Fix codebase review findings across routing, servlet, multipart and server

[ghosthack]

Fixes the findings from a full codebase review. Each fix has a regression test. The test count goes from 243 to 331, and mvn verify passes, including the javadoc build.

Security and robustness

• Multipart:
  • Repeated field names took quadratic CPU: about 200k parts under the 10 MB limit cost 18.6 s. Values are now stored in lists.
  • A request with more than 1000 parts gets a 413 (MultipartParser.setMaxParts).
  • Parsing makes fewer copies of the body.
• Redirects:
  • redirect() now rejects every control character, including TAB.
  • New redirectLocal() and Validation.isLocalPath() block open redirects such as //evil.com, /\evil.com and https://…. A target that isn't a local path gets a 400.
• Servlet backend: an exception from an action is logged and answered with a 500 instead of reaching the container, whose error page could show a stack trace.
• Log forging: the embedded server logs the raw path with control characters escaped, so %0A in a URL can't forge log lines.
• ClassForName: a class is no longer initialized before its type is checked, LinkageErrors are wrapped, and the class name is trimmed.
• Release workflow:
  • Permissions are scoped to the job, and checkout sets persist-credentials: false.
  • The GPG passphrase is passed as MAVEN_GPG_PASSPHRASE.
  • The GitHub release is created as a draft, since publishing to Central is manual.

Correctness

• Servlet forwards: Servlet.service() saves and restores the thread-local Env. Before, a forward()/alias() back into turismo broke the outer action.
• Argument binding:
  • InputStream arguments are bound after the others. Before, (InputStream in, String name) gave a 500.
  • Reading form fields after the raw body is a 400.
• controller():
  • Override detection compares name and parameter types. Before, an overload in a subclass hid a parent route.
  • Registration is all-or-nothing.
  • Parameter names of abstract methods are read from the concrete override.
• Routing:
  • Trailing slashes and empty segments now count everywhere, in both App and the servlet ListResolver.
  • Re-registering a pattern route replaces it, as it already did for exact routes.
  • OPTIONS is answered automatically with a 204 and Allow, and 405 Allow headers list OPTIONS.
• Float/double arguments: NaN, Infinity, hex values and overflow get a 400.
• Multipart:
  • A field name can hold several files (getFile, getFiles, getFileNames), kept separate from text fields.
  • Query-string parameters are kept on multipart requests.
  • Backslashes in filenames are kept.
• Servlet charset: a request without a charset is decoded as UTF-8, matching the embedded server.
• Servlet router drift:
  • The servlet resolvers now block encoded-slash paths, as App does.
  • Registration is thread-safe (concurrent collections).
  • HEAD, 405 and OPTIONS are handled the same way as in App.
• Embedded server:
  • Status codes outside 200–599 are rejected.
  • HEAD responses carry the GET body's Content-Length.
• Alias: the forward target is validated.

New API

• Turismo.stream() / HttpContext.stream(): opt-in chunked streaming, embedded server only.
• Turismo.redirectLocal(...) and Validation.isLocalPath(...).
• Multipart: FilePart, MultipartRequest.getFile/getFiles/getFileNames, and MultipartParser.setMaxParts.
• Env.restore(Env), plus protected hooks on MethodPathResolver.

Docs

• README JSP example: the servlet is mapped to / instead of /*, which forwarded JSPs back into turismo and gave a 404.
• ExtendedRoutesMap section.
• Server timeouts, documented rather than set, because the JDK reads them from global system properties.
• Streaming and open-redirect guidance.
• All behavior changes are listed under Upgrading to 5.0.

Behavior changes to note

• /users/:id no longer matches /users/42/.
• 405 Allow headers now include OPTIONS.
• On the embedded server, status() throws for codes outside 200–599.
• The multipart filename escape \" is no longer decoded; %22 is.

Not changed

• jsp() still forwards by path rather than through the named jsp servlet: a named forward keeps the request path, which Jasper would try to render instead of the JSP file.
• The two routing engines are aligned, not merged into one.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Qjn6ZdPkHxbqCyPby4Lu4V

---

Generated by Claude Code