Repository navigation
fix: trim Options.Prefix in place so the request body survives security validation - #17
Merged
Merged
Conversation
…ty validation Request.Clone copies the Body reference. With Prefix set and a security scheme in the spec, openapi3filter's security validation reads the body from the live request and restores a fresh reader onto the clone only, so every POST/PUT/PATCH through a prefixed mount reached its handler with a drained, zero-byte body — even with ExcludeRequestBody enabled, since the read belongs to the security path. Trimming URL.Path (and RawPath, which the clone approach left untrimmed) in place with a deferred restore keeps RequestValidationInput.Request the live request, so the body restore lands where it is needed, and the restore runs before next so handlers still observe the original path — the existing prefix test's path assertion keeps passing. The new regression test fails against the previous clone-based handling and passes with this change. Fixes oapi-codegen#16
Bring in main so the fix builds and is tested against kin-openapi v0.152.0 (with Options.KeepValidatedValue) and echo v5.4.1. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Move the prefix body regression test into oapi_validate_test.go next to TestOapiRequestValidatorWithPrefix and broaden it: the handler must get the exact body bytes and the original /api path for plain body validation, for security validation with ExcludeRequestBody, and with KeepValidatedValue, where the body must also expose ValidatedValue(). A new test sends a %2F path parameter under the prefix, which only routes when the prefix is trimmed from URL.RawPath too. All of these fail against the previous req.Clone()-based handling. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Member
|
Thanks for the fix, @blacksud0! I pushed two commits on top of your branch so this can go in:
Your commit and the fix in |
mromaszewicz
added a commit
to karlpip/echo-middleware
that referenced
this pull request
Oct 23, 2026
Validating a req.Clone() meant openapi3filter put the re-readable body, the KeepValidatedValue wrapper and any defaults-rewritten ContentLength back on the clone only. Copying Body/GetBody back still missed ContentLength, and only URL.Path was trimmed, so percent-encoded path parameters under a prefix mis-routed. Follow the approach of oapi-codegen/echo-v5-middleware#17 by blacksud0 so both repos share one fix: trim URL.Path and URL.RawPath on the live request and restore them in a defer that runs before the next handler. Everything kin writes to the body now lands on the request the handler sees. An AuthenticationFunc reading GetEchoContext(ctx).Request().URL.Path now sees the trimmed path during validation. Keep the POST case added to TestOapiRequestValidatorWithPrefix and add tests for the issue oapi-codegen#49 security + AuthenticationFunc + body scenario (exact body, ContentLength, original path), a defaults-rewritten body, KeepValidatedValue, and a percent-encoded path parameter under a prefix. Closes oapi-codegen#49 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
mromaszewicz
approved these changes
Oct 23, 2026
mromaszewicz
added a commit
to oapi-codegen/echo-middleware
that referenced
this pull request
Oct 23, 2026
* restore body on clone * add test * Trim the prefix in place instead of validating a clone Validating a req.Clone() meant openapi3filter put the re-readable body, the KeepValidatedValue wrapper and any defaults-rewritten ContentLength back on the clone only. Copying Body/GetBody back still missed ContentLength, and only URL.Path was trimmed, so percent-encoded path parameters under a prefix mis-routed. Follow the approach of oapi-codegen/echo-v5-middleware#17 by blacksud0 so both repos share one fix: trim URL.Path and URL.RawPath on the live request and restore them in a defer that runs before the next handler. Everything kin writes to the body now lands on the request the handler sees. An AuthenticationFunc reading GetEchoContext(ctx).Request().URL.Path now sees the trimmed path during validation. Keep the POST case added to TestOapiRequestValidatorWithPrefix and add tests for the issue #49 security + AuthenticationFunc + body scenario (exact body, ContentLength, original path), a defaults-rewritten body, KeepValidatedValue, and a percent-encoded path parameter under a prefix. Closes #49 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: Marcin Romaszewicz <marcinr@gmail.com> Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #16.
Request.Clonecopies theBodyreference. WithOptions.Prefixset and a security scheme in the spec,openapi3filter's security validation reads the body from the live request and restores a fresh reader onto the clone only — so every POST/PUT/PATCH through a prefixed mount reached its handler with a drained, zero-byte body (even withExcludeRequestBodyenabled, since the read belongs to the security path).This trims
URL.Path— andRawPath, which the clone approach left untrimmed — in place, restoring both in adefer.RequestValidationInput.Requeststays the live request, so the body restore lands where it is needed; the restore runs beforenext, so handlers still observe the original path and the existing prefix test's path assertion keeps passing.The new regression test fails against the previous clone-based handling (
the handler received a drained body … was []) and passes with this change. Full suite green. This is the fix we have been running in production as a vendored copy.