Issue
I am working on a legacy project containing many jsps and models. Lot of places, people have used @ModelAttribute
to map the request parameters to the specific model class.
My question is, in the conversion of request params to model, does spring internally invoke request.getParameter()
method? I want to prevent XSS and already have XSS filter in place. But during request params to model conversion, I don't see control coming to my overriden getParameter()
mthod.
Solution
For binding Spring has the DataBinder
abstraction, for a web request that utilizes the ServletRequestDataBinder
. If you take a look at the source code you will end up here which shows a call to WebUtils.getParametersStartingWith
.
If you look at the last code you will see that it uses getParameterNames
and getParameterValues
instead of getParameter
.
Answered By - M. Deinum