to reproduce the issue with boot 2.1.6 and cloud Greenwich.SR2 or boot 2.1.8 and cloud Greenwich.SR3

[rgarciapariente]

I have updated the sources to boot 2.1.8 and cloud Greenwich.SR3.

To reproduce the error:
1) In demo-gateway-error-micro execute: mvn spring-boot:run
2) In demo-gateway-error execute: mvn spring-boot:run
3) In demo-gateway-error execute: mvn test

And you could see the error in test testGW

[spencergibb]

So if I rewrite the GW test to use RestTemplate rather than WebTestClient it passes. Also using httpie.org doesn't reveal the error, so something is different with WebTestClient.

[spencergibb]

I'm going to need some help from the broader team @smaldini, @rstoyanchev or @violetagg

[spencergibb]

Some logs https://gist.github.com/spencergibb/1ed54d6723598423393b7c8cb3e9d9cf

[spencergibb]

As @Actonian1187 mentioned I was able to isolate that the error only happens with a boot version change. Boot 2.1.4 works, anything after fails. That still doesn't narrow down if the change was in boot, framework or reactor-netty