Skip to content

LUI-209 : Getting ClassCastException on multipart form submissions due to latest Spring compatibility issue #243

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sudhanshu-raj wants to merge 3 commits into
base: master
Choose a base branch
from
Open

LUI-209 : Getting ClassCastException on multipart form submissions due to latest Spring compatibility issue #243

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e825b12
Using MultipartHttpServletRequest casting due to latest spring compat…
sudhanshu-raj Mar 3, 2026
8e208db
LUI-209:Fixed import line and removed not needed function
sudhanshu-raj Mar 5, 2026
19ddb1a
Added parameter configuration
sudhanshu-raj Mar 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions omod/src/main/java/org/openmrs/web/xss/XSSFilter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@
import jakarta.servlet.ServletResponse;
import jakarta.servlet.http.HttpServletRequest;

import org.springframework.web.multipart.support.DefaultMultipartHttpServletRequest;
import org.springframework.web.multipart.MultipartHttpServletRequest;

import static org.apache.commons.fileupload2.jakarta.servlet6.JakartaServletFileUpload.isMultipartContent;

Expand All @@ -31,7 +31,7 @@ public void doFilter(ServletRequest request, ServletResponse response, FilterCha

if (!"GET".equalsIgnoreCase(((HttpServletRequest) request).getMethod())) {
if (isMultipartContent((HttpServletRequest) request)) {
request = new XSSMultipartRequestWrapper((DefaultMultipartHttpServletRequest) request);
request = new XSSMultipartRequestWrapper((MultipartHttpServletRequest) request);
} else {
request = new XSSRequestWrapper((HttpServletRequest) request);
}
Expand Down
49 changes: 40 additions & 9 deletions omod/src/main/java/org/openmrs/web/xss/XSSMultipartRequestWrapper.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,15 +10,21 @@
package org.openmrs.web.xss;

import java.util.Enumeration;
import java.util.Iterator;
import java.util.List;
import java.util.Map;

import jakarta.servlet.http.HttpServletRequestWrapper;

import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpMethod;
import org.springframework.util.MultiValueMap;
import org.springframework.web.multipart.MultipartFile;
import org.springframework.web.multipart.support.DefaultMultipartHttpServletRequest;
import org.springframework.web.multipart.MultipartHttpServletRequest;

public class XSSMultipartRequestWrapper extends DefaultMultipartHttpServletRequest {
public class XSSMultipartRequestWrapper extends HttpServletRequestWrapper implements MultipartHttpServletRequest {

public XSSMultipartRequestWrapper(DefaultMultipartHttpServletRequest request) {
public XSSMultipartRequestWrapper(MultipartHttpServletRequest request) {
super(request);
}

Expand Down Expand Up @@ -50,9 +56,13 @@ public String[] getParameterValues(String name) {
return encodedValues;
}

public MultipartHttpServletRequest getRequest() {
return (MultipartHttpServletRequest) super.getRequest();
}

@Override
public DefaultMultipartHttpServletRequest getRequest() {
return (DefaultMultipartHttpServletRequest) super.getRequest();
public Iterator<String> getFileNames() {
return getRequest().getFileNames();
}

@Override
Expand All @@ -64,14 +74,35 @@ public MultipartFile getFile(String name) {
public MultiValueMap<String, MultipartFile> getMultiFileMap() {
return getRequest().getMultiFileMap();
}


@Override
public Enumeration<String> getParameterNames() {
return getRequest().getParameterNames();
public List<MultipartFile> getFiles(String name) {
return getRequest().getFiles(name);
}

@Override
public List<MultipartFile> getFiles(String name) {
return getRequest().getFiles(name);
public Map<String, MultipartFile> getFileMap() {
return getRequest().getFileMap();
}

@Override
public String getMultipartContentType(String paramOrFileName) {
return getRequest().getMultipartContentType(paramOrFileName);
}

@Override
public HttpHeaders getMultipartHeaders(String paramOrFileName) {
return getRequest().getMultipartHeaders(paramOrFileName);
}

@Override
public HttpHeaders getRequestHeaders() {
return getRequest().getRequestHeaders();
}

@Override
public HttpMethod getRequestMethod() {
return getRequest().getRequestMethod();
}
}
1 change: 1 addition & 0 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,6 +155,7 @@
<target>${javaCompilerVersion}</target>
<source>${javaCompilerVersion}</source>
<encoding>${project.build.sourceEncoding}</encoding>
<parameters>true</parameters>
Copy link
Copy Markdown
Author

@sudhanshu-raj sudhanshu-raj Mar 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Problem : If try to create the new provider or on Person Attribute Management if try to moveup-down thr attributes and there could be many such places , it will throw exception java.lang.IllegalArgumentException: Name for argument of type [[Ljava.lang.Integer;] not specified, and parameter name information not available via reflection. Ensure that the compiler uses the '-parameters' flag. .

Fix : In old version of spring, it used a library called ASM which reads the bytecode of controller methods and try to read the parameter names. Like here :

public String moveUp(Integer[] personAttributeTypeId, HttpSession httpSession)

Spring would read the bytecode and figure out that the request parameter name is personAttributeTypeId. Same for:

`public EncounterRole formBackingObject(@RequestParam(required = false) Integer encounterRoleId)`

But on newer spring version, it has dropped the ASM library and now we need to tell the spring manually that hey, this is my parameter name preserve this name in the bytecode , how ? By either mentioning the parameter name like : @RequestParam(value =encounterRoleId,required = false) Integer encounterRoleId) or setting the config on pom.xml by adding the parameter flag which i just did and which is more efficient way as we not need to edit all controller methods.

Copy link
Copy Markdown
Author

@sudhanshu-raj sudhanshu-raj Mar 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Although this change is not related to this ticket directly, but as it's small change and related to spring upgradation part so I added here.

</configuration>
</plugin>
<plugin>
Expand Down