openapi_first 4.0.1 → 4.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dc1e6456e7c11e5079255b24e6407f61d9e94677fe07bef54000c26fe1174e05
-  data.tar.gz: 313d87080b433ca45defd7a47a811f6f2a91b93804a6655b9121b86d95c2e2f7
+  metadata.gz: ac70785f7221fecd32d0a1408c8c12ee14ea75f5d45be6c9c1efce38e735d02e
+  data.tar.gz: 0cea3e400f9eed814fc9924c551893d78444920d99f7573d59426a7fa7a61068
 SHA512:
-  metadata.gz: 6a04433e95586c8cc5ad34f791e1a2fc598584be5e23c7e7518c5eb9bd04d77c96fb3b1fe9330a16e4a9060b119b835e42863a11a1abb77c8f5b2cbba246fdcc
-  data.tar.gz: bb8a46ea7aaf083819cac30ede78fe6f560f339f2d8282d727e111b3e504dab42aa0a7b82d1372bd060a5217818f694cadad11f71085e15baed7a10c48f5578e
+  metadata.gz: 9c8883be1aad4a502ac4596ecb91765b855e2d515ec3e6ad11519a350ed43f29ae591645b71f7f7da709775cd1322c9dd4803f1474032bf5e8004abfd4b0eb51
+  data.tar.gz: 21e78cbcc5607436c1a32e108f786b0ddfc7ad434d2d103cee6f506eb90bef74d6dfcc4977ce748b612aeeab0c9e50c3a372c77da66a291275ead799bf677226

data/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 ## Unreleased
 
+## 4.1.0
+
+- Query and cookie parameter values with invalid encoding (like `?search=%C3`) produce a 400 response now. Before such a value passed validation or raised an `ArgumentError`. This applies to documented and undocumented query parameter, but only to documented cookie parameters.
+- A query string with more parameters than Rack accepts (4096 by default) produces a 400 response now instead of raising `Rack::QueryParser::QueryLimitError`. See the [rack documentation](https://rack.github.io/rack/main/index.html#configuration) about how to configure this.
+
 ## 4.0.1
 
 - Fix: Reduced memory usage with large API descriptions. Schemas no longer each deep-copy (stringify keys) the whole OAD to build a root schema. This is a json_schemer specific optimization.

data/lib/openapi_first/builder.rb

@@ -126,10 +126,10 @@ module OpenapiFirst
       cookie = build_parameters(grouped[:cookie])
       ParsedParameters.new(
         all: [*path, *query, *header, *cookie].freeze,
-        path_parser: grouped[:path] && ParametersParser.new(path),
+        path_parser: grouped[:path] && ParametersParser.new(path, check_encoding: false),
         query_parser: QueryStringParser.new(query),
-        header_parser: grouped[:header] && ParametersParser.new(header),
-        cookie_parser: grouped[:cookie] && ParametersParser.new(cookie),
+        header_parser: grouped[:header] && ParametersParser.new(header, check_encoding: false),
+        cookie_parser: grouped[:cookie] && ParametersParser.new(cookie, check_encoding: true),
         path_schema: build_parameter_schema(grouped[:path]),
         query_schema: build_parameter_schema(grouped[:query]),
         header_schema: build_parameter_schema(grouped[:header]),

data/lib/openapi_first/parameters_parser.rb

@@ -5,8 +5,10 @@ module OpenapiFirst
   # @visibility private
   class ParametersParser
     # @param parameters [Array<Parameter>]
-    def initialize(parameters)
+    # @param check_encoding [Boolean] Raise Rack::Utils::InvalidParameterError if a value has an invalid encoding.
+    def initialize(parameters, check_encoding:)
       @parameters = parameters
+      @check_encoding = check_encoding
     end
 
     attr_reader :parameters
@@ -16,8 +18,18 @@ module OpenapiFirst
       parameters.each_with_object({}) do |parameter, result|
         next unless parameters_hash.key?(parameter.name)
 
-        result[parameter.name] = parameter.unpack_and_convert(parameters_hash[parameter.name])
+        value = parameters_hash[parameter.name]
+        check_encoding!(value) if @check_encoding
+        result[parameter.name] = parameter.unpack_and_convert(value)
       end
     end
+
+    private
+
+    def check_encoding!(value)
+      return if !value.is_a?(::String) || value.valid_encoding?
+
+      raise Rack::Utils::InvalidParameterError, "invalid encoding (#{value.inspect})"
+    end
   end
 end

data/lib/openapi_first/query_string_parser.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'rack'
+require 'rack/query_parser'
 require_relative 'parameters_parser'
 
 module OpenapiFirst
@@ -10,11 +11,15 @@ module OpenapiFirst
     DEEP_PROP = '\[([\w-]+)\]$'
     private_constant :DEEP_PROP
 
+    # Rack < 3.1 does not know about Rack::BadRequest
+    BAD_REQUEST = defined?(Rack::BadRequest) ? Rack::BadRequest : Rack::QueryParser::QueryLimitError
+    private_constant :BAD_REQUEST
+
     # @param parameters [Array<Parameter>]
     def initialize(parameters)
       @parameters = parameters
       @deep_object_parameters, flat_parameters = parameters.partition(&:deep_object?)
-      @flat_parser = ParametersParser.new(flat_parameters)
+      @flat_parser = ParametersParser.new(flat_parameters, check_encoding: false)
       @deep_object_properties = {}
       @deep_object_regex = {}
       @deep_object_parameters.each do |parameter|
@@ -54,16 +59,23 @@ module OpenapiFirst
       return if unknown.empty?
 
       unknown
+    rescue Rack::Utils::InvalidParameterError
+      nil
     end
 
     private
 
     def parse_query(query_string)
       Rack::Utils.parse_query(query_string) do |string|
-        Rack::Utils.unescape(string)
+        unescaped = Rack::Utils.unescape(string)
+        next unescaped if unescaped.valid_encoding?
+
+        raise Rack::Utils::InvalidParameterError, "invalid encoding (#{string})"
       rescue ArgumentError => e
         raise Rack::Utils::InvalidParameterError, e.message
       end
+    rescue BAD_REQUEST => e
+      raise Rack::Utils::InvalidParameterError, e.message
     end
 
     def parse_deep_object(parameter, parsed_query)

data/lib/openapi_first/request.rb

@@ -61,6 +61,9 @@ module OpenapiFirst
       query, query_error = parse_query(request.env[Rack::QUERY_STRING])
       return [nil, query_error] if query_error
 
+      cookies = parse_cookies(request.env[Rack::HTTP_COOKIE])
+      return [nil, cookies] if cookies.is_a?(Failure)
+
       body = @body_parsers&.call(request)
       return [nil, body] if body.is_a?(Failure)
 
@@ -68,7 +71,7 @@ module OpenapiFirst
         path: @path_parser&.unpack(route_params),
         query:,
         headers: @header_parser&.unpack(RequestHeaders.new(request.env)),
-        cookies: @cookie_parser&.unpack(Rack::Utils.parse_cookies_header(request.env[Rack::HTTP_COOKIE])),
+        cookies:,
         body:
       ), nil]
     end
@@ -79,6 +82,12 @@ module OpenapiFirst
       [nil, Failure.new(:invalid_query, message: 'Invalid query parameter.')]
     end
 
+    def parse_cookies(cookie_header)
+      @cookie_parser&.unpack(Rack::Utils.parse_cookies_header(cookie_header))
+    rescue Rack::Utils::InvalidParameterError
+      Failure.new(:invalid_cookie, message: 'Invalid cookie value.')
+    end
+
     def build_body_parser(content_type, encoding)
       RequestBodyParsers[content_type, { encoding: encoding || {} }]
     end

data/lib/openapi_first/response_parser.rb

@@ -40,7 +40,7 @@ module OpenapiFirst
     def build_headers_parser(headers)
       return unless headers&.any?
 
-      ParametersParser.new(headers.map(&:parameter))
+      ParametersParser.new(headers.map(&:parameter), check_encoding: false)
     end
   end
 end

data/lib/openapi_first/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module OpenapiFirst
-  VERSION = '4.0.1'
+  VERSION = '4.1.0'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: openapi_first
 version: !ruby/object:Gem::Version
-  version: 4.0.1
+  version: 4.1.0
 platform: ruby
 authors:
 - Andreas Haller