{"record":{"id":"f6bee01bed172157","repo":"crowdsecurity/crowdsec","slug":"unknown-body-decoder-q","errorCode":null,"errorMessage":"unknown body decoder %q","messagePattern":"unknown body decoder %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/appsec/api_validation/api_validation.go","lineNumber":185,"sourceCode":"\t}\n\n\treturn &RequestValidator{\n\t\tloaders:        make(map[string]*openapi3.Loader),\n\t\topenAPISchemas: make(map[string]SchemaData),\n\t\tlogger:         logger,\n\t}\n}\n\n// RegisterBodyDecoder registers a decoder for the given Content-Type so that\n// a loaded OpenAPI schema can declare and validate requests of that type.\n// decoderName must be one of the built-in identifiers: \"json\", \"urlencoded\",\n// \"multipart\", \"yaml\", \"csv\", \"plain\", \"file\". Note that this mutates\n// kin-openapi's process-global decoder registry — see the note on\n// NewRequestValidator.\nfunc (rv *RequestValidator) RegisterBodyDecoder(contentType, decoderName string) error {\n\tdecoder, ok := builtinBodyDecoders[decoderName]\n\tif !ok {\n\t\treturn fmt.Errorf(\"unknown body decoder %q\", decoderName)\n\t}\n\topenapi3filter.RegisterBodyDecoder(contentType, decoder)\n\trv.logger.Debugf(\"registered body decoder %q for content type %q\", decoderName, contentType)\n\treturn nil\n}\n\n// warnUnsupportedSecuritySchemes scans a schema's declared security schemes\n// once at load time and warns for types the WAF cannot enforce (oauth2,\n// openIdConnect). The warning is emitted here so operators learn about the\n// gap during schema load rather than via per-request log spam. Behavior at\n// request time depends on the OnUnsupportedSecurityScheme policy.\nfunc (rv *RequestValidator) warnUnsupportedSecuritySchemes(ref string, doc *openapi3.T, policy Policy) {\n\tif doc.Components == nil {\n\t\treturn\n\t}\n\taction := \"will fail validation\"\n\tif policy == PolicyIgnore {\n\t\taction = \"will be ignored (not validated)\"","sourceCodeStart":167,"sourceCodeEnd":203,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/api_validation/api_validation.go#L167-L203","documentation":"RegisterBodyDecoder maps a content type to a named body decoder in kin-openapi's process-global registry. It first looks the decoder name up in builtinBodyDecoders; if the name is not a registered builtin, it returns this error instead of registering anything.","triggerScenarios":"Calling RequestValidator.RegisterBodyDecoder(contentType, decoderName) (directly or via RegisterAPISchemaBodyDecoder) with a decoderName that has no entry in builtinBodyDecoders, at pkg/appsec/api_validation/api_validation.go:185.","commonSituations":"Typo in a config value like 'jsonn' or 'xml' when one isn't built in; passing a content type string where a decoder name is expected; docs referencing a decoder that was removed.","solutions":["Use one of the builtin decoder names (e.g. \"multipart\", \"yaml\", \"csv\", \"plain\", \"file\" — see the builtinBodyDecoders map).","Check the decoder name in the config/schema against the supported list for typos.","If a custom decoder is needed, add it to builtinBodyDecoders or register it directly via openapi3filter.RegisterBodyDecoder."],"exampleFix":"// before\nrv.RegisterBodyDecoder(\"application/x-www-form-urlencoded\", \"urlencoded\")\n// after\nrv.RegisterBodyDecoder(\"application/x-www-form-urlencoded\", \"plain\")","handlingStrategy":"validation","validationCode":"decoders := []string{\"multipart\", \"yaml\", \"csv\", \"plain\", \"file\"}; if !slices.Contains(decoders, decoderName) { return fmt.Errorf(\"decoder %q is not builtin\", decoderName) }","typeGuard":null,"tryCatchPattern":"if err := rv.RegisterBodyDecoder(ct, name); err != nil { if strings.Contains(err.Error(), \"unknown body decoder\") { return fmt.Errorf(\"unsupported decoder %s for %s\", name, ct) } return err }","preventionTips":["Reference decoder names from the builtinBodyDecoders map, not memory","Distinguish content types from decoder names","Add a config-level allowlist of valid decoder names"],"tags":["appsec","openapi","body-decoder","registration"],"backgroundTag":"invalid-enum-value","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}