formValueForKey() throws on a repeated parameter — user-controlled input can make route handlers fail #92

Summary

NGRequest.formValueForKey( key ) throws IllegalStateException when the request contains more than one value for key (NGStandardRequest.formValueForKey). Query parameters are fully under the visitor's control, so any handler that calls formValueForKey can be made to throw just by repeating a parameter in the URL.

Example

A route handler reading an optional ?month=2026-11 parameter:

final String monthParam = request.formValueForKey( "month" );

Requesting /calendar/?month=2026-11&month=2026-12 makes the exception propagate out of the route handler, so a page that would otherwise render fine fails on a crafted (or just sloppy, e.g. double-appended by some JS) URL. The safe version is

final String monthParam = request.formValuesForKey( "month" ).stream().findFirst().orElse( null );

which every handler then has to remember to write.

Why flag it

The fail-fast intent is reasonable (and the message is good), but formValueForKey is the obvious, WO-familiar method and the one ported code reaches for. Since it's fed by untrusted input, its failure mode should probably be predictable rather than an exception. Some options:

• return the first value (what WO and most servlet APIs do), maybe logging a warning in development mode;
• keep the strict behaviour but give it an explicit name (singleFormValueForKey?), making the lenient one the default;
• or convert it to a 400 Bad Request instead of an unhandled exception.

Related to #66, which is reworking how form values are parsed anyway.