grailsdata-bindinggspgrails-2.3command-objects

Data binding not working if index is greater than 255


I am working on a application using grails version 2.3.9. There I am rendering a list with check-box. User can select any row(s) and submit the page. And at server side I am using command object to bind the data.

My command object--

@Validateable
class MyCO {

    List<MyDoamin> myDomains = ListUtils.lazyList([], FactoryUtils.instantiateFactory(MyDoamin))
    ...

    static constraints = {
        myDomains nullable: false, validator: { val, obj ->
            if (val.size() < 1) {
                return "error.code"
            }
        }
        ...
    }
}

View--

<g:each in="${myDomains}" var="myDomain" status="idx">
  <tr>
    <td>
      <input type="checkbox" name="myDomains[${idx}].id" value="${myDomain.id}" checked>
    </td>
    ...
  </tr>
</g:each>

Action--

def myAction(MyCO myCO) {
    if (myCO.validate()) {
        ...
    } else {
        log.error "-----INVALID-----"
        ...
    }
}

This code is working fine. But if user select row(s) whose index (idx) value is greater than 255 then data binding is not working.

Request params--

[myDomains[256].id:66, myDomains[256]:[id:66], action:myAction, controller:myController]

I also tried with

List<MyDoamin> myDomains

and

List<MyDoamin> myDomains = [].withDefault { new Client() }

in the command object, but same result, no data binding.

Am I doing something wrong here? How can I fix this?


Solution

  • By default collection auto-growth limit is set to 255:

    https://github.com/grails/grails-core/blob/2.3.x/grails-plugin-databinding/src/main/groovy/org/codehaus/groovy/grails/plugins/databinding/DataBindingGrailsPlugin.groovy#L58

    You can change this by setting the grails.databinding.autoGrowCollectionLimit in Config.groovy to something else.

    The reason for this limit is an attacker could craft a Denial of Service attack that exhausted all memory by creating thousands of objects during data binding, which is not what you want.