Skip to content

openapi: querystring parameters are stamped with a style the spec forbids #334

Description

@OmarAlJarrah

What happens

compilers/openapi/internal/operation/params.go:326 defaultParamStyle puts
soa.ParameterInQueryString in the same arm as query and cookie, so a 3.2
in: querystring parameter comes out of the compiler carrying
style: "form" and explode: true:

- name: querystringWhole
  in: querystring
  content:
    application/x-www-form-urlencoded:
      schema: {type: object}
{'param': 'querystringWhole', 'location': 'querystring', 'style': 'form',
 'explode': True, 'contentType': 'application/x-www-form-urlencoded'}

Why it is wrong

style is not a legal keyword on this location. OpenAPI 3.2 binds the whole
query string from the parameter's content, and forbids both style and
schema there — the bundled parser refuses the declaration outright
(openapi/parameter.go: "parameter field style is not allowed for
in=querystring"). So the IR records a declared serialization fact that the
source cannot state and that no reader can have meant, and an emitter reading
style: form would serialize the parameter as a form-exploded field rather than
as the media type contentType already names.

The function's own doc comment describes the table as "query/cookie →
form/true, path/header → simple/false" and does not mention querystring, so the
third location in that arm reads as an oversight rather than a decision.

Expected

A querystring binding carries no style and no explode — the media type in
ContentType is the whole of its declared serialization.

Where it is pinned today

testdata/conformance/openapi/param-style-matrix.yaml exercises the location and
assertQuerystringParam in compilers/openapi/conformance_test.go pins the
current values with a comment citing this issue, so fixing it reddens that case
and the golden rather than passing unnoticed.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions