Spring file upload not binding to model attribute object

Question

I want to build a simple file upload functionality using Spring MVC.

I have the multipartResolver in place and working:

<bean id="multipartResolver" class="org.springframework.web.multipart.commons.CommonsMultipartResolver">
  <property name="maxUploadSize" value="10240000"/>
</bean>

When uploading a file this is logged:

DEBUG:[org.springframework.web.multipart.commons.CommonsMultipartResolver]: Found multipart file [imageUpload] of size 29081 bytes with original filename [xyz.jpg], stored at [/home/myuser/workspace/myProject/target/tmp/upload_67f1107c_1b8f_402c_bebd_6cd8a6e4c830_00000032.tmp]

which tells me that it's basically working.

This is part of my JSP:

<form:form modelAttribute="placeForm" action="/platz/save" method="post" cssClass="placeForm" enctype="multipart/form-data">
...
        <label for="imageUpload">Upload</label>
        <form:input type="file" path="imageUpload" id="imageUpload" accept="image/*" />
...
</form:form>

This is my model attribute object's class:

public class PlaceEditForm
{
    @Valid
    private Place place = new Place();
    private Map<Integer, PlaceFeature> features;
    private MultipartFile imageUpload;
... getter/setter omitted...
}

And this is part of my Controller method:

@RequestMapping(value="/save", method=RequestMethod.POST)
public String savePlace (@Valid @ModelAttribute("placeForm") PlaceEditForm form, BindingResult result)
{
    logger.debug("saveNewPlace");
    logger.debug("Upload: "+form.getImageUpload()); // null
    ...
    return "redirect:/platz/"+place.getPlaceId();
}

What happens is, that the imageUpload attribute of the form object is not populated (null), whereas all other form properties are.

I found that it does work when I use this in the controller:

@RequestMapping(value="/save", method=RequestMethod.POST)
public String savePlace (@Valid @ModelAttribute("placeForm") PlaceEditForm form, BindingResult result, @RequestParam("imageUpload") MultipartFile upload, BindingResult uploadResult)
{
    logger.debug("saveNewPlace");
    logger.debug("Upload: "+upload); // Works!!
    ...
    return "redirect:/platz/"+place.getPlaceId();
}

So, having the MultipartFile as a @RequestParam works, but binding it to the form's modelAttribute object doesn't. I found hundreds of examples on the web that do about the same and I don't find the difference.

I'm still learning Spring, so I might miss a very obvious point. I could just use the second version of the controller, but I don't understand it, and as I said, I'm learning.

Shouldn't all the <form:input path="abc"> properties inside the <form:form modelAttribute="xyz">...</form:form> be bound to xyz.abc? It works like this for all properties except the file upload.

Any insights? Thanks

score 6 · Accepted Answer · answered Jul 29 '13 at 19:05

6

I found the problem:

I had a method like this in the controller, but forgot to add the imageUpload property. Very stupid and easy once found..!

@InitBinder
public void initBinder(WebDataBinder binder)
{
    binder.setAllowedFields("place.placeId", "place.name", "place.description", "place.directions", "place.coordinates*", "features*", "tmpFiles*", "removeFiles*");
}

This prevents the binder to bind any other properties to the modelAttribute than the ones specified. Very important security measure to prevent evildoers from feeding in dangerous information into your system, when you only validate what you expect to be on the front-end.

answered Jul 29 '13 at 19:05

marc82ch

1,004
3
11
27

I was looking at this example and it seems we are defining the properties inside the `class PlaceEditForm` and its own properties. Where can I read more about how `setAllowedFields` work to identify the list supplied here and how it handles wildcards in param names. Any direction on this would be helpful. Thanks! cc @marc82ch – Samarth Asthana Oct 15 '20 at 13:19
1

@SamarthAsthana If I were you I'd use three different places to find more information: 1) Spring MVC documentation, 2) JavaDoc of WebDataBinder, 3) Source code of WebDataBinder and more classes if needed. You should rely on documented bevavior only, but sometimes it's good to understand *how* it works by looking at the actual source code, gladly Spring is open-source. – marc82ch Oct 19 '20 at 05:53

Spring file upload not binding to model attribute object

1 Answers1

Linked