Mirrors oapi-codegen/oapi-codegen#2403.
A required query parameter whose Go type is a struct (e.g. types.Date, time.Time) is not enforced when the parameter is absent: BindQueryParameterWithOptions returns nil instead of a RequiredParameterError.
In the exploded form path, the reflect.Struct case does:
if !fieldsPresent {
return nil
}
with no required check — unlike the adjacent slice/scalar branches, which do return RequiredParameterError. The same gap exists in BindRawQueryParameter.
This is long-standing, but it surfaced as a regression because oapi-codegen 2.7.0 stopped emitting an explicit presence check in the generated handler and now delegates required-checking to the runtime. So a missing required date query param silently passes instead of returning a 400.
Fix: honor required in the struct case, matching the slice/scalar branches:
if !fieldsPresent {
if required {
return &RequiredParameterError{ParamName: paramName}
}
return nil
}
in both BindQueryParameterWithOptions and BindRawQueryParameter (bindparam.go).
See oapi-codegen/oapi-codegen#2403 for the full analysis.
Mirrors oapi-codegen/oapi-codegen#2403.
A required query parameter whose Go type is a struct (e.g.
types.Date,time.Time) is not enforced when the parameter is absent:BindQueryParameterWithOptionsreturnsnilinstead of aRequiredParameterError.In the exploded
formpath, thereflect.Structcase does:with no
requiredcheck — unlike the adjacent slice/scalar branches, which do returnRequiredParameterError. The same gap exists inBindRawQueryParameter.This is long-standing, but it surfaced as a regression because oapi-codegen 2.7.0 stopped emitting an explicit presence check in the generated handler and now delegates required-checking to the runtime. So a missing required
datequery param silently passes instead of returning a 400.Fix: honor
requiredin the struct case, matching the slice/scalar branches:in both
BindQueryParameterWithOptionsandBindRawQueryParameter(bindparam.go).See oapi-codegen/oapi-codegen#2403 for the full analysis.