granttrace 2.4.0__tar.gz → 2.4.1__tar.gz

{granttrace-2.4.0 → granttrace-2.4.1}/CHANGELOG.md

@@ -1,5 +1,50 @@
 # Changelog
 
+## 2.4.1 - 2026-10-03
+
+### Added
+
+- Add `granttrace demo` with packaged OpenAPI, configuration and fictional mock
+  data, so an installed wheel can demonstrate identity comparison, BOLA / IDOR,
+  Mass Assignment, independent readback and rollback verification outside a Git
+  checkout without user credentials or external API access.
+- Start the disposable mock on a dynamic loopback port, close it on completion
+  or failure, and retain HTML / JSON reports in a unique output directory.
+- Add `--output-dir` and optional `--read-only` controls for the built-in demo.
+
+### Changed
+
+- Put the single-command installed-package demo before the source-checkout
+  walkthrough and retain configuration onboarding and safety boundaries. During
+  release preparation, distinguish the upcoming package from the published stable
+  version and do not claim an unpublished PyPI release is available.
+- Give missing spec/config files and offline configuration failures a concise
+  next step; an empty write allowlist still sends no PATCH requests.
+- Promote the 2.4.1.dev0 development package to 2.4.1 consistently across runtime,
+  package metadata and generated reports; update the release acceptance checklist.
+
+### Quality
+
+- Resolve the existing 20 mypy errors in six files using accurate annotations and
+  type narrowing, without new suppression directives or weaker mypy settings.
+- Make mypy a blocking CI check and add a minimum 80% branch-aware coverage gate.
+- Add weekly Dependabot checks for pip dependencies and GitHub Actions, without
+  automatic merging; exclude the release workflow from dependency updates.
+- Verify installed demo resources, source-independent startup, both demo modes,
+  complete database restoration and local server shutdown.
+
+### Security / Safety
+
+- The demo accepts no external target or user credentials. Its active PATCH checks
+  run only against bundled, disposable data on a dynamic `127.0.0.1` server.
+- Keep auditing users' own APIs read-only by default; `granttrace demo --read-only`
+  sends no PATCH requests.
+- Preserve the BOLA / IDOR and Mass Assignment detection criteria, explicit write
+  allowlists, independent GET readback, original-state snapshots and rollback
+  verification. Failed recovery still blocks subsequent writes.
+- Keep the existing `granttrace --spec ...` CLI, TLS / HTTP / redirect / proxy
+  safety boundaries and evidence minimisation unchanged.
+
 ## 2.4.0 - 2026-10-03
 
 ### Added

{granttrace-2.4.0 → granttrace-2.4.1}/CONTRIBUTING.md

@@ -28,7 +28,7 @@ python -m coverage xml
 python -m coverage json
 ```
 
-Mypy is advisory while existing dynamic JSON type issues are tracked:
+Mypy is a blocking CI check and must report zero errors; coverage must be at least 80%:
 
 ```bash
 python -m mypy

{granttrace-2.4.0 → granttrace-2.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: granttrace
-Version: 2.4.0
+Version: 2.4.1
 Summary: Safety-first OpenAPI authorization auditing tool for BOLA, IDOR and Mass Assignment testing
 Author: GrantTrace contributors
 License-Expression: Apache-2.0
@@ -32,6 +32,7 @@ Dynamic: license-file
 ![License](https://img.shields.io/badge/license-Apache--2.0-green)
 
 **Stable:** [v2.4.0](https://github.com/ysc070528/granttrace/releases/tag/v2.4.0)
+**Release prep:** v2.4.1 (not yet released)
 
 An OpenAPI authorization auditor that compares identities, verifies persisted changes, and reports restoration evidence.
 
@@ -49,30 +50,23 @@ An OpenAPI authorization auditor that compares identities, verifies persisted ch
 
 ## 五分钟体验
 
-需要 Python 3.9+。在终端中克隆、安装并启动本机演示服务：
+需要 Python 3.9+。**v2.4.1 正在准备发布，尚未发布到 PyPI**；当前稳定版 v2.4.0 暂不支持 `demo`。v2.4.1 正式发布到 PyPI 后，首次体验只需：
 
 ```bash
-git clone https://github.com/ysc070528/granttrace.git
-cd granttrace
-python -m pip install -e .
-python mock_server/server.py
+pip install granttrace
+granttrace demo
 ```
 
-另开终端，进入同一目录执行首次只读扫描：
+审查当前发布准备分支时，先安装本轮构建的 wheel，再运行同一条 demo 命令：
 
 ```bash
-granttrace --spec openapi.json --target http://127.0.0.1:8080 --config config.example.json --export-json result.local.json
+python -m pip install dist/granttrace-2.4.1-py3-none-any.whl
+granttrace demo
 ```
 
-用浏览器打开默认生成的 **`granttrace_report.html`**：先查看发现与修复建议，再按状态筛选端点、展开证据。预期结果为 **1 个 CONFIRMED、1 个 PUBLIC、1 个 SECURE、2 个 SKIPPED**，确定性覆盖率 **60%**。两个 PATCH 因默认只读而跳过。JSON 结果写入 `result.local.json`；两个本地产物均由 `.gitignore` 忽略。
-
-在这个可丢弃的本地靶场体验写测试和恢复核验：
-
-```bash
-granttrace --spec openapi.json --target http://127.0.0.1:8080 --config config.example.json --allow-write-tests --export-json result.local.json
-```
+安装后可在任意目录运行，无需 clone、准备配置、另开终端或访问外部 API。Demo 自动启动动态端口的 `127.0.0.1` 靶场，比较身份访问、演示 BOLA / IDOR 与 Mass Assignment，并通过独立读回与恢复核验展示 PATCH 测试证据。**主动写操作仅发生在内置、可丢弃的本机靶场**；demo 不接受外部 target 或用户凭据，结束时关闭靶场。
 
-再次打开 **`granttrace_report.html`**。预期 **2 个 CONFIRMED、1 个 PUBLIC、2 个 SECURE**，确定性覆盖率 **100%**，批量赋值发现的 `rollback_verified` 为 `true`。本次扫描更新同名 HTML / JSON 文件；这些结果只属于内置五个演示端点。
+HTML / JSON 报告保留在当前目录的 `granttrace-demo/` 唯一子目录，终端会输出绝对路径，不覆盖已有报告。可选用 `granttrace demo --output-dir PATH` 指定报告父目录，或 `granttrace demo --read-only` 仅体验只读身份访问。
 
 完整离线示例：[HTML 报告](examples/sample_report.html)（下载后用浏览器打开）与 [JSON 结果](examples/sample_result.json)。
 
@@ -91,7 +85,34 @@ granttrace --spec your-openapi.yaml --config config.local.json --validate-config
 granttrace --spec your-openapi.yaml --config config.local.json --dry-run --export-json plan.local.json
 ```
 
-账户、API Key / Cookie、合法共享和管理员访问配置见 [配置指南](docs/configuration.md)。支持的数组、布尔值及 `style` / `explode` 编码见 [参数规则](docs/parameter-serialization.md)。接入实测前请核对 [安全边界](SECURITY.md)。
+接入自己的 API 时仍默认只读，主动 PATCH 测试必须显式开启并满足 allowlist、独立 readback 和恢复条件。账户、API Key / Cookie、合法共享和管理员访问配置见 [配置指南](docs/configuration.md)。支持的数组、布尔值及 `style` / `explode` 编码见 [参数规则](docs/parameter-serialization.md)。接入实测前请核对 [安全边界](SECURITY.md)。
+
+## 从源码开发 / 运行仓库 mock
+
+需要查看源码或手工运行仓库靶场时：
+
+```bash
+git clone https://github.com/ysc070528/granttrace.git
+cd granttrace
+python -m pip install -e .
+python mock_server/server.py
+```
+
+另开终端，进入同一目录执行首次只读扫描：
+
+```bash
+granttrace --spec openapi.json --target http://127.0.0.1:8080 --config config.example.json --export-json result.local.json
+```
+
+用浏览器打开默认生成的 **`granttrace_report.html`**：先查看发现与修复建议，再按状态筛选端点、展开证据。预期结果为 **1 个 CONFIRMED、1 个 PUBLIC、1 个 SECURE、2 个 SKIPPED**，确定性覆盖率 **60%**。两个 PATCH 因默认只读而跳过。JSON 结果写入 `result.local.json`；两个本地产物均由 `.gitignore` 忽略。
+
+在这个可丢弃的本地靶场体验写测试和恢复核验：
+
+```bash
+granttrace --spec openapi.json --target http://127.0.0.1:8080 --config config.example.json --allow-write-tests --export-json result.local.json
+```
+
+再次打开 **`granttrace_report.html`**。预期 **2 个 CONFIRMED、1 个 PUBLIC、2 个 SECURE**，确定性覆盖率 **100%**，批量赋值发现的 `rollback_verified` 为 `true`。本次扫描更新同名 HTML / JSON 文件；这些结果只属于内置五个演示端点。
 
 ## 验证与边界
 

{granttrace-2.4.0 → granttrace-2.4.1}/README.md

@@ -5,6 +5,7 @@
 ![License](https://img.shields.io/badge/license-Apache--2.0-green)
 
 **Stable:** [v2.4.0](https://github.com/ysc070528/granttrace/releases/tag/v2.4.0)
+**Release prep:** v2.4.1 (not yet released)
 
 An OpenAPI authorization auditor that compares identities, verifies persisted changes, and reports restoration evidence.
 
@@ -22,30 +23,23 @@ An OpenAPI authorization auditor that compares identities, verifies persisted ch
 
 ## 五分钟体验
 
-需要 Python 3.9+。在终端中克隆、安装并启动本机演示服务：
+需要 Python 3.9+。**v2.4.1 正在准备发布，尚未发布到 PyPI**；当前稳定版 v2.4.0 暂不支持 `demo`。v2.4.1 正式发布到 PyPI 后，首次体验只需：
 
 ```bash
-git clone https://github.com/ysc070528/granttrace.git
-cd granttrace
-python -m pip install -e .
-python mock_server/server.py
+pip install granttrace
+granttrace demo
 ```
 
-另开终端，进入同一目录执行首次只读扫描：
+审查当前发布准备分支时，先安装本轮构建的 wheel，再运行同一条 demo 命令：
 
 ```bash
-granttrace --spec openapi.json --target http://127.0.0.1:8080 --config config.example.json --export-json result.local.json
+python -m pip install dist/granttrace-2.4.1-py3-none-any.whl
+granttrace demo
 ```
 
-用浏览器打开默认生成的 **`granttrace_report.html`**：先查看发现与修复建议，再按状态筛选端点、展开证据。预期结果为 **1 个 CONFIRMED、1 个 PUBLIC、1 个 SECURE、2 个 SKIPPED**，确定性覆盖率 **60%**。两个 PATCH 因默认只读而跳过。JSON 结果写入 `result.local.json`；两个本地产物均由 `.gitignore` 忽略。
-
-在这个可丢弃的本地靶场体验写测试和恢复核验：
-
-```bash
-granttrace --spec openapi.json --target http://127.0.0.1:8080 --config config.example.json --allow-write-tests --export-json result.local.json
-```
+安装后可在任意目录运行，无需 clone、准备配置、另开终端或访问外部 API。Demo 自动启动动态端口的 `127.0.0.1` 靶场，比较身份访问、演示 BOLA / IDOR 与 Mass Assignment，并通过独立读回与恢复核验展示 PATCH 测试证据。**主动写操作仅发生在内置、可丢弃的本机靶场**；demo 不接受外部 target 或用户凭据，结束时关闭靶场。
 
-再次打开 **`granttrace_report.html`**。预期 **2 个 CONFIRMED、1 个 PUBLIC、2 个 SECURE**，确定性覆盖率 **100%**，批量赋值发现的 `rollback_verified` 为 `true`。本次扫描更新同名 HTML / JSON 文件；这些结果只属于内置五个演示端点。
+HTML / JSON 报告保留在当前目录的 `granttrace-demo/` 唯一子目录，终端会输出绝对路径，不覆盖已有报告。可选用 `granttrace demo --output-dir PATH` 指定报告父目录，或 `granttrace demo --read-only` 仅体验只读身份访问。
 
 完整离线示例：[HTML 报告](examples/sample_report.html)（下载后用浏览器打开）与 [JSON 结果](examples/sample_result.json)。
 
@@ -64,7 +58,34 @@ granttrace --spec your-openapi.yaml --config config.local.json --validate-config
 granttrace --spec your-openapi.yaml --config config.local.json --dry-run --export-json plan.local.json
 ```
 
-账户、API Key / Cookie、合法共享和管理员访问配置见 [配置指南](docs/configuration.md)。支持的数组、布尔值及 `style` / `explode` 编码见 [参数规则](docs/parameter-serialization.md)。接入实测前请核对 [安全边界](SECURITY.md)。
+接入自己的 API 时仍默认只读，主动 PATCH 测试必须显式开启并满足 allowlist、独立 readback 和恢复条件。账户、API Key / Cookie、合法共享和管理员访问配置见 [配置指南](docs/configuration.md)。支持的数组、布尔值及 `style` / `explode` 编码见 [参数规则](docs/parameter-serialization.md)。接入实测前请核对 [安全边界](SECURITY.md)。
+
+## 从源码开发 / 运行仓库 mock
+
+需要查看源码或手工运行仓库靶场时：
+
+```bash
+git clone https://github.com/ysc070528/granttrace.git
+cd granttrace
+python -m pip install -e .
+python mock_server/server.py
+```
+
+另开终端，进入同一目录执行首次只读扫描：
+
+```bash
+granttrace --spec openapi.json --target http://127.0.0.1:8080 --config config.example.json --export-json result.local.json
+```
+
+用浏览器打开默认生成的 **`granttrace_report.html`**：先查看发现与修复建议，再按状态筛选端点、展开证据。预期结果为 **1 个 CONFIRMED、1 个 PUBLIC、1 个 SECURE、2 个 SKIPPED**，确定性覆盖率 **60%**。两个 PATCH 因默认只读而跳过。JSON 结果写入 `result.local.json`；两个本地产物均由 `.gitignore` 忽略。
+
+在这个可丢弃的本地靶场体验写测试和恢复核验：
+
+```bash
+granttrace --spec openapi.json --target http://127.0.0.1:8080 --config config.example.json --allow-write-tests --export-json result.local.json
+```
+
+再次打开 **`granttrace_report.html`**。预期 **2 个 CONFIRMED、1 个 PUBLIC、2 个 SECURE**，确定性覆盖率 **100%**，批量赋值发现的 `rollback_verified` 为 `true`。本次扫描更新同名 HTML / JSON 文件；这些结果只属于内置五个演示端点。
 
 ## 验证与边界
 

{granttrace-2.4.0 → granttrace-2.4.1}/VERIFICATION.md

@@ -1,5 +1,34 @@
 # GrantTrace 验收记录
 
+## 2026-10-03 2.4.1.dev0 内置 demo 验收
+
+本轮仅改善安装后的首次体验，稳定版仍为 v2.4.0，开发版本为
+2.4.1.dev0；本记录不表示开发版已发布。原检测语义、配置验证规则和
+PATCH allowlist / 独立读回 / 回滚限制保持不变，兼容入口保留。
+
+本地 Windows / Python 3.14.5 实际验证结果：
+
+- 完整 unittest 与 coverage 运行均为 **304 项通过**，0 失败、0 错误、
+  0 跳过，其中新增 27 项 demo 测试、9 项首次使用提示测试。
+- 总覆盖率 **80.85%**，语句 **83.78%**，分支 **75.17%**；分别高于
+  之前的 79.66% / 82.66% / 74.02%。
+- 业务场景、JSON / YAML 示例、真实 wheel 安装脚本全部通过；Ruff、
+  pip check 与严格 pip-audit 通过，未发现已知运行依赖漏洞。
+- mypy 仍为 **20 个问题 / 6 个文件**，新增 demo 未增加类型诊断；保持 advisory。
+- 全新虚拟环境在仓库外的空目录安装 wheel，未复制任何仓库文件，
+  `granttrace demo` 成功；环境代理被绕过，靶场只绑定动态 127.0.0.1 端口。
+- 完整 demo 为 **1 BOLA / IDOR + 1 Mass Assignment**；独立 GET 读回、
+  `rollback_verified`、整库恢复与服务器关闭均成功。只读 demo 未发送 PATCH。
+- HTML / JSON 报告保留在唯一 run 子目录，不覆盖旧文件；本地安装验收
+  证据另存于被忽略的 `dist/demo-validation/`。
+- 异常回归包含构造/启动/ready 失败、JSON 与报告错误、真实 PATCH 后
+  KeyboardInterrupt、读回失败后恢复、回滚证据缺失与整库残留；均可靠关闭
+  靶场，恢复失败或证据不足不会显示 demo 成功。
+
+Python 3.9 / 3.12 / 3.14 与 CodeQL 的远程结果以本轮 PR 的实际检查为准。
+本轮只创建 PR 供审查，不合并、不创建 tag、不发布 GitHub Release 或 PyPI。
+以下历史记录完整保留。
+
 ## 2026-10-03 v2.4.0 发布前验收
 
 本轮在已合并 PR #11 的最新 `main`（`4b65e54`）基础上创建

{granttrace-2.4.0 → granttrace-2.4.1}/api_sentinel.py

@@ -33,7 +33,8 @@ BANNER = rf"""
 
 def build_argument_parser() -> argparse.ArgumentParser:
     parser = argparse.ArgumentParser(
-        description="Safety-first OpenAPI authorization and mass-assignment auditor"
+        description="Safety-first OpenAPI authorization and mass-assignment auditor",
+        epilog="Built-in local demo: granttrace demo (no spec, config or credentials needed)",
     )
     parser.add_argument("--spec", "-s", default=None,
                         help="OpenAPI/Swagger JSON or YAML (default: openapi.json)")
@@ -128,10 +129,26 @@ def _reject_constant(val: str) -> None:
     raise ValueError(f"Non-standard JSON number not allowed: {val}")
 
 
+_MISSING_FILE_GUIDANCE = (
+    "For the built-in local demo, run 'granttrace demo'. "
+    "For your own API, select a local OpenAPI file and create a draft with "
+    "'granttrace --spec <openapi-file> --init-config config.local.json'."
+)
+
+
+def _print_config_next_steps() -> None:
+    print("[NEXT] Review identities, resource IDs in parameter_values, and independent GET readback mappings. "
+          "Access expectations must come from your API's business rules.", file=sys.stderr)
+    print("[NEXT] After editing, run --validate-config, then --dry-run with the same --spec and --config. "
+          "Both checks are offline.", file=sys.stderr)
+
+
 def _load_spec(path: str) -> Dict[str, Any]:
     """Use the scanner's local JSON/YAML loader for both preflight modes."""
     try:
         return OpenAPIParser(path).raw_spec
+    except FileNotFoundError as exc:
+        raise ValueError(f"Cannot load specification '{path}': {exc}. {_MISSING_FILE_GUIDANCE}") from exc
     except Exception as exc:
         raise ValueError(f"Cannot load specification '{path}': {exc}") from exc
 
@@ -147,9 +164,10 @@ def _reject_incomplete_draft(config: Any) -> None:
 
 def run_config_validation(config_path_str: str, spec_path: Optional[str] = None) -> int:
     config_file = Path(config_path_str)
-    safe_path_str = sanitize_log_text(config_path_str)
+    safe_path_str = sanitize_log_text(sanitize_text(config_path_str))
     if not config_file.is_file():
         print(f"[ERROR] Configuration file does not exist: {safe_path_str}", file=sys.stderr)
+        print("[NEXT] " + _MISSING_FILE_GUIDANCE, file=sys.stderr)
         return 2
     try:
         with config_file.open("r", encoding="utf-8") as handle:
@@ -202,6 +220,7 @@ def run_config_validation(config_path_str: str, spec_path: Optional[str] = None)
             print(f"[WARN] In addition, {result.summary.warnings_count} warning(s) observed:", file=sys.stderr)
             for warning in result.warnings:
                 print(warning.format(), file=sys.stderr)
+        _print_config_next_steps()
         return 2
 
     print(f"[OK] Configuration is valid: {safe_path_str}")
@@ -221,7 +240,7 @@ def _load_config(path: Optional[str]) -> Dict[str, Any]:
         return {}
     config_path = Path(path)
     if not config_path.is_file():
-        raise ValueError(f"configuration file does not exist: {path}")
+        raise ValueError(f"configuration file does not exist: {path}. {_MISSING_FILE_GUIDANCE}")
     try:
         with config_path.open("r", encoding="utf-8") as handle:
             config = json.load(handle, parse_constant=_reject_constant)
@@ -241,7 +260,11 @@ def _ensure_parent(path: str) -> None:
 
 
 def main(argv: Optional[Sequence[str]] = None) -> int:
-    args = build_argument_parser().parse_args(argv)
+    selected = list(sys.argv[1:] if argv is None else argv)
+    if selected and selected[0] == "demo":
+        from core.demo import demo_main
+        return demo_main(selected[1:])
+    args = build_argument_parser().parse_args(selected)
     print(BANNER)
     if args.init_config is not None:
         if args.config or args.validate_config or args.dry_run or args.allow_write_tests or args.write_endpoint:
@@ -309,6 +332,7 @@ def main(argv: Optional[Sequence[str]] = None) -> int:
             )
             for issue in val_result.errors:
                 print(issue.format(), file=sys.stderr)
+            _print_config_next_steps()
             return 2
 
     try:
@@ -317,6 +341,11 @@ def main(argv: Optional[Sequence[str]] = None) -> int:
         if not isinstance(write_allowlist, list):
             raise ValueError("write_allowlist must be a list")
 
+        if args.allow_write_tests and not write_allowlist:
+            print("[WARN] Write tests requested, but write_allowlist is empty; no PATCH requests will be sent. "
+                  "Review explicit PATCH entries and independent GET readbacks, then run --validate-config "
+                  "and --dry-run before scanning.", file=sys.stderr)
+
         auditor = APISentinelAuditor(
             spec_path=spec_path,
             target_base_url=args.target,

{granttrace-2.4.0 → granttrace-2.4.1}/core/__init__.py

@@ -1,4 +1,4 @@
 # -*- coding: utf-8 -*-
 """GrantTrace core package."""
 
-__version__ = "2.4.0"
+__version__ = "2.4.1"

{granttrace-2.4.0 → granttrace-2.4.1}/core/auditor.py

@@ -19,7 +19,7 @@ import urllib.error
 import urllib.parse
 import urllib.request
 from concurrent.futures import ThreadPoolExecutor, as_completed
-from typing import Any, Dict, Iterable, List, Optional, Tuple
+from typing import Any, Dict, Iterable, List, Optional, Tuple, Union
 
 from core import __version__
 from core.config_validator import ConfigValidator
@@ -102,7 +102,7 @@ class APISentinelAuditor:
             if not is_valid or method != "PATCH":
                 raise ValueError("write_allowlist entries must be 'PATCH /case-sensitive-path'")
             self.write_allowlist.add(canonical)
-        self._writes_halted_reason = None
+        self._writes_halted_reason: Optional[str] = None
 
         context = ssl._create_unverified_context() if insecure_ssl else ssl.create_default_context()
         self._opener = urllib.request.build_opener(
@@ -495,7 +495,7 @@ class APISentinelAuditor:
         if visitor_self is not None:
             request_results["visitor_self"] = visitor_self
         transport_errors = [f"{name}: {item.error}" for name, item in request_results.items() if item.error]
-        evidence = {
+        evidence: Dict[str, Any] = {
             "target_url": owner_url,
             "visitor_self_url": visitor_self_url if visitor_self is not None else None,
             **{name: self._safe_body(item) for name, item in request_results.items()},
@@ -621,7 +621,7 @@ class APISentinelAuditor:
                 if last:
                     cursor[part] = value
                     return
-                expected = [] if isinstance(next_part, int) else {}
+                expected: Union[List[object], Dict[str, object]] = [] if isinstance(next_part, int) else {}
                 if not isinstance(cursor.get(part), type(expected)):
                     cursor[part] = expected
                 cursor = cursor[part]
@@ -680,7 +680,8 @@ class APISentinelAuditor:
                         else {},
                     })
                     continue
-                payload = item.get("payload") if isinstance(item.get("payload"), dict) else item
+                configured_payload = item.get("payload")
+                payload = configured_payload if isinstance(configured_payload, dict) else item
                 for field_path, value in payload.items():
                     cases.append({
                         "field_path": str(field_path),
@@ -954,7 +955,7 @@ class APISentinelAuditor:
                     "recovery_sent": transaction["recovery_sent"],
                 })
                 if persisted:
-                    finding = {
+                    finding: Dict[str, Any] = {
                         "type": "Mass Assignment (independent readback confirmed)",
                         "cwe": "CWE-915", "severity": "Critical", "endpoint": operation_key,
                         "target_url": mutation_url,

{granttrace-2.4.0 → granttrace-2.4.1}/core/config_validator.py

@@ -977,7 +977,10 @@ class ConfigValidator:
                             expected="JSON object",
                             actual=safe_diagnostic_value(parameter.get("schema")),
                         ))
-                    if valid_name and location in ("path", "query"):
+                    if (
+                        valid_name and isinstance(name, str) and isinstance(location, str)
+                        and location in ("path", "query")
+                    ):
                         identity = (name, location)
                         if identity in identities:
                             issues.append(ConfigIssue(