Spring Bug in HttpHeaders class. Headers are not mutated properly in constructor

There is a serious bug in org.springframework.http.HttpHeaders in the following constructor

public HttpHeaders(MultiValueMap<String, String> headers) {
    Assert.notNull(headers, "MultiValueMap must not be null");
    this.headers = headers;
}

As one can notice the constructor is keeping only a reference of the headers passed as arguments. Due to this, if the passed argument is of instance ReadOnlyHttpHeaders then any add/remove operation is throwing exception.

The above problem also affects the Spring Cloud Gateway filter org.springframework.cloud.gateway.filter.factory.RemoveRequestHeaderGatewayFilterFactory

The following code snippet

exchange.getRequest().mutate().headers(httpHeaders -> httpHeaders.remove(config.getName())).build()

will always throw exception when the headers are read only.

The mutate function call org.springframework.http.server.reactive.DefaultServerHttpRequestBuilder which then internally calls HttpHeaders.writableHttpHeaders.

In HttpHeaders.writableHttpHeaders the following line is causing the problem return (headers instanceof ReadOnlyHttpHeaders ? new HttpHeaders(headers.headers) : headers); because as initially mentioned the HttpHeaders constructor is simply holding a reference of the read only headers and not mutating in true sense. This bug needs to be fixed ASAP.

Comment From: bclozel

This has been fixed already. Please take the time to search the issue tracker before submitting a new issue.

Duplicates https://github.com/spring-projects/spring-framework/issues/33789

Comment From: d3bt3ch

This has been fixed already. Please take the time to search the issue tracker before submitting a new issue.

Duplicates #33789

Thanks for letting me know. This got resolved the day I posted the bug too. So there was no point searching the issue tracker.

Comment From: d3bt3ch

This has been fixed already. Please take the time to search the issue tracker before submitting a new issue. Duplicates #33789

Thanks for letting me know. This got resolved the day I posted the bug too. So there was no point searching the issue tracker.

A thumbs down. Seriously 🤔