Better handling of illegal locale values in LocaleChangeInterceptor [SPR-9456]

[spring-projects-issues]

Kaj Hejer opened SPR-9456 and commented

When url contains illegal values for locale in the lang parameter like

http://www.myhost.com/index.html?lang=en-

LocaleChangeInterceptor throws an exception:

java.lang.IllegalArgumentException: Locale value "no-" contains invalid characters
        at org.springframework.util.StringUtils.parseLocaleString(StringUtils.java:671)
        at org.springframework.web.servlet.i18n.LocaleChangeInterceptor.preHandle(LocaleChangeInterceptor.java:73)
        at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:781)
        at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:719)
        at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:669)
        at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:574)
        at javax.servlet.http.HttpServlet.doHead(HttpServlet.java:238)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:117)

Maybe a better solution is to catch this exception in LocaleChangeInterceptor and just write a logmessage.

---

Affects: 3.1 GA

Issue Links:

• LocaleChangeInterceptor not protected against CSRF [SPR-13032] #17624 LocaleChangeInterceptor not protected against CSRF
• BCP 47 compatible Locale support [SPR-13274] #17865 BCP 47 compatible Locale support

1 votes, 5 watchers

[spring-projects-issues]

Christian Gendreau commented

Is there a way to by pass this issue without extending LocaleChangeInterceptor ?
This issue makes it hard to recover from a simple wrong query parameter.

Thanks

[spring-projects-issues]

Jeff Conrad commented

FYI
http://stackoverflow.com/questions/24786962/define-default-locale-and-treat-exceptions-for-spring-locale-interceptor
mentions a workaround.

[spring-projects-issues]

Rossen Stoyanchev commented

Will take a look at this for 4.2.2.

[spring-projects-issues]

Juergen Hoeller commented

I've added an "ignoreInvalidLocale" property to LocaleChangeInterceptor, catching such an IllegalArgumentException and logging its message at debug level instead of propagating it.

Juergen