[Bug]:WebFlux strict request validation bypass without Content-Length #427

Summary

In strict request-validation mode, the WebFlux filter skipped synchronous request validation when the request did not include a Content-Length header.

This is a real HTTP case: chunked or streamed requests commonly omit Content-Length because the final body size is not known before sending the request.

Affected code

spring-boot-starter/spring-boot-starter-webflux/src/main/java/com/getyourguide/openapi/validation/filter/OpenApiValidationWebFilter.java

Before the fix, the filter skipped validation when either header was missing:

if (!trafficSelector.shouldFailOnRequestViolation(requestMetaData)
    || !request.getHeaders().containsHeader("Content-Type")
    || !request.getHeaders().containsHeader("Content-Length")) {
    return Mono.just(alreadyDidValidation);
}

Impact

An invalid JSON request with a valid Content-Type, but without Content-Length, could reach the controller instead of being rejected before controller execution.

Example OpenAPI rule:

{ "amount": "must be a positive number" }

Example invalid chunked request:

POST /payments HTTP/1.1
Content-Type: application/json
Transfer-Encoding: chunked

{ "amount": -999 }

Expected behavior in strict mode: return 400 Bad Request and do not call the controller.

Fix

Content-Length is not evidence that a request has a valid body; it only states whether its size was known in advance. The WebFlux request decorator can consume the reactive body stream without it.

The Content-Length condition was removed. Strict validation now runs when strict mode is enabled and Content-Type is present, regardless of whether the request is fixed-length or chunked.

if (!trafficSelector.shouldFailOnRequestViolation(requestMetaData)
    || !request.getHeaders().containsHeader("Content-Type")) {
    return Mono.just(alreadyDidValidation);
}

Regression coverage

Tests were added in:

spring-boot-starter/spring-boot-starter-webflux/src/test/java/com/getyourguide/openapi/validation/filter/OpenApiValidationWebFilterTest.java

They verify that, without Content-Length:

1. an invalid request fails synchronously before the controller is called;
2. a valid request is synchronously validated and continues to the controller;
3. a request without a body and without either header continues safely.

Run the focused tests with:

.\gradlew.bat :spring-boot-starter:spring-boot-starter-webflux:test --tests com.getyourguide.openapi.validation.filter.OpenApiValidationWebFilterTest --console=plain

The focused suite passed after the fix.

Terminal Screenshots

BuildRunBeforeChanges

BuildRunWithBugFix

TestRunWithBug

TestRunWithBugFix