Skip to content

Required not enforced for struct-typed query params (e.g. date) #134

Description

@mromaszewicz

Mirrors oapi-codegen/oapi-codegen#2403.

A required query parameter whose Go type is a struct (e.g. types.Date, time.Time) is not enforced when the parameter is absent: BindQueryParameterWithOptions returns nil instead of a RequiredParameterError.

In the exploded form path, the reflect.Struct case does:

if !fieldsPresent {
    return nil
}

with no required check — unlike the adjacent slice/scalar branches, which do return RequiredParameterError. The same gap exists in BindRawQueryParameter.

This is long-standing, but it surfaced as a regression because oapi-codegen 2.7.0 stopped emitting an explicit presence check in the generated handler and now delegates required-checking to the runtime. So a missing required date query param silently passes instead of returning a 400.

Fix: honor required in the struct case, matching the slice/scalar branches:

if !fieldsPresent {
    if required {
        return &RequiredParameterError{ParamName: paramName}
    }
    return nil
}

in both BindQueryParameterWithOptions and BindRawQueryParameter (bindparam.go).

See oapi-codegen/oapi-codegen#2403 for the full analysis.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions