Flawed implementations of ResourceResolverChain and ResourceTransformerChain [SPR-16862]

[spring-projects-issues]

Rossen Stoyanchev opened SPR-16862 and commented

The ResourceResolverChain and ResourceTransformerChain implementations in WebFlux use a List with a mutable index. This works as expected as long as resolvers and transformers use the chain instance when first called. However, if they use the chain from a nested, potentially asynchronous call that executes later, the chain index would almost certainly have a different value. 

Looking at the implementations, those that make a nested call, and are impacted, include VersionResourceResolver, WebJarsResourceResolver, CssLinkResourceTransformer and AppCacheManifestTransformer.

Unfortunately the issue went undetected by any tests since in many cases delegating to the chain from any point might still produce the right end results, with the PathResourceResolver at the end.

 

---

Affects: 5.0.6

Referenced from: commits f121aa5, a71bd7c

[spring-projects-issues]

Rossen Stoyanchev commented

This should be now fixed. In master (5.1+) both Spring MVC and WebFlux have been updated with the same immutable implementations for consistency with each other going forward. For the backport to 5.0.x only WebFlux has been updated, since technically it's not an issue in Spring MVC.