Repository navigation
Keep the validated request body value by default - #20
Merged
mromaszewicz merged 1 commit intoOct 23, 2026
Merged
Conversation
Enable openapi3filter.Options.KeepValidatedValue by default. With it, openapi3filter leaves the decoded, validated request body value on req.Body behind a ValidatedValue() any method, while the body stays readable with its original bytes. oapi-codegen strict servers are being changed to bind that value (oapi-codegen/oapi-codegen#2605) instead of decoding the body a second time. Decoding twice is a validation bypass: encoding/json matches object member names case-insensitively, so {"role":"user","ROLE":"admin"} validates as role: user but binds as Role: "admin". For the fix to protect users by default, the middleware has to keep the value by default. The middleware now passes openapi3filter a copy of Options.Options with KeepValidatedValue set, leaving the caller's struct untouched; nil options (OapiRequestValidator, OapiValidatorFromYamlFile, or ValidateRequestFromContext called with nil) also keep the value. The new Options.DiscardValidatedValue opts out, for instance to limit memory retention for very large request bodies, and overrides Options.Options.KeepValidatedValue. Any middleware placed after the validator that replaces the request body (decompression, size limiting, logging wrappers) hides the validated value from handlers, so such middleware belongs before the validator. The README documents the default, the opt-out and this ordering caveat. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Enables kin-openapi's
openapi3filter.Options.KeepValidatedValueby default, with an opt-out.With the flag on, the request body that reaches the handler exposes the value the validator decoded and validated through a
ValidatedValue() anymethod. The body itself stays fully readable. oapi-codegen strict servers are being changed (oapi-codegen/oapi-codegen#2605) to bind that value instead of decoding the body a second time, which closes a validation bypass:encoding/jsonmatches member names case-insensitively, so{"role":"user","ROLE":"admin"}validates asrole: userbut binds asRole: "admin". Defaulting the flag here makes that fix effective without configuration.Changes:
Options.DiscardValidatedValueturns the flag back off, for example to limit memory retention for very large bodies. It overridesOptions.Options.KeepValidatedValue.openapi3filter.Optionsis copied, never mutated; nil options now get{KeepValidatedValue: true}.KeepValidatedValue: true), andExcludeRequestBody, and check the body still reads the original bytes.Requires kin-openapi v0.151.0 or later;
mainis on v0.152.0.🤖 Generated with Claude Code