fix: trim Options.Prefix in place so the request body survives security validation - #17
Open
blacksud0 wants to merge 1 commit into
Open
fix: trim Options.Prefix in place so the request body survives security validation#17blacksud0 wants to merge 1 commit into
blacksud0 wants to merge 1 commit into
Conversation
…ty validation Request.Clone copies the Body reference. With Prefix set and a security scheme in the spec, openapi3filter's security validation reads the body from the live request and restores a fresh reader onto the clone only, so every POST/PUT/PATCH through a prefixed mount reached its handler with a drained, zero-byte body — even with ExcludeRequestBody enabled, since the read belongs to the security path. Trimming URL.Path (and RawPath, which the clone approach left untrimmed) in place with a deferred restore keeps RequestValidationInput.Request the live request, so the body restore lands where it is needed, and the restore runs before next so handlers still observe the original path — the existing prefix test's path assertion keeps passing. The new regression test fails against the previous clone-based handling and passes with this change. Fixes oapi-codegen#16
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #16.
Request.Clonecopies theBodyreference. WithOptions.Prefixset and a security scheme in the spec,openapi3filter's security validation reads the body from the live request and restores a fresh reader onto the clone only — so every POST/PUT/PATCH through a prefixed mount reached its handler with a drained, zero-byte body (even withExcludeRequestBodyenabled, since the read belongs to the security path).This trims
URL.Path— andRawPath, which the clone approach left untrimmed — in place, restoring both in adefer.RequestValidationInput.Requeststays the live request, so the body restore lands where it is needed; the restore runs beforenext, so handlers still observe the original path and the existing prefix test's path assertion keeps passing.The new regression test fails against the previous clone-based handling (
the handler received a drained body … was []) and passes with this change. Full suite green. This is the fix we have been running in production as a vendored copy.