Required not enforced for struct-typed query params (e.g. date) · Issue #134 · oapi-codegen/runtime · GitHub
Skip to content

Required not enforced for struct-typed query params (e.g. date) #134

Description

@mromaszewicz

Mirrors oapi-codegen/oapi-codegen#2403.

A required query parameter whose Go type is a struct (e.g. types.Date, time.Time) is not enforced when the parameter is absent: BindQueryParameterWithOptions returns nil instead of a RequiredParameterError.

In the exploded form path, the reflect.Struct case does:

if !fieldsPresent {
    return nil
}

with no required check — unlike the adjacent slice/scalar branches, which do return RequiredParameterError. The same gap exists in BindRawQueryParameter.

This is long-standing, but it surfaced as a regression because oapi-codegen 2.7.0 stopped emitting an explicit presence check in the generated handler and now delegates required-checking to the runtime. So a missing required date query param silently passes instead of returning a 400.

Fix: honor required in the struct case, matching the slice/scalar branches:

if !fieldsPresent {
    if required {
        return &RequiredParameterError{ParamName: paramName}
    }
    return nil
}

in both BindQueryParameterWithOptions and BindRawQueryParameter (bindparam.go).

See oapi-codegen/oapi-codegen#2403 for the full analysis.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions