openapi_first 4.0.1 → 4.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dc1e6456e7c11e5079255b24e6407f61d9e94677fe07bef54000c26fe1174e05
-  data.tar.gz: 313d87080b433ca45defd7a47a811f6f2a91b93804a6655b9121b86d95c2e2f7
+  metadata.gz: 70cf5324252fd4c36421cb732127b220e45c3eefbafba7ed63ee513aea2d5b84
+  data.tar.gz: 43358cb067c765b59920160f589eb929216a9721b806a4a37b24ab039f536599
 SHA512:
-  metadata.gz: 6a04433e95586c8cc5ad34f791e1a2fc598584be5e23c7e7518c5eb9bd04d77c96fb3b1fe9330a16e4a9060b119b835e42863a11a1abb77c8f5b2cbba246fdcc
-  data.tar.gz: bb8a46ea7aaf083819cac30ede78fe6f560f339f2d8282d727e111b3e504dab42aa0a7b82d1372bd060a5217818f694cadad11f71085e15baed7a10c48f5578e
+  metadata.gz: d1b97b74dcdf98616c0f51c3e6a2c53cedb3685518f9697491eadca4110d39f12f68c54769535e6d171bf401d8d47085279124d70534fb5959c47cdf3b4d4eda
+  data.tar.gz: a27158cbd2760fa99de1f26193ce5450f5d2ef409c4a780da94ab102c24439dd1d149d6824a99cc8287617cd999cccc9de4989a33edaaaad2debfd7045a3892e

data/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## Unreleased
 
+## 4.2.0
+
+- Added `config.regexp_resolver` configuration option, `'ruby'` (default) or `'ecma'` (also as Symbol). The value is passed to json_schemer's `regexp_resolver` configuration. In OpenAPI, the pattern keyword specifies a regular expression that must conform to the ECMA-262 standard. So using `'ecma'` is recommended.
+
+## 4.1.0
+
+- Query and cookie parameter values with invalid encoding (like `?search=%C3`) produce a 400 response now. Before such a value passed validation or raised an `ArgumentError`. This applies to documented and undocumented query parameter, but only to documented cookie parameters.
+- A query string with more parameters than Rack accepts (4096 by default) produces a 400 response now instead of raising `Rack::QueryParser::QueryLimitError`. See the [rack documentation](https://rack.github.io/rack/main/index.html#configuration) about how to configure this.
+
 ## 4.0.1
 
 - Fix: Reduced memory usage with large API descriptions. Schemas no longer each deep-copy (stringify keys) the whole OAD to build a root schema. This is a json_schemer specific optimization.

data/lib/openapi_first/builder.rb

@@ -27,9 +27,9 @@ module OpenapiFirst
     end
 
     def initialize(contents, filepath:, config:)
+      @config = config
       meta_schema = detect_meta_schema(contents, filepath)
       @schemer_configuration = build_schemer_config(filepath:, meta_schema:)
-      @config = config
       @file_loader = FileLoader.new
       ref_resolver = RefResolver.new(file_loader:)
       @contents = ref_resolver.for(contents, filepath:)
@@ -47,6 +47,7 @@ module OpenapiFirst
       end
       result.meta_schema = meta_schema
       result.insert_property_defaults = true
+      result.regexp_resolver = config.regexp_resolver if config.regexp_resolver
       result
     end
 
@@ -126,10 +127,10 @@ module OpenapiFirst
       cookie = build_parameters(grouped[:cookie])
       ParsedParameters.new(
         all: [*path, *query, *header, *cookie].freeze,
-        path_parser: grouped[:path] && ParametersParser.new(path),
+        path_parser: grouped[:path] && ParametersParser.new(path, check_encoding: false),
         query_parser: QueryStringParser.new(query),
-        header_parser: grouped[:header] && ParametersParser.new(header),
-        cookie_parser: grouped[:cookie] && ParametersParser.new(cookie),
+        header_parser: grouped[:header] && ParametersParser.new(header, check_encoding: false),
+        cookie_parser: grouped[:cookie] && ParametersParser.new(cookie, check_encoding: true),
         path_schema: build_parameter_schema(grouped[:path]),
         query_schema: build_parameter_schema(grouped[:query]),
         header_schema: build_parameter_schema(grouped[:header]),

data/lib/openapi_first/child_configuration.rb

@@ -8,6 +8,7 @@ module OpenapiFirst
       @parent = parent
       @request_validation_error_response = parent.request_validation_error_response
       @path = parent.path
+      @regexp_resolver = parent.regexp_resolver
     end
 
     private attr_reader :parent

data/lib/openapi_first/configuration.rb

@@ -16,13 +16,14 @@ module OpenapiFirst
       @request_validation_error_response = OpenapiFirst.find_error_response(:default)
       @hooks = HOOKS.to_h { [_1, Set.new] }
       @path = nil
+      @regexp_resolver = nil
     end
 
     def register(path_or_definition, as: :default)
       OpenapiFirst.register(path_or_definition, as:)
     end
 
-    attr_reader :hooks, :request_validation_error_response
+    attr_reader :hooks, :request_validation_error_response, :regexp_resolver
     attr_accessor :path
 
     # Return a child configuration that still receives updates of global hooks.
@@ -49,6 +50,10 @@ module OpenapiFirst
       Plugins.load(name).configure(self, **)
     end
 
+    def regexp_resolver=(resolver)
+      @regexp_resolver = resolver.is_a?(Symbol) ? resolver.to_s : resolver
+    end
+
     def request_validation_error_response=(mod)
       @request_validation_error_response = if mod.is_a?(Symbol)
                                              OpenapiFirst.find_error_response(mod)

data/lib/openapi_first/parameters_parser.rb

@@ -5,8 +5,10 @@ module OpenapiFirst
   # @visibility private
   class ParametersParser
     # @param parameters [Array<Parameter>]
-    def initialize(parameters)
+    # @param check_encoding [Boolean] Raise Rack::Utils::InvalidParameterError if a value has an invalid encoding.
+    def initialize(parameters, check_encoding:)
       @parameters = parameters
+      @check_encoding = check_encoding
     end
 
     attr_reader :parameters
@@ -16,8 +18,18 @@ module OpenapiFirst
       parameters.each_with_object({}) do |parameter, result|
         next unless parameters_hash.key?(parameter.name)
 
-        result[parameter.name] = parameter.unpack_and_convert(parameters_hash[parameter.name])
+        value = parameters_hash[parameter.name]
+        check_encoding!(value) if @check_encoding
+        result[parameter.name] = parameter.unpack_and_convert(value)
       end
     end
+
+    private
+
+    def check_encoding!(value)
+      return if !value.is_a?(::String) || value.valid_encoding?
+
+      raise Rack::Utils::InvalidParameterError, "invalid encoding (#{value.inspect})"
+    end
   end
 end

data/lib/openapi_first/query_string_parser.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'rack'
+require 'rack/query_parser'
 require_relative 'parameters_parser'
 
 module OpenapiFirst
@@ -10,11 +11,15 @@ module OpenapiFirst
     DEEP_PROP = '\[([\w-]+)\]$'
     private_constant :DEEP_PROP
 
+    # Rack < 3.1 does not know about Rack::BadRequest
+    BAD_REQUEST = defined?(Rack::BadRequest) ? Rack::BadRequest : Rack::QueryParser::QueryLimitError
+    private_constant :BAD_REQUEST
+
     # @param parameters [Array<Parameter>]
     def initialize(parameters)
       @parameters = parameters
       @deep_object_parameters, flat_parameters = parameters.partition(&:deep_object?)
-      @flat_parser = ParametersParser.new(flat_parameters)
+      @flat_parser = ParametersParser.new(flat_parameters, check_encoding: false)
       @deep_object_properties = {}
       @deep_object_regex = {}
       @deep_object_parameters.each do |parameter|
@@ -54,16 +59,23 @@ module OpenapiFirst
       return if unknown.empty?
 
       unknown
+    rescue Rack::Utils::InvalidParameterError
+      nil
     end
 
     private
 
     def parse_query(query_string)
       Rack::Utils.parse_query(query_string) do |string|
-        Rack::Utils.unescape(string)
+        unescaped = Rack::Utils.unescape(string)
+        next unescaped if unescaped.valid_encoding?
+
+        raise Rack::Utils::InvalidParameterError, "invalid encoding (#{string})"
       rescue ArgumentError => e
         raise Rack::Utils::InvalidParameterError, e.message
       end
+    rescue BAD_REQUEST => e
+      raise Rack::Utils::InvalidParameterError, e.message
     end
 
     def parse_deep_object(parameter, parsed_query)

data/lib/openapi_first/request.rb

@@ -61,6 +61,9 @@ module OpenapiFirst
       query, query_error = parse_query(request.env[Rack::QUERY_STRING])
       return [nil, query_error] if query_error
 
+      cookies = parse_cookies(request.env[Rack::HTTP_COOKIE])
+      return [nil, cookies] if cookies.is_a?(Failure)
+
       body = @body_parsers&.call(request)
       return [nil, body] if body.is_a?(Failure)
 
@@ -68,7 +71,7 @@ module OpenapiFirst
         path: @path_parser&.unpack(route_params),
         query:,
         headers: @header_parser&.unpack(RequestHeaders.new(request.env)),
-        cookies: @cookie_parser&.unpack(Rack::Utils.parse_cookies_header(request.env[Rack::HTTP_COOKIE])),
+        cookies:,
         body:
       ), nil]
     end
@@ -79,6 +82,12 @@ module OpenapiFirst
       [nil, Failure.new(:invalid_query, message: 'Invalid query parameter.')]
     end
 
+    def parse_cookies(cookie_header)
+      @cookie_parser&.unpack(Rack::Utils.parse_cookies_header(cookie_header))
+    rescue Rack::Utils::InvalidParameterError
+      Failure.new(:invalid_cookie, message: 'Invalid cookie value.')
+    end
+
     def build_body_parser(content_type, encoding)
       RequestBodyParsers[content_type, { encoding: encoding || {} }]
     end

data/lib/openapi_first/response_parser.rb

@@ -40,7 +40,7 @@ module OpenapiFirst
     def build_headers_parser(headers)
       return unless headers&.any?
 
-      ParametersParser.new(headers.map(&:parameter))
+      ParametersParser.new(headers.map(&:parameter), check_encoding: false)
     end
   end
 end

data/lib/openapi_first/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module OpenapiFirst
-  VERSION = '4.0.1'
+  VERSION = '4.2.0'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: openapi_first
 version: !ruby/object:Gem::Version
-  version: 4.0.1
+  version: 4.2.0
 platform: ruby
 authors:
 - Andreas Haller