Skip to content

Required not enforced for struct-typed query params (e.g. date) #134

Description

@mromaszewicz

Mirrors oapi-codegen/oapi-codegen#2403.

A required query parameter whose Go type is a struct (e.g. types.Date, time.Time) is not enforced when the parameter is absent: BindQueryParameterWithOptions returns nil instead of a RequiredParameterError.

In the exploded form path, the reflect.Struct case does:

if !fieldsPresent {
    return nil
}

with no required check — unlike the adjacent slice/scalar branches, which do return RequiredParameterError. The same gap exists in BindRawQueryParameter.

This is long-standing, but it surfaced as a regression because oapi-codegen 2.7.0 stopped emitting an explicit presence check in the generated handler and now delegates required-checking to the runtime. So a missing required date query param silently passes instead of returning a 400.

Fix: honor required in the struct case, matching the slice/scalar branches:

if !fieldsPresent {
    if required {
        return &RequiredParameterError{ParamName: paramName}
    }
    return nil
}

in both BindQueryParameterWithOptions and BindRawQueryParameter (bindparam.go).

See oapi-codegen/oapi-codegen#2403 for the full analysis.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions