openapi3filter: honor comma-separated and wildcard encoding.contentType#1201
Merged
fenollp merged 1 commit intoJun 3, 2026
Merged
Conversation
OAS 3.0 allows encoding.contentType to be a single media type, a wildcard, or a comma-separated list; match a multipart part against each entry instead of doing an exact string compare. Binary parts whose matched content type has no registered decoder are now read as raw bytes rather than rejected. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bug
In
multipart/form-datarequest validation,decodeBodycompares a part's media type againstencoding.contentTypewith an exact string match:But per the Encoding Object spec,
contentType"can be a specific media type (e.g.application/json), a wildcard media type (e.g.image/*), or a comma-separated list of the two types" — and the official example usescontentType: image/png, image/jpeg.So any part declared with a comma-separated list or a wildcard is rejected even when its
Content-Typeis one of the declared types. A part withContent-Type: image/pngfails againstimage/png, image/jpeg.Fix
encoding.contentTypeon commas and accept the part if its media type matches any entry — supportingtype/*and*/*wildcards, comparing case-insensitively, and ignoring parameters.format: binary) whose matched content type has no registered decoder (e.g.image/png) is now read viaFileBodyDecoderinstead of failing with "unsupported content type" — the same handling binary parts already get when noencoding.contentTypeis set.Compatibility
Single exact-value encodings and genuine mismatches behave exactly as before (same error and text); only previously-rejected valid cases now pass.
Tests
Added matching and binary-fallback table tests, and updated the existing multipart encoding test.