Skip to content

Fix form/explode=false incorrectly splitting primitive string values on commas#119

Merged
mromaszewicz merged 3 commits intooapi-codegen:mainfrom
f-kanari:fix/explode-default-behaviour
Apr 8, 2026
Merged

Fix form/explode=false incorrectly splitting primitive string values on commas#119
mromaszewicz merged 3 commits intooapi-codegen:mainfrom
f-kanari:fix/explode-default-behaviour

Conversation

@f-kanari
Copy link
Copy Markdown
Contributor

@f-kanari f-kanari commented Apr 7, 2026

Summary

BindQueryParameterWithOptions and BindRawQueryParameter unconditionally split query parameter values on commas when explode=false, even for primitive (non-array, non-object) destination types. This causes
parameters like scope=openid,profile,email to fail with:

Invalid format for parameter scope: multiple values for single value parameter 'scope'

Per the OpenAPI specification, explode has no effect on primitive types — the serialization is identical regardless of the explode value:

Type explode=true explode=false
primitive id=5 id=5
array id=3&id=4&id=5 id=3,4,5
object role=admin&firstName=Alex role,admin,firstName,Alex

Comma splitting is only meaningful for array and object types.

Changes

  • bindparam.go: In both BindQueryParameterWithOptions and BindRawQueryParameter, check the destination type before splitting on commas. For primitive types (reflect.Kind is not Slice, Struct, or
    Map), bind the raw value directly without splitting.

How it was tested

  • Added regression tests for BindQueryParameter with form/explode=false binding a comma-containing string (required and optional variants)
  • Added regression tests for BindRawQueryParameter with form/explode=false binding a percent-encoded comma-containing string (required and optional variants)
  • All existing tests continue to pass

Related

This is similar in spirit to #115 / #114, which fixed the same class of bug in BindStyledParameterWithOptions for simple/form style parameters. This PR addresses the equivalent issue in the query parameter
binding functions.

@f-kanari f-kanari marked this pull request as ready for review April 7, 2026 03:01
@f-kanari f-kanari requested a review from a team as a code owner April 7, 2026 03:01
@mromaszewicz mromaszewicz added this to the 1.4.0 milestone Apr 8, 2026
mromaszewicz and others added 2 commits April 8, 2026 14:01
Resolve conflict in bindparam.go: keep the PR's primitive-type
early-return (skip comma splitting for non-array/object types) and
upstream's spaceDelimited/pipeDelimited style support.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The primitive-type early returns added for the explode=false fix
guarantee that only Slice, Struct, and Map kinds reach the
post-split switch. The default branches in both
BindQueryParameterWithOptions and BindRawQueryParameter are now
dead code — remove them.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@mromaszewicz mromaszewicz added the bug Something isn't working label Apr 8, 2026
@mromaszewicz mromaszewicz enabled auto-merge (squash) April 8, 2026 21:10
@mromaszewicz mromaszewicz merged commit 77570f9 into oapi-codegen:main Apr 8, 2026
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants