Skip to content

openapi3filter: honor comma-separated and wildcard encoding.contentType#1201

Merged
fenollp merged 1 commit into
getkin:masterfrom
utah-KT:fix-multipart-encoding-contenttype-matching
Jun 3, 2026
Merged

openapi3filter: honor comma-separated and wildcard encoding.contentType#1201
fenollp merged 1 commit into
getkin:masterfrom
utah-KT:fix-multipart-encoding-contenttype-matching

Conversation

@utah-KT
Copy link
Copy Markdown
Contributor

@utah-KT utah-KT commented Jun 3, 2026

Bug

In multipart/form-data request validation, decodeBody compares a part's media type against encoding.contentType with an exact string match:

mediaType := parseMediaType(contentType)          // e.g. "image/png"
encodingContentType := getEncodingContentType(encFn) // e.g. "image/png, image/jpeg"
...
if encodingContentType != "" && mediaType != encodingContentType {
    return ... prefixNotMatchingCT ...            // "not matching content types"
}

But per the Encoding Object spec, contentType "can be a specific media type (e.g. application/json), a wildcard media type (e.g. image/*), or a comma-separated list of the two types" — and the official example uses contentType: image/png, image/jpeg.

So any part declared with a comma-separated list or a wildcard is rejected even when its Content-Type is one of the declared types. A part with Content-Type: image/png fails against image/png, image/jpeg.

Fix

  • Match per the spec: split encoding.contentType on commas and accept the part if its media type matches any entry — supporting type/* and */* wildcards, comparing case-insensitively, and ignoring parameters.
  • Read matched binary parts as raw bytes: a binary part (format: binary) whose matched content type has no registered decoder (e.g. image/png) is now read via FileBodyDecoder instead of failing with "unsupported content type" — the same handling binary parts already get when no encoding.contentType is set.

Compatibility

Single exact-value encodings and genuine mismatches behave exactly as before (same error and text); only previously-rejected valid cases now pass.

Tests

Added matching and binary-fallback table tests, and updated the existing multipart encoding test.

OAS 3.0 allows encoding.contentType to be a single media type, a wildcard, or a
comma-separated list; match a multipart part against each entry instead of doing
an exact string compare. Binary parts whose matched content type has no
registered decoder are now read as raw bytes rather than rejected.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@fenollp fenollp merged commit b292ee0 into getkin:master Jun 3, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants