Skip to content

fix(bind): skip empty scalar header values - #3223

Merged
vishr merged 2 commits into
masterfrom
fix/bind-empty-header-values
Nov 12, 2026
Merged

vishr merged 2 commits into
masterfrom
fix/bind-empty-header-values

Conversation

@vishr

@vishr vishr commented Nov 12, 2026

Copy link
Copy Markdown
Member

Summary

Fixes #3169.

BindHeaders indexes nil or zero-length header value slices when binding scalar map values or tagged struct fields. Treat entries with no values as absent for those destinations, while preserving slice-map values and custom multi-value unmarshalling.

- nil / []string{} -> values[0] -> panic
+ nil / []string{} -> skip scalar binding
  []string{""}     -> bind empty string

Related: #3170, #3171, #3175, and #3178. This version preserves map[string][]string entries and passes empty values to custom UnmarshalParams implementations. It also avoids allocating ordinary pointer fields for absent values.

Evidence

  • Before: TestBindHeadersEmptyValues panics on nil and empty slices for tagged structs, map[string]string, and map[string]any.
    After: existing scalar values remain unchanged, one empty string still binds, slice-map values survive, ordinary pointer fields stay nil, and custom multi-value unmarshalling is still called.
  • Independent branch: GOTOOLCHAIN=go1.27.4 go test -race ./..., go vet ./..., golint -set_exit_status ./..., and current staticcheck pass.

Merge Danger

Door: two-way

Blast Radius: binding

The shared binder skips scalar entries with no values. The reported header state requires in-process construction or mutation; this PR does not claim a remotely exploitable denial of service.

@vishr
vishr merged commit 6bb25f2 into master Nov 12, 2026
11 checks passed
@vishr
vishr deleted the fix/bind-empty-header-values branch November 12, 2026 05:54
vishr added a commit that referenced this pull request Nov 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

BindHeaders panics on nil or empty header value slices

1 participant