Field 'host' in query parameters is automatically populated with HTTP 'Host' header after upgrading to 3.4.1

[bartolcz]

Hi,
I have encountered an issue with Spring Boot's data binding mechanism. When using a class in a controller method to bind query parameters, a field named host automatically gets populated with the value from the HTTP Host header if no parameter named host is provided in the request.

This behavior is unexpected because the host field should remain null if the parameter is not present in the request. Instead, the field is populated with the host value from the incoming request, such as localhost:8080.

Steps to Reproduce

@Getter
@Setter
@NoArgsConstructor
@AllArgsConstructor
public class InstancesFilterCriteria {
    private String host;
    private String name;
// and many more 
}

@GetMapping("/api/instances")
public ResponseEntity<?> getInstances(@Valid InstancesFilterCriteria filterCriteria) {
    return ResponseEntity.ok(filterCriteria.getHost());
}

http call
GET /api/instances?name=MyServer

Expected Behavior
The host field should remain null when the parameter is not provided in the request.

Actual Behavior
The host field is automatically populated with the value of the HTTP Host header (localhost:8080), even though the parameter is not present in the request.

I recently migrated from Spring Boot 2.7.18 to 3.4.1, and this issue started occurring after the migration.
What I want to achieve is control over my parameter naming, as the current implementation is highly integrated into the API and changing the naming convention is difficult to conclude at this stage.
Is there a way to configure Spring Boot to handle such naming collisions differently or prevent this automatic binding to the HTTP Host header?

I would greatly appreciate at least a brief explanation of this behavior and potential solutions.

Best Regards,
Bartek

[wilkinsona]

Duplicates spring-projects/spring-framework#34182.