Repository navigation
fix: issue with header, validator - #67
Merged
Merged
Conversation
v3.3.0 decodes the body before binding the path, query and headers, but
the binders only overwrite the parameters present in the request. A
header-only field absent from the request kept the value the JSON
decoder took from a body key with the same name: Tenant
`header:"X-Tenant"` became "evil" with {"tenant":"evil"} and no header.
That defeats an application trusting a header set by a proxy, such as
X-User-Id.
After decoding the body, parseInput now resets the uri, query and header
fields that declare no body tag (json, form, xml, msgpack, cbor; "-"
counts as none), then binds them from the request. A field that also
declares a body tag keeps accepting either.
TestHeaderNotInRequestBody pinned the old behavior (a required header
satisfied from the body); it now expects 422.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
HTTPStatus, ContentType and Error were declared on *Problem, so a Problem passed by value (as TError or in OpenAPIOptions.Errors) implemented none of them: the library fell back to a Code int field, found a string, and served and documented a 500 in application/json. RawResponse had the same flaw: by value it was not a Responder and got encoded as JSON. The methods now have value receivers, so both work by value as well as by pointer. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A validator returning (nil, nil) made validateSecurityRequirement dereference a nil AuthContext and panic when security schemes are configured; with Bearer-only validation the request went on without a context. Every scheme validator (Bearer, Basic, API key, AWS SigV4) now turns such a result into an authentication failure, in routes and in the standalone middlewares alike. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Path, query and header fields never come from the body, Problem works by value, and a validator returning no context is a 401. The Method example had its first two arguments swapped: the signature is Method(router, method, path, handler, options). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.