Skip to content

Add default validation for $namespace, $controller, and $action url mapping variables#15525

Merged
codeconsole merged 14 commits intoapache:7.1.xfrom
codeconsole:url-mapping-wildcard-validation
Mar 29, 2026
Merged

Add default validation for $namespace, $controller, and $action url mapping variables#15525
codeconsole merged 14 commits intoapache:7.1.xfrom
codeconsole:url-mapping-wildcard-validation

Conversation

@codeconsole
Copy link
Copy Markdown
Contributor

@codeconsole codeconsole commented Mar 23, 2026

Validates namespace, controller and action. If validation fails, triggers next mapping.
Literals override wildcards.

        "/$namespace/$controller/$action?/$id?(.$format)?" {}
        "/$controller/$action?/$id?(.$format)?"{}
        "/community" { controller: 'topic', action: 'home' } // literals win even when namespace or controller CommunityController exists
        group "/community", namespace: 'community', { 
              "/$controller/$action?"()
              group "/files", controller: 'fileServing', namespace: null, { // allow null namespace overrides on group mappings
                     "/$imageId"()
              }
        } 
        "/$username"(controller: 'profile', action: 'show'

Without validation, you have to a do something messy like this:

        "/$username"(ontroller: 'profile', action: 'show') {
            constraints {
                username(validator: { val -> !(val in reserved) })
            }
        }

I can't think why you would want to disable this feature, but it can be disabled via:

grails:                                                                                                                                                    
    web:                                                                                                                                                   
        url:                                                                                                                                               
           mapping:                                                                                                                                       
               validateWildcards: false 

Does not affect performance:

  1. Calls info.configure(webRequest) for each match — sets params on the web request
  2. Does a ConcurrentHashMap.get() for the ControllerKey lookup
  3. Now additionally: info.hasWildcardCaptures() (three instanceof checks) when the lookup misses

Steps 1 and 2 were already happening before this change. The only new cost is step 3, which is negligible.

@testlens-app

This comment has been minimized.

@testlens-app

This comment has been minimized.

@testlens-app

This comment has been minimized.

@testlens-app

This comment has been minimized.

@testlens-app

This comment has been minimized.

@testlens-app

This comment has been minimized.

@testlens-app

This comment has been minimized.

@testlens-app

This comment has been minimized.

@codeconsole
Copy link
Copy Markdown
Contributor Author

I am doing some final testing and want to do 1 more doc update before merging

@testlens-app

This comment has been minimized.

@testlens-app

This comment has been minimized.

@matrei
Copy link
Copy Markdown
Contributor

matrei commented Mar 28, 2026

@codeconsole There is an existing config setting with the config key:

grails:
    urlmapping:
        cache:
            maxsize: 1000

Should we use that namespace instead for validateWildcards?

grails:
    urlmapping:
        validateWildcards: false
        cache:
            maxsize: 1000

@testlens-app
Copy link
Copy Markdown

testlens-app bot commented Mar 29, 2026

✅ All tests passed ✅

⚠️ TestLens detected flakiness ⚠️

Test Summary

Check Project/Task Test Runs
CI / Functional Tests (Java 21, indy=false) :grails-test-examples-app1:integrationTest AsyncPromiseSpec > async service processes string input ❌ ✅
CI / Functional Tests (Java 21, indy=false) :grails-test-examples-app1:integrationTest AsyncPromiseSpec > multi-stage process reports all stages ❌ ✅

🏷️ Commit: 04904da
▶️ Tests: 9974 executed
⚪️ Checks: 35/35 completed


Learn more about TestLens at testlens.app.

@codeconsole codeconsole merged commit 95f9749 into apache:7.1.x Mar 29, 2026
62 of 63 checks passed
@jdaugherty jdaugherty deleted the url-mapping-wildcard-validation branch March 29, 2026 17:21
@codeconsole
Copy link
Copy Markdown
Contributor Author

codeconsole commented Apr 1, 2026

@codeconsole There is an existing config setting with the config key:

@matrei
yeah, I will create another PR

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

3 participants