Affects: \6.0.11

When working with this API definition

@GetMapping(path = "{param1}/foo/{param2}/bar", produces = APPLICATION_XML_VALUE)
@Operation(summary = "Gets Foo for provided Bar")
@ApiResponse(responseCode = "200", content = @Content(mediaType = APPLICATION_XML_VALUE, schema = @Schema(implementation = FooListResponse.class)))
FooListResponse getFooList(
        @PathVariable("param1") final String param1,
        @PathVariable("param2") final String param2,
        @RequestParam(value = "param3", required = false) final Integer param3,
        @RequestParam(value = "param4", required = false) final FooScope param4,
        @RequestParam(value = "param5", required = false) final Boolean param5
);

and this implementation of the api

@Override
public FooListResponse getFooList(
        final String param1,
        final String param2,
        @Nullable final Integer param3,
        @Nullable final FooScope param4,
        @Nullable final Boolean param5
) { .....
}

I get correct input validation for param3 values like "abc" or "69a", I get a 400-bad request with the reason for it. But using special characters as values like "%" or "?" I get a null value for param3 in the implementation and not a bad request response.

Isolated this would be not a big issue but combined with the optional nature of the param3 I cannot distinguish between when param3 is not set on purpose of not set because of wrong input validation.

Comment From: rstoyanchev

The Servlet request parameter has a null value. For example:

@GetMapping("/foo")
void getFooList(HttpServletRequest request) {
    String param3 = request.getParameter("param3");
    System.out.println("param3='" + param3 + "'");
}

Sending param3=% results in:

param3='null'

In other words this comes from the Servlet container that probably sanitizes the URL.