Skip to content

Fix: validate body contents for empty operation input across protocols(issue 3723)#4522

Open
lee-1104 wants to merge 2 commits intosmithy-lang:mainfrom
lee-1104:fix-issue-3723
Open

Fix: validate body contents for empty operation input across protocols(issue 3723)#4522
lee-1104 wants to merge 2 commits intosmithy-lang:mainfrom
lee-1104:fix-issue-3723

Conversation

@lee-1104
Copy link

@lee-1104 lee-1104 commented Feb 8, 2026

Hi, this is my first contribution to smithy-rs. Happy to address any feedback!

Motivation and Context

fixes #3723

When an operation has empty or no modeled input, the server was not validating the request body contents. This allowed malformed requests to be silently accepted.

Description

Added body validation in ServerHttpBoundProtocolGenerator for operations with empty or no input:

  • JSON protocols (RestJson, AwsJson): accepts empty body or {}
  • CBOR (RpcV2Cbor): accepts empty body or empty CBOR map (0xA0)
  • XML (RestXml): accepts only empty body
  • Removed AdditionalTokensEmptyStruct from the failing test list since it now passes.

Testing

  • cargo test additional_tokens_empty_struct passes in rpcv2Cbor_extras
  • ./gradlew codegen-server-test:assemble completes successfully

Checklist

  • For changes to the smithy-rs codegen or runtime crates, I have created a changelog entry Markdown file in the .changelog directory, specifying "client," "server," or both in the applies_to key.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

@lee-1104 lee-1104 requested review from a team as code owners February 8, 2026 16:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Servers incorrectly accept any request body when the modeled operation input is empty or non-existent

3 participants