Skip to content

Set Spring MVC context when RequestContextFilter is absent - #327

Open
Mishenevd wants to merge 2 commits into
mainfrom
fix/spring-mvc-context-without-request-context-filter
Open

Set Spring MVC context when RequestContextFilter is absent#327
Mishenevd wants to merge 2 commits into
mainfrom
fix/spring-mvc-context-without-request-context-filter

Conversation

@Mishenevd

Copy link
Copy Markdown
Collaborator

Summary

Zen creates the Spring MVC context only by instrumenting RequestContextFilter#doFilterInternal. WebMvcAutoConfiguration.requestContextFilter() is @ConditionalOnMissingBean({RequestContextListener.class, RequestContextFilter.class}), so when the application registers a RequestContextListener bean the filter is never added to the chain. The context is then never set: controllers log Received Spring Annotations, but no context set on every request, and input/IP/user-agent inspection does not run.

Fix

Add SpringMVCDispatcherWrapper wrapping FrameworkServlet#processRequest — the entry point of every DispatcherServlet request, independent of the filter chain — which creates the context when none exists. The filter sets a per-request marker the fallback checks, so the normal path is unchanged and the context is not created twice.

Testing

Reproduced on Spring Boot 4.0.7 (Spring 7.0.8 / Tomcat 11.0.22) with a RequestContextListener bean: exact error on every request. Verified with the fix, forcing a single Tomcat worker thread, 3 sequential requests:

  • filter absent (RequestContextListener present): 0 errors, 3 fresh contexts, correct per-request routes;
  • filter present (default): 0 errors, 3 fresh contexts (no double creation), behavior unchanged.

@codecov

codecov Bot commented Jul 28, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

The Spring MVC context was only created by wrapping RequestContextFilter#doFilterInternal. WebMvcAutoConfiguration does not register that filter when a RequestContextListener bean is present, so the context was never set: controllers logged "Received Spring Annotations, but no context set" on every request and input/IP/UA inspection did not run.

Wrap FrameworkServlet#processRequest, which runs for every DispatcherServlet request regardless of the filter chain, and create the context when it is missing. A per-request marker set by the filter prevents double creation on the normal path.
@Mishenevd
Mishenevd force-pushed the fix/spring-mvc-context-without-request-context-filter branch from 3d736db to 90eda45 Compare July 28, 2026 12:17
New sample app (Spring Boot 4.0.7 / Spring 7, Jakarta) on HyperSQL that registers a RequestContextListener, which makes WebMvcAutoConfiguration skip the auto RequestContextFilter and forces Zen onto the FrameworkServlet#processRequest fallback. The e2e SQL-injection payload is blocked (500) with the fix and passes through (200) without it, guarding against regressions. Wired into the end2end matrix.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant