openapi_first 4.0.0 → 4.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 47dffdd527985dd188f08ea57ff1104f3e51203746175cf4a964c757af8ebd6e
-  data.tar.gz: c67d1e706d644caadd9397bfdb2eef046317e2c4ac86bfd8e261b60ad7136bf7
+  metadata.gz: ac70785f7221fecd32d0a1408c8c12ee14ea75f5d45be6c9c1efce38e735d02e
+  data.tar.gz: 0cea3e400f9eed814fc9924c551893d78444920d99f7573d59426a7fa7a61068
 SHA512:
-  metadata.gz: e5e16ce4c6c4756517e9bff345eb7182937b239be36a038444680f61b169790aef3c5d10c3c1d8b2be0e3332b72784a3722ba3ea99de0e7712f4c1e48284c0ec
-  data.tar.gz: fa631d3327bbcf640645d2b762d00ac8baa4bf5c87276c9c00cc280e58d1985a419a64ccd4b8521f411f9d5f47442ae9efc31f0bf959b5a8d4f24fb8205de7a7
+  metadata.gz: 9c8883be1aad4a502ac4596ecb91765b855e2d515ec3e6ad11519a350ed43f29ae591645b71f7f7da709775cd1322c9dd4803f1474032bf5e8004abfd4b0eb51
+  data.tar.gz: 21e78cbcc5607436c1a32e108f786b0ddfc7ad434d2d103cee6f506eb90bef74d6dfcc4977ce748b612aeeab0c9e50c3a372c77da66a291275ead799bf677226

data/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## Unreleased
 
+## 4.1.0
+
+- Query and cookie parameter values with invalid encoding (like `?search=%C3`) produce a 400 response now. Before such a value passed validation or raised an `ArgumentError`. This applies to documented and undocumented query parameter, but only to documented cookie parameters.
+- A query string with more parameters than Rack accepts (4096 by default) produces a 400 response now instead of raising `Rack::QueryParser::QueryLimitError`. See the [rack documentation](https://rack.github.io/rack/main/index.html#configuration) about how to configure this.
+
+## 4.0.1
+
+- Fix: Reduced memory usage with large API descriptions. Schemas no longer each deep-copy (stringify keys) the whole OAD to build a root schema. This is a json_schemer specific optimization.
+
 ## 4.0.0
 
 This release has no stricter or less strict request validation. It changes mostly internal stuff and adds a Sinatra integration. It's a major version, but it should be safe to upgrade.

data/lib/openapi_first/builder.rb

@@ -126,10 +126,10 @@ module OpenapiFirst
       cookie = build_parameters(grouped[:cookie])
       ParsedParameters.new(
         all: [*path, *query, *header, *cookie].freeze,
-        path_parser: grouped[:path] && ParametersParser.new(path),
+        path_parser: grouped[:path] && ParametersParser.new(path, check_encoding: false),
         query_parser: QueryStringParser.new(query),
-        header_parser: grouped[:header] && ParametersParser.new(header),
-        cookie_parser: grouped[:cookie] && ParametersParser.new(cookie),
+        header_parser: grouped[:header] && ParametersParser.new(header, check_encoding: false),
+        cookie_parser: grouped[:cookie] && ParametersParser.new(cookie, check_encoding: true),
         path_schema: build_parameter_schema(grouped[:path]),
         query_schema: build_parameter_schema(grouped[:query]),
         header_schema: build_parameter_schema(grouped[:header]),

data/lib/openapi_first/file_loader.rb

@@ -26,12 +26,20 @@ module OpenapiFirst
           if extname == '.json'
             ::JSON.parse(body)
           elsif ['.yaml', '.yml'].include?(extname)
-            YAML.unsafe_load(body)
+            load_yaml(body, file_path)
           else
             body
           end
         end
       end
     end
+
+    private
+
+    def load_yaml(body, file_path)
+      Utils.deep_stringify_keys(YAML.unsafe_load(body))
+    rescue ::JSON::GeneratorError => e
+      raise Error, "Could not load #{file_path.inspect}: #{e.message}"
+    end
   end
 end

data/lib/openapi_first/parameters_parser.rb

@@ -5,8 +5,10 @@ module OpenapiFirst
   # @visibility private
   class ParametersParser
     # @param parameters [Array<Parameter>]
-    def initialize(parameters)
+    # @param check_encoding [Boolean] Raise Rack::Utils::InvalidParameterError if a value has an invalid encoding.
+    def initialize(parameters, check_encoding:)
       @parameters = parameters
+      @check_encoding = check_encoding
     end
 
     attr_reader :parameters
@@ -16,8 +18,18 @@ module OpenapiFirst
       parameters.each_with_object({}) do |parameter, result|
         next unless parameters_hash.key?(parameter.name)
 
-        result[parameter.name] = parameter.unpack_and_convert(parameters_hash[parameter.name])
+        value = parameters_hash[parameter.name]
+        check_encoding!(value) if @check_encoding
+        result[parameter.name] = parameter.unpack_and_convert(value)
       end
     end
+
+    private
+
+    def check_encoding!(value)
+      return if !value.is_a?(::String) || value.valid_encoding?
+
+      raise Rack::Utils::InvalidParameterError, "invalid encoding (#{value.inspect})"
+    end
   end
 end

data/lib/openapi_first/query_string_parser.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'rack'
+require 'rack/query_parser'
 require_relative 'parameters_parser'
 
 module OpenapiFirst
@@ -10,11 +11,15 @@ module OpenapiFirst
     DEEP_PROP = '\[([\w-]+)\]$'
     private_constant :DEEP_PROP
 
+    # Rack < 3.1 does not know about Rack::BadRequest
+    BAD_REQUEST = defined?(Rack::BadRequest) ? Rack::BadRequest : Rack::QueryParser::QueryLimitError
+    private_constant :BAD_REQUEST
+
     # @param parameters [Array<Parameter>]
     def initialize(parameters)
       @parameters = parameters
       @deep_object_parameters, flat_parameters = parameters.partition(&:deep_object?)
-      @flat_parser = ParametersParser.new(flat_parameters)
+      @flat_parser = ParametersParser.new(flat_parameters, check_encoding: false)
       @deep_object_properties = {}
       @deep_object_regex = {}
       @deep_object_parameters.each do |parameter|
@@ -54,16 +59,23 @@ module OpenapiFirst
       return if unknown.empty?
 
       unknown
+    rescue Rack::Utils::InvalidParameterError
+      nil
     end
 
     private
 
     def parse_query(query_string)
       Rack::Utils.parse_query(query_string) do |string|
-        Rack::Utils.unescape(string)
+        unescaped = Rack::Utils.unescape(string)
+        next unescaped if unescaped.valid_encoding?
+
+        raise Rack::Utils::InvalidParameterError, "invalid encoding (#{string})"
       rescue ArgumentError => e
         raise Rack::Utils::InvalidParameterError, e.message
       end
+    rescue BAD_REQUEST => e
+      raise Rack::Utils::InvalidParameterError, e.message
     end
 
     def parse_deep_object(parameter, parsed_query)

data/lib/openapi_first/ref_resolver.rb

@@ -184,6 +184,17 @@ module OpenapiFirst
         vocabulary: { 'https://json-schema.org/draft/2020-12/vocab/core' => true }
       )
 
+      # This class is here to monkey-patch JSONSchemer::Schema when we are passing
+      # an instance to sub-schemas. It skips stringifying all keys of the passed object to
+      # allocate fewer objects. We don't have to stringify the keys, because they are already stringified upstream.
+      # @visibility private
+      class DocumentRootSchema < JSONSchemer::Schema
+        private
+
+        def deep_stringify_keys(value) = value
+      end
+      private_constant :DocumentRootSchema
+
       def initialize(value:, context:, base_uri:, options:)
         @value = value
         @context = context
@@ -197,7 +208,7 @@ module OpenapiFirst
 
       def schema
         @schema ||= begin
-          root_schema = JSONSchemer::Schema.new(context, base_uri:, **options, meta_schema: DOCUMENT_META_SCHEMA)
+          root_schema = DocumentRootSchema.new(context, base_uri:, **options, meta_schema: DOCUMENT_META_SCHEMA)
           apply_dialect(root_schema)
           JSONSchemer::Schema.new(value, nil, root_schema, base_uri:, **options)
         end

data/lib/openapi_first/request.rb

@@ -61,6 +61,9 @@ module OpenapiFirst
       query, query_error = parse_query(request.env[Rack::QUERY_STRING])
       return [nil, query_error] if query_error
 
+      cookies = parse_cookies(request.env[Rack::HTTP_COOKIE])
+      return [nil, cookies] if cookies.is_a?(Failure)
+
       body = @body_parsers&.call(request)
       return [nil, body] if body.is_a?(Failure)
 
@@ -68,7 +71,7 @@ module OpenapiFirst
         path: @path_parser&.unpack(route_params),
         query:,
         headers: @header_parser&.unpack(RequestHeaders.new(request.env)),
-        cookies: @cookie_parser&.unpack(Rack::Utils.parse_cookies_header(request.env[Rack::HTTP_COOKIE])),
+        cookies:,
         body:
       ), nil]
     end
@@ -79,6 +82,12 @@ module OpenapiFirst
       [nil, Failure.new(:invalid_query, message: 'Invalid query parameter.')]
     end
 
+    def parse_cookies(cookie_header)
+      @cookie_parser&.unpack(Rack::Utils.parse_cookies_header(cookie_header))
+    rescue Rack::Utils::InvalidParameterError
+      Failure.new(:invalid_cookie, message: 'Invalid cookie value.')
+    end
+
     def build_body_parser(content_type, encoding)
       RequestBodyParsers[content_type, { encoding: encoding || {} }]
     end

data/lib/openapi_first/response_parser.rb

@@ -40,7 +40,7 @@ module OpenapiFirst
     def build_headers_parser(headers)
       return unless headers&.any?
 
-      ParametersParser.new(headers.map(&:parameter))
+      ParametersParser.new(headers.map(&:parameter), check_encoding: false)
     end
   end
 end

data/lib/openapi_first/utils.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+module OpenapiFirst
+  # @visibility private
+  module Utils
+    module_function
+
+    def deep_stringify_keys(contents) = ::JSON.parse(::JSON.generate(contents))
+  end
+end

data/lib/openapi_first/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module OpenapiFirst
-  VERSION = '4.0.0'
+  VERSION = '4.1.0'
 end

data/lib/openapi_first.rb

@@ -4,6 +4,7 @@ require_relative 'openapi_first/json'
 require_relative 'openapi_first/file_loader'
 require_relative 'openapi_first/errors'
 require_relative 'openapi_first/registry'
+require_relative 'openapi_first/utils'
 require_relative 'openapi_first/configuration'
 require_relative 'openapi_first/child_configuration'
 require_relative 'openapi_first/definition'
@@ -82,7 +83,7 @@ module OpenapiFirst
   # @return [Definition]
   # TODO: This needs to work with unresolved contents as well
   def self.parse(contents, only: nil, filepath: nil, path_prefix: nil, &)
-    contents = ::JSON.parse(::JSON.generate(contents)) # Deeply stringify keys, because of YAML. See https://github.com/ahx/openapi_first/issues/367
+    contents = Utils.deep_stringify_keys(contents) # Deeply stringify keys, because of YAML. See https://github.com/ahx/openapi_first/issues/367
     contents['paths'].filter!(&->(key, _) { only.call(key) }) if only
     Definition.new(contents, filepath, path_prefix, &)
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: openapi_first
 version: !ruby/object:Gem::Version
-  version: 4.0.0
+  version: 4.1.0
 platform: ruby
 authors:
 - Andreas Haller
@@ -154,6 +154,7 @@ files:
 - lib/openapi_first/test/observe.rb
 - lib/openapi_first/test/observer_middleware.rb
 - lib/openapi_first/test/plain_helpers.rb
+- lib/openapi_first/utils.rb
 - lib/openapi_first/validated_request.rb
 - lib/openapi_first/validated_response.rb
 - lib/openapi_first/validators/multipart_request_body.rb