🐛 bug: avoid reading omitted request bodies in Bind.All

[gaby]

Motivation

• Fix a regression where Bind.All eagerly inspected Request().Body() before honoring a struct's binding_source precedence, which can force buffering of streamed request bodies and undermine StreamRequestBody streaming/DoS protections.

Description

• Remove the unconditional hasBody precomputation and defer calling Request().Body() until the body source is actually selected in the custom-precedence loop or the default precedence path.
• Preserve existing behavior when body is included in precedence (default or custom) so body-binding still occurs when intended.
• Add a regression test Test_Bind_All_CustomPrecedence_DoesNotReadOmittedBody that uses SetBodyStream and asserts a query-only binding_source:"query" does not consume the request body stream.
• Commit recorded as fix(bind): avoid reading omitted request bodies and PR metadata created with the same summary title.

Testing

• Ran make generate, make betteralign, make format, and make lint, all of which completed successfully (lint reported 0 issues).
• Ran make test, which completed successfully: the test suite reported PASS for all tests (4191 tests, 1 skipped) and the new regression test passed.
• Ran make audit; go mod verify and go vet completed, but govulncheck in the execution environment reported pre-existing standard-library vulnerabilities (Go 1.25.1), causing make audit to exit non-zero; this is an environmental/toolchain issue and not caused by these code changes.

---

Codex Task

[coderabbitai]

Walkthrough

Bind.All now gates body binding inline on both body data and Content-Type for custom and default precedence. A regression test confirms query-only binding does not consume a provided request body stream.

Changes

Body binder precedence guard

Layer / File(s)	Summary
Precedence gating and regression coverage bind.go, bind_test.go	Custom and default precedence paths include b.Body only when body data and Content-Type are present; query-only custom precedence is tested to leave the body stream unconsumed.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• gofiber/fiber#3373: Updates Bind.All precedence and body-first binding behavior.
• gofiber/fiber#3659: Adds related body-presence and unconsumed-body handling.
• gofiber/fiber#4544: Modifies custom precedence body inclusion and related tests.

Suggested labels: 🧹 Updates

Suggested reviewers: renewerner87

Poem

I’m a rabbit guarding the stream,
Query hops ahead of the dream.
No body gets read
When it’s not in the spread—
Bindings now flow clean and serene.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: avoiding reads of omitted request bodies in Bind.All.
Description check	✅ Passed	The description covers motivation, change details, and testing, but it does not follow the full template or include Fixes # and checklist items.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-bind.all-body-handling-issue

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain main module or its selected dependencies"

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.24%. Comparing base (6955385) to head (1441155).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4565      +/-   ##
==========================================
- Coverage   93.29%   93.24%   -0.06%     
==========================================
  Files         140      140              
  Lines       14854    14853       -1     
==========================================
- Hits        13858    13849       -9     
- Misses        620      627       +7     
- Partials      376      377       +1     

Flag	Coverage Δ
unittests	93.24% <100.00%> (-0.06%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

bind_test.go (1)

3044-3063: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Add coverage for the no-Content-Type and default-precedence paths.

This test only exercises custom query precedence with Content-Type present, so it cannot catch the new condition reading a streamed body before checking the header or regressions in the default branch.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@bind_test.go` around lines 3044 - 3063, Extend
Test_Bind_All_CustomPrecedence_DoesNotReadOmittedBody with coverage for a
streamed request that has no Content-Type, verifying query-only binding still
uses the query value without consuming the body. Add a separate assertion for
the default-precedence binding path to confirm omitted-body sources are not read
and existing precedence behavior remains intact.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@bind.go`:
- Around line 527-528: In both custom-precedence and default-precedence
body-binding branches, reorder the conditions so ContentType() is checked before
Request().Body(). Update the checks at bind.go lines 527-528 and 543-544;
preserve the existing body-binding behavior after the content type is confirmed.

---

Nitpick comments:
In `@bind_test.go`:
- Around line 3044-3063: Extend
Test_Bind_All_CustomPrecedence_DoesNotReadOmittedBody with coverage for a
streamed request that has no Content-Type, verifying query-only binding still
uses the query value without consuming the body. Add a separate assertion for
the default-precedence binding path to confirm omitted-body sources are not read
and existing precedence behavior remains intact.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8436ac3c-8460-43de-a73a-4adf58e26b1b

📥 Commits

Reviewing files that changed from the base of the PR and between 6955385 and 13a4a32.

📒 Files selected for processing (2)

• bind.go
• bind_test.go