[v2.0] Add support for multipart/form-data

[James Navin]

Add support for multipart form data requests

[Greg Zealley]

Hi, is this something that is being considered?

Thanks, Greg

[Mikhail Kadan]

It worked in 1.5.1 but was dropped in 2.x for some reason

[Viktar Patotski]

just tried validating multipart/form-data request using 2.4.1 version and looks like validation is not working at all:

• additional not allowed parameter not rejected
• passing field value wich is not a part of “enum“ configured for field also passes validation.

[Gediminas Rimša]

This feature was added in 1.3.8 under this issue: https://bitbucket.org/atlassian/swagger-request-validator/issues/62 with PR https://bitbucket.org/atlassian/swagger-request-validator/pull-requests/70/issue-62-multipart-requests-support/diff

But then it was NOT included in 2.0 with an upgrade note “Multi-part formdata validation is currently not supported. This will be re-added in an upcoming release.”

Currently, we’re at 2.8.3 and this is issue has the highest vote count of all open issues. Is it still on the roadmap?

[James Navin]

Hi Gediminas,

You are correct that v1.0 did support multipart form data validation. It has not (yet) been added to v2.0 because the support for multi-part data changed significantly in the OpenAPI v3 spec. I have not had time to implement validation for it yet.

If it is important to you you are more than welcome to raise a PR to add the functionality - I will happily review and assist where I can.

It is on the roadmap, its just that the amount of time I can allocate to this project is not large and has recently been spent addressing bugs and upgrading dependencies etc.

Cheers,

James

[Willem Salembier]

If this feature is added back, it would be nice if it were optimized for big payloads too. Multipart is most of the times used to send (large) binaries along structured meta-data in JSON or plain text.

If I understand correctly, all the Body implementations (StringBody, InputStreamBody and ByteArrayBody) are now converted to a String object. The requestBody string is parsed in com.atlassian.oai.validator.util.HttpParsingUtils to separate the parts (e.g. using the boundaries). This means an in-memory copy of the payload for each validation.

Typically there are no constraints on form params of type binary (except for required flag perhaps) and the REST frameworks already parsed the incoming request into multiple part objects. So a more efficient implementation would be to have a MultiPartBody implementation of Body that reflects that. The MultiPartBody could contains a list of part objects, that link to the framework specific part object. Only when the validator needs to check a constraint on a specific part, it could call a getInputStream() on that part object only, leaving the other binary parts untouched.