OpenAPITools / OpenAPITools/openapi-generator

[BUG] [Kotlin] [kotlin-spring] Multipart file upload fails with 500 error when file contains CDATA lines starting with double hyphens (--), before controller is reached

Open
#21,803 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Issue: Bug
Dominant language
Java
Stars
26.8k
Forks
7.7k
PR metrics pending

Description

Bug Report Checklist
  • Have you provided a full/minimal spec to reproduce the issue?
  • Have you validated the input using an OpenAPI validator?
  • Have you tested with the latest master to confirm the issue still exists?
  • Have you searched for related issues/PRs?
  • What's the actual output vs expected output?
  • [Optional] Sponsorship to speed up the bug fix or feature request (example)
Description

When attempting to upload files using a multipart/form-data POST endpoint generated via OpenAPI Generator (kotlin-spring, Spring Boot 2.7.5), the server responds with a 500 Internal Server Error before the controller is reached if the uploaded file contains a CDATA section with a line starting with double hyphens (--).
This appears to be a multipart parsing issue: the parser misinterprets such lines as multipart boundaries, causing the request to break.
This issue blocks uploads for files such as JasperReports .jrxml files, which are XML and may contain such CDATA sections.

Error observed:

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
misconfiguration and was unable to complete
your request.</p>
<p>Please contact the server administrator at 
 root@localhost to inform them of the time this error occurred,
 and the actions you performed just before this error.</p>
<p>More information about this error may be available
in the server error log.</p>
</body></html>
openapi-generator version

7.15.0

OpenAPI declaration file content or url
paths:
  /sample/upload-endpoint:
    post:
      summary: Upload new file at sample endpoint
      operationId: uploadSampleFile
      parameters:
        - name: Authorization
          in: header
          required: true
          schema:
            type: string
        - name: example_parameter
          in: path
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          multipart/form-data:
            schema:
              type: object
              properties:
                file:
                  type: string
                  format: binary
                name:
                  type: string
                path:
                  type: string
      responses:
        "200":
          description: Upload new file at sample endpoint
        "400":
          description: Bad request
        "404":
          description: Not found
      security:
        - basicAuth: []
Generation Details
  • Spring Boot version: 2.7.5
  • Kotlin version: 1.7.22
  • openapi-generator-maven-plugin: 7.15.0
  • Generator config:
    • generatorName: kotlin-spring
    • library: spring-boot
    • configOptions: delegatePattern=true, interfaceOnly=false, serializableModel=true, openApiNullable=false, enumPropertyNaming=UPPERCASE
  • Build tool: Gradle/Maven plugin, with additional dependencies for Spring Web, Security, Data JPA, etc.
Steps to reproduce
  1. Generate the Spring Boot Kotlin code from the provided OpenAPI spec.
  2. Start the application.
  3. Perform a multipart/form-data POST request to the endpoint with a file attachment (e.g. using a tool like cURL or Postman).
    • The file being uploaded is a JasperReport XML file, example content: 
      <![CDATA[
-- This line starts with double hyphens inside CDATA
]]>
  4. Observe that the response is a 500 Internal Server Error and the controller is not reached.
Actual output vs expected output

Actual Output:

  • 500 Internal Server Error (HTML response as shown above)
  • The error occurs before the controller, likely within multipart parsing (Tomcat/Spring).

Expected Output:

  • The controller should be invoked and handle the file upload normally, regardless of file content.
Attachments
  • Example problematic file: sample.jrxml (JasperReport XML with CDATA/double hyphens)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the generated kotlin-spring multipart upload controller entry point and reproduce the failure using the provided OpenAPI declaration and sample.jrxml content. Trace multipart parsing before controller invocation; done means the controller is reached and the file uploads normally when its CDATA contains lines beginning with double hyphens.

Written by the indexing model from the issue text.

Assessment

Tech stack
kotlin, spring-boot
Domain
api, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.