Repository navigation
Keep the validated request body value by default - #55
Closed
mromaszewicz wants to merge 1 commit into
Closed
mromaszewicz wants to merge 1 commit into
mromaszewicz wants to merge 1 commit into
Conversation
oapi-codegen strict servers are being changed to bind the value that request validation decoded instead of decoding the body a second time (oapi-codegen/oapi-codegen#2605). Decoding twice allowed a validation bypass: encoding/json matches object members case-insensitively, so a body such as {"role":"user","ROLE":"admin"} validates as role "user" but binds as Role "admin". kin-openapi's openapi3filter.Options.KeepValidatedValue leaves the decoded, validated body on the validated request's Body behind a ValidatedValue() method. Enable it by default, consistently with the other oapi-codegen middlewares. The filter options are now built by a filterOptions helper from a copy of the caller's Options.Options, so the caller's struct is never modified; with no options at all, the middleware now passes {KeepValidatedValue: true} instead of nil. Add Options.DiscardValidatedValue as the opt-out, for instance to limit memory retention for very large request bodies. It overrides any KeepValidatedValue set in Options.Options. In this middleware the setting has no visible effect yet: validation runs on a net/http request converted from the fiber context by adaptor.ConvertRequest, which is a copy, so fiber handlers never see anything openapi3filter attaches to its body. Exposing the value to handlers (for example via c.Locals) is left to a later change; the Options field doc comment and README say so. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Member
Author
|
I changed my mind, I don't want a non-functional flag for symmetry with other middleware. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Enables kin-openapi's
openapi3filter.Options.KeepValidatedValueby default, with an opt-out, for consistency with the other oapi-codegen middlewares.With the flag on, openapi3filter leaves the value it decoded and validated on the validated request's body behind a
ValidatedValue() anymethod, which oapi-codegen strict servers are being changed to bind (oapi-codegen/oapi-codegen#2605). This middleware validates anet/httprequest produced byadaptor.ConvertRequest, a copy, so Fiber handlers do not yet observe the value and there is no behaviour change for them. The README and the field's doc comment say so. Exposing it to Fiber handlers (for example viac.Locals) is a follow-up.Changes:
Options.DiscardValidatedValueturns the flag back off. It overridesOptions.Options.KeepValidatedValue.openapi3filter.Optionsis copied, never mutated; nil options now get{KeepValidatedValue: true}.Requires kin-openapi v0.151.0 or later;
mainis on v0.152.0.🤖 Generated with Claude Code