Dear Jan, Thanks for the observation. I am pretty sure this relates to a known issue that has been fixed just yesterday [1]. We will provide a snapshot with a bug fix beginning of next week, and the next minor release will be made available later in January. Best, Christian [1] https://github.com/BaseXdb/basex/issues/2356 Jan Meijer <jmeijer@importalis.com> schrieb am Do., 9. Jan. 2025, 14:35:

In BaseX v11.6 an error occurs when passing a value via "%rest:form-param" in combination with a security function.

The example below consists of two RESTXQ functions "p:post" and "p:form". After submitting the form with a value for input "resource-id" the following error occurs in function "p:post":

Stopped at /usr/local/basex/webapp/ui/problem.xqm, 16/10: [basex:restxq] Value of "resource-id" must be xs:string, supplied: ().

Example module problem.xqm:

module namespace p = 'problem';

declare %perm:check('/p', '{$perm}') function p:check( $perm as map(*) ) as element(rest:response)? { };

declare %rest:path('/p/post') %rest:POST %rest:form-param("resource-id", "{$resource-id}") %output:method('html') %output:version('5.0') function p:post( $resource-id as xs:string ) { <div> <p>$resource-id={$resource-id}</p> </div> };

declare %rest:path('/p/form') %rest:GET %output:method('html') %output:version('5.0') function p:form() { <div> <form method="post" action="/p/post"> <input type="text" name="resource-id" id="resource-id" required="required"/><br/> <button type="submit">Ok</button> </form> </div> };

The described behavior is caused by the security function "p:check".

1. If you remove the security function "p:check" it works fine. 2. If you replace `%rest:form-param` with `%rest:query-param` it also works fine, but that doesn't seem right to me.

Is this a bug or do I something wrong?

Kind regards, Jan Meijer