From c6c0d6d77f36b72e8850eb467d324b06010689f6 Mon Sep 17 00:00:00 2001
From: Fabien Chebel <fabien.chebel@mirakl.com>
Date: Tue, 12 Jul 2022 17:45:55 +0200
Subject: [PATCH] Allow hiding model attributes in redirects

Context
-------

Spring Web MVC allows performing redirections by returning a String prefixed by `redirect://` in the controller.

This String is intercepted by `ThymeleafViewResolver` which maps it to an instance of `RedirectView`.

Problem
-------

The default behaviour of `RedirectView` is to include all model attributes as query parameters.

This behaviour may not be desirable and thymeleaf-spring does not provide a way to easily change it.

Suggested fix
-------------

Expose a method called `setRedirectExposeModelAttributes` in `ThymeleafViewResolver` to allow overriding this behaviour.
---
 .../spring5/view/ThymeleafViewResolver.java   | 34 +++++++++++++++++--
 .../spring6/view/ThymeleafViewResolver.java   | 30 +++++++++++++++-
 2 files changed, 60 insertions(+), 4 deletions(-)

diff --git a/thymeleaf-spring5/src/main/java/org/thymeleaf/spring5/view/ThymeleafViewResolver.java b/thymeleaf-spring5/src/main/java/org/thymeleaf/spring5/view/ThymeleafViewResolver.java
index 4cc78214..9a94f5a4 100755
--- a/thymeleaf-spring5/src/main/java/org/thymeleaf/spring5/view/ThymeleafViewResolver.java
+++ b/thymeleaf-spring5/src/main/java/org/thymeleaf/spring5/view/ThymeleafViewResolver.java
@@ -91,6 +91,7 @@ public class ThymeleafViewResolver
 
     private boolean redirectContextRelative = true;
     private boolean redirectHttp10Compatible = true;
+    private boolean redirectExposeModelAttributes = true;
 
     private boolean alwaysProcessRedirectAndForward = true;
 
@@ -523,8 +524,35 @@ public void setRedirectHttp10Compatible(final boolean redirectHttp10Compatible)
     public boolean isRedirectHttp10Compatible() {
         return this.redirectHttp10Compatible;
     }
-    
-    
+
+
+    /**
+     * <p>
+     *     Set whether model attributes should be appended to the URI, when performing a redirection.
+     * </p>
+     *
+     * @param redirectExposeModelAttributes true if model attributes should be appended to the redirect URI,
+     *        false if not
+     * @see RedirectView#setExposeModelAttributes(boolean)
+     */
+    public void setRedirectExposeModelAttributes(final boolean redirectExposeModelAttributes) {
+        this.redirectExposeModelAttributes = redirectExposeModelAttributes;
+    }
+
+
+    /**
+     * <p>
+     *     Return whether model attributes should be appended to the URI, when performing a redirection.
+     * </p>
+     *
+     * @return whether model attributes should be appended to the URI, when performing a redirection.
+     * @see RedirectView#setExposeModelAttributes(boolean)
+     *
+     */
+    public boolean shouldRedirectExposeModelAttributes() {
+        return this.redirectExposeModelAttributes;
+    }
+
 
     /**
      * <p>
@@ -775,7 +803,7 @@ protected View createView(final String viewName, final Locale locale) throws Exc
         if (viewName.startsWith(REDIRECT_URL_PREFIX)) {
             vrlogger.trace("[THYMELEAF] View \"{}\" is a redirect, and will not be handled directly by ThymeleafViewResolver.", viewName);
             final String redirectUrl = viewName.substring(REDIRECT_URL_PREFIX.length(), viewName.length());
-            final RedirectView view = new RedirectView(redirectUrl, isRedirectContextRelative(), isRedirectHttp10Compatible());
+            final RedirectView view = new RedirectView(redirectUrl, isRedirectContextRelative(), isRedirectHttp10Compatible(), shouldRedirectExposeModelAttributes());
             return (View) getApplicationContext().getAutowireCapableBeanFactory().initializeBean(view, REDIRECT_URL_PREFIX);
         }
         // Process forwards (to JSP resources)
diff --git a/thymeleaf-spring6/src/main/java/org/thymeleaf/spring6/view/ThymeleafViewResolver.java b/thymeleaf-spring6/src/main/java/org/thymeleaf/spring6/view/ThymeleafViewResolver.java
index b1eaccb9..832b7274 100755
--- a/thymeleaf-spring6/src/main/java/org/thymeleaf/spring6/view/ThymeleafViewResolver.java
+++ b/thymeleaf-spring6/src/main/java/org/thymeleaf/spring6/view/ThymeleafViewResolver.java
@@ -91,6 +91,7 @@ public class ThymeleafViewResolver
 
     private boolean redirectContextRelative = true;
     private boolean redirectHttp10Compatible = true;
+    private boolean redirectExposeModelAttributes = true;
 
     private boolean alwaysProcessRedirectAndForward = true;
 
@@ -525,6 +526,33 @@ public boolean isRedirectHttp10Compatible() {
     }
 
 
+    /**
+     * <p>
+     *     Set whether model attributes should be appended to the URI, when performing a redirection.
+     * </p>
+     *
+     * @param redirectExposeModelAttributes true if model attributes should be appended to the redirect URI,
+     *        false if not
+     * @see RedirectView#setExposeModelAttributes(boolean)
+     */
+    public void setRedirectExposeModelAttributes(final boolean redirectExposeModelAttributes) {
+        this.redirectExposeModelAttributes = redirectExposeModelAttributes;
+    }
+
+
+    /**
+     * <p>
+     *     Return whether model attributes should be appended to the URI, when performing a redirection.
+     * </p>
+     *
+     * @return whether model attributes should be appended to the URI, when performing a redirection.
+     * @see RedirectView#setExposeModelAttributes(boolean)
+     *
+     */
+    public boolean shouldRedirectExposeModelAttributes() {
+        return this.redirectExposeModelAttributes;
+    }
+
 
     /**
      * <p>
@@ -775,7 +803,7 @@ protected View createView(final String viewName, final Locale locale) throws Exc
         if (viewName.startsWith(REDIRECT_URL_PREFIX)) {
             vrlogger.trace("[THYMELEAF] View \"{}\" is a redirect, and will not be handled directly by ThymeleafViewResolver.", viewName);
             final String redirectUrl = viewName.substring(REDIRECT_URL_PREFIX.length(), viewName.length());
-            final RedirectView view = new RedirectView(redirectUrl, isRedirectContextRelative(), isRedirectHttp10Compatible());
+            final RedirectView view = new RedirectView(redirectUrl, isRedirectContextRelative(), isRedirectHttp10Compatible(), shouldRedirectExposeModelAttributes());
             return (View) getApplicationContext().getAutowireCapableBeanFactory().initializeBean(view, REDIRECT_URL_PREFIX);
         }
         // Process forwards (to JSP resources)