I was testing the upgrade to 20.4.1 and this version broke some of our forms. Previous versions up to 20.3 were working. I suspect this "fix" introduced new bugs: BUG:29909257 - ORDS: Support parameter names with hyphens.
<!-- myproc takes no parameters
name="log-on" or "log on" breaks ORDS
"logon" or "log_on" is ok -->
<form method=post action="/myproc">
<input type="submit" name="log-on" value="log on">
</form>
ORDS gave a misleading error message. I wasted time thinking it was an issue with security.inclusionList, security.requestValidationFunction, etc
isValidRequest(), procedure name: <myproc>
Procedure DENIED with Error code: 0
==== Request Processed ====
Stack Trace
InternalServerException [statusCode=500, logLevel=SEVERE, reasons=[]]
at oracle.dbtools.apex.ModApex.validateRequest(ModApex.java:429)
at oracle.dbtools.apex.ModApex.doPost(ModApex.java:192)
at oracle.dbtools.apex.ModApex.service(ModApex.java:121)
Our workaround was to remove the name from the submit control, since it wasn't required. Posting in case anyone else gets this misleading error message.