openapi-spec-validator-rs 0.2.1__tar.gz → 0.2.2__tar.gz

{openapi_spec_validator_rs-0.2.1 → openapi_spec_validator_rs-0.2.2}/Cargo.lock

@@ -848,7 +848,7 @@ checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
 
 [[package]]
 name = "openapi-spec-validator-rs"
-version = "0.2.1"
+version = "0.2.2"
 dependencies = [
  "base64",
  "fancy-regex",
@@ -864,7 +864,7 @@ dependencies = [
 
 [[package]]
 name = "openapi-spec-validator-rs-cli"
-version = "0.2.1"
+version = "0.2.2"
 dependencies = [
  "clap",
  "insta",
@@ -875,7 +875,7 @@ dependencies = [
 
 [[package]]
 name = "openapi-spec-validator-rs-py"
-version = "0.2.1"
+version = "0.2.2"
 dependencies = [
  "clap",
  "mimalloc",

{openapi_spec_validator_rs-0.2.1 → openapi_spec_validator_rs-0.2.2}/Cargo.toml

@@ -3,7 +3,7 @@ resolver = "3"
 members = ["crates/*"]
 
 [workspace.package]
-version = "0.2.1"
+version = "0.2.2"
 edition = "2024"
 rust-version = "1.85"
 license = "Apache-2.0"
@@ -14,8 +14,8 @@ keywords = ["openapi", "swagger", "validation", "jsonschema"]
 categories = ["command-line-utilities", "development-tools", "web-programming"]
 
 [workspace.dependencies]
-openapi-spec-validator-rs = { path = "crates/openapi-spec-validator-rs", version = "0.2.1", default-features = false }
-openapi-spec-validator-rs-cli = { path = "crates/openapi-spec-validator-rs-cli", version = "0.2.1", default-features = false }
+openapi-spec-validator-rs = { path = "crates/openapi-spec-validator-rs", version = "0.2.2", default-features = false }
+openapi-spec-validator-rs-cli = { path = "crates/openapi-spec-validator-rs-cli", version = "0.2.2", default-features = false }
 
 anyhow = "1.0.104"
 base64 = "0.23.1"

{openapi_spec_validator_rs-0.2.1 → openapi_spec_validator_rs-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openapi-spec-validator-rs
-Version: 0.2.1
+Version: 0.2.2
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
 Classifier: Operating System :: OS Independent
@@ -113,14 +113,20 @@ The package mirrors openapi-spec-validator's API:
 ```python
 from openapi_spec_validator_rs import validate, validate_path, validate_url
 from openapi_spec_validator_rs import OpenAPIV31SpecValidator, OpenAPIValidationError
+from openapi_spec_validator_rs.readers import read_from_filename
 
 validate(spec_dict)                     # raises the first error
 validate_path("openapi.yaml")           # reads the file like the command line
 validate_url("https://example.com/openapi.json")
 
-errors = list(OpenAPIV31SpecValidator(spec_dict).iter_errors())
+spec_dict, base_uri = read_from_filename("openapi.yaml")
+errors = list(OpenAPIV31SpecValidator(spec_dict, base_uri=base_uri).iter_errors())
 ```
 
+`spec_dict` can be anything `json.load` or `yaml.safe_load` returns, dates and all: a
+`datetime.date` from an unquoted `2020-01-01` is treated as jsonschema treats it (of no
+type, shown as `datetime.date(2020, 1, 1)` in messages).
+
 Errors are `OpenAPIValidationError` (or one of its subclasses: `DuplicateOperationIDError`,
 `ParameterDuplicateError`, `UnresolvableParameterError`, `ExtraParametersError`) with the
 same attributes and messages as upstream's. Moving over is usually a matter of changing the
@@ -165,7 +171,7 @@ repos:
         name: openapi-spec-validator-rs
         entry: openapi-spec-validator-rs
         language: python
-        additional_dependencies: [openapi-spec-validator-rs==0.2.1]
+        additional_dependencies: [openapi-spec-validator-rs==0.2.2]
         files: .*(openapi|swagger).*\.(json|yaml|yml)$
 ```
 
@@ -204,8 +210,10 @@ The validator is a Rust library (`crates/openapi-spec-validator-rs`) with a CLI
 PyO3 bindings on top. It follows the reference implementation step by step:
 
 1. **Load**: JSON goes through serde_json when libyaml would read it the same way; anything
-   else goes through libyaml (the parser inside PyYAML) with PyYAML's YAML 1.1 rules, then
-   through the same JSON round trip.
+   else goes through libyaml (the parser inside PyYAML, as the [unsafe-libyaml] crate's
+   mechanical translation of its C code: archived upstream, which is also what keeps it
+   identical to the parser PyYAML bundles) with PyYAML's YAML 1.1 rules, then through
+   the same JSON round trip. Streams are read only as far as that parser would get.
 2. **Meta-schema**: the whole document is validated against the official schema for its
    version with the [`jsonschema`](https://crates.io/crates/jsonschema) crate.
 3. **Walk**: the document is walked like `keywords.py`, following `$ref`s (into other
@@ -233,4 +241,5 @@ and [NOTICE][notice].
 [compatibility]: https://github.com/Arjun-Aravind/openapi-spec-validator-rs/blob/main/COMPATIBILITY.md
 [license]: https://github.com/Arjun-Aravind/openapi-spec-validator-rs/blob/main/LICENSE
 [notice]: https://github.com/Arjun-Aravind/openapi-spec-validator-rs/blob/main/NOTICE
+[unsafe-libyaml]: https://crates.io/crates/unsafe-libyaml
 

{openapi_spec_validator_rs-0.2.1 → openapi_spec_validator_rs-0.2.2}/README.md

@@ -88,14 +88,20 @@ The package mirrors openapi-spec-validator's API:
 ```python
 from openapi_spec_validator_rs import validate, validate_path, validate_url
 from openapi_spec_validator_rs import OpenAPIV31SpecValidator, OpenAPIValidationError
+from openapi_spec_validator_rs.readers import read_from_filename
 
 validate(spec_dict)                     # raises the first error
 validate_path("openapi.yaml")           # reads the file like the command line
 validate_url("https://example.com/openapi.json")
 
-errors = list(OpenAPIV31SpecValidator(spec_dict).iter_errors())
+spec_dict, base_uri = read_from_filename("openapi.yaml")
+errors = list(OpenAPIV31SpecValidator(spec_dict, base_uri=base_uri).iter_errors())
 ```
 
+`spec_dict` can be anything `json.load` or `yaml.safe_load` returns, dates and all: a
+`datetime.date` from an unquoted `2020-01-01` is treated as jsonschema treats it (of no
+type, shown as `datetime.date(2020, 1, 1)` in messages).
+
 Errors are `OpenAPIValidationError` (or one of its subclasses: `DuplicateOperationIDError`,
 `ParameterDuplicateError`, `UnresolvableParameterError`, `ExtraParametersError`) with the
 same attributes and messages as upstream's. Moving over is usually a matter of changing the
@@ -140,7 +146,7 @@ repos:
         name: openapi-spec-validator-rs
         entry: openapi-spec-validator-rs
         language: python
-        additional_dependencies: [openapi-spec-validator-rs==0.2.1]
+        additional_dependencies: [openapi-spec-validator-rs==0.2.2]
         files: .*(openapi|swagger).*\.(json|yaml|yml)$
 ```
 
@@ -179,8 +185,10 @@ The validator is a Rust library (`crates/openapi-spec-validator-rs`) with a CLI
 PyO3 bindings on top. It follows the reference implementation step by step:
 
 1. **Load**: JSON goes through serde_json when libyaml would read it the same way; anything
-   else goes through libyaml (the parser inside PyYAML) with PyYAML's YAML 1.1 rules, then
-   through the same JSON round trip.
+   else goes through libyaml (the parser inside PyYAML, as the [unsafe-libyaml] crate's
+   mechanical translation of its C code: archived upstream, which is also what keeps it
+   identical to the parser PyYAML bundles) with PyYAML's YAML 1.1 rules, then through
+   the same JSON round trip. Streams are read only as far as that parser would get.
 2. **Meta-schema**: the whole document is validated against the official schema for its
    version with the [`jsonschema`](https://crates.io/crates/jsonschema) crate.
 3. **Walk**: the document is walked like `keywords.py`, following `$ref`s (into other
@@ -208,3 +216,4 @@ and [NOTICE][notice].
 [compatibility]: https://github.com/Arjun-Aravind/openapi-spec-validator-rs/blob/main/COMPATIBILITY.md
 [license]: https://github.com/Arjun-Aravind/openapi-spec-validator-rs/blob/main/LICENSE
 [notice]: https://github.com/Arjun-Aravind/openapi-spec-validator-rs/blob/main/NOTICE
+[unsafe-libyaml]: https://crates.io/crates/unsafe-libyaml

{openapi_spec_validator_rs-0.2.1 → openapi_spec_validator_rs-0.2.2}/crates/openapi-spec-validator-rs/README.md

@@ -88,14 +88,20 @@ The package mirrors openapi-spec-validator's API:
 ```python
 from openapi_spec_validator_rs import validate, validate_path, validate_url
 from openapi_spec_validator_rs import OpenAPIV31SpecValidator, OpenAPIValidationError
+from openapi_spec_validator_rs.readers import read_from_filename
 
 validate(spec_dict)                     # raises the first error
 validate_path("openapi.yaml")           # reads the file like the command line
 validate_url("https://example.com/openapi.json")
 
-errors = list(OpenAPIV31SpecValidator(spec_dict).iter_errors())
+spec_dict, base_uri = read_from_filename("openapi.yaml")
+errors = list(OpenAPIV31SpecValidator(spec_dict, base_uri=base_uri).iter_errors())
 ```
 
+`spec_dict` can be anything `json.load` or `yaml.safe_load` returns, dates and all: a
+`datetime.date` from an unquoted `2020-01-01` is treated as jsonschema treats it (of no
+type, shown as `datetime.date(2020, 1, 1)` in messages).
+
 Errors are `OpenAPIValidationError` (or one of its subclasses: `DuplicateOperationIDError`,
 `ParameterDuplicateError`, `UnresolvableParameterError`, `ExtraParametersError`) with the
 same attributes and messages as upstream's. Moving over is usually a matter of changing the
@@ -140,7 +146,7 @@ repos:
         name: openapi-spec-validator-rs
         entry: openapi-spec-validator-rs
         language: python
-        additional_dependencies: [openapi-spec-validator-rs==0.2.1]
+        additional_dependencies: [openapi-spec-validator-rs==0.2.2]
         files: .*(openapi|swagger).*\.(json|yaml|yml)$
 ```
 
@@ -179,8 +185,10 @@ The validator is a Rust library (`crates/openapi-spec-validator-rs`) with a CLI
 PyO3 bindings on top. It follows the reference implementation step by step:
 
 1. **Load**: JSON goes through serde_json when libyaml would read it the same way; anything
-   else goes through libyaml (the parser inside PyYAML) with PyYAML's YAML 1.1 rules, then
-   through the same JSON round trip.
+   else goes through libyaml (the parser inside PyYAML, as the [unsafe-libyaml] crate's
+   mechanical translation of its C code: archived upstream, which is also what keeps it
+   identical to the parser PyYAML bundles) with PyYAML's YAML 1.1 rules, then through
+   the same JSON round trip. Streams are read only as far as that parser would get.
 2. **Meta-schema**: the whole document is validated against the official schema for its
    version with the [`jsonschema`](https://crates.io/crates/jsonschema) crate.
 3. **Walk**: the document is walked like `keywords.py`, following `$ref`s (into other
@@ -208,3 +216,4 @@ and [NOTICE][notice].
 [compatibility]: https://github.com/Arjun-Aravind/openapi-spec-validator-rs/blob/main/COMPATIBILITY.md
 [license]: https://github.com/Arjun-Aravind/openapi-spec-validator-rs/blob/main/LICENSE
 [notice]: https://github.com/Arjun-Aravind/openapi-spec-validator-rs/blob/main/NOTICE
+[unsafe-libyaml]: https://crates.io/crates/unsafe-libyaml

{openapi_spec_validator_rs-0.2.1 → openapi_spec_validator_rs-0.2.2}/crates/openapi-spec-validator-rs/src/document.rs

@@ -19,6 +19,7 @@ use serde_json::Value;
 use url::Url;
 
 use crate::loader;
+use crate::pyobj;
 use crate::pyrepr;
 use crate::pyurl;
 use crate::retrieve::Retrieve;
@@ -227,7 +228,7 @@ impl<'a> Documents<'a> {
                 let path = url
                     .to_file_path()
                     .map_err(|()| format!("not a file path: {uri}"))?;
-                let bytes = std::fs::read(&path).map_err(|error| error.to_string())?;
+                let bytes = crate::read_file(&path).map_err(|error| error.to_string())?;
                 // Upstream reads files through `urlopen`, which is the stream name
                 // PyYAML reports.
                 loader::load(&bytes, "<urllib response>").map_err(|error| error.message)
@@ -345,7 +346,7 @@ impl<'a> Documents<'a> {
                 Value::Array(items) => position(segment, items.len())?
                     .map(|i| &items[i])
                     .ok_or_else(nowhere)?,
-                Value::Object(map) => {
+                Value::Object(map) if pyrepr::foreign(contents).is_none() => {
                     let key = segment.replace("~1", "/").replace("~0", "~");
                     map.get(&key).ok_or_else(nowhere)?
                 }
@@ -370,8 +371,8 @@ impl<'a> Documents<'a> {
 
     /// The child `key` of a mapping node, resolved (`path / key`).
     pub fn get<'d>(&'d self, node: Node<'d>, key: &str) -> Result<Option<Node<'d>>, Crash> {
-        match node.value {
-            Value::Object(map) => match map.get(key) {
+        match pyobj::as_dict(node.value) {
+            Some(map) => match map.get(key) {
                 Some(value) => self
                     .resolve(Node {
                         value,
@@ -410,7 +411,7 @@ impl<'a> Documents<'a> {
     ) -> Result<Vec<(Key<'d>, Node<'d>)>, Crash> {
         let doc = node.doc;
         match node.value {
-            Value::Object(map) => Ok(map
+            Value::Object(map) if pyrepr::foreign(node.value).is_none() => Ok(map
                 .iter()
                 .map(|(key, value)| (Key::Str(key), Node { value, doc }))
                 .collect()),
@@ -433,11 +434,12 @@ pub(crate) enum Key<'d> {
 
 /// `is_ref` from `jsonschema-path`: a mapping whose `$ref` is a string.
 pub(crate) fn as_ref(value: &Value) -> Option<&str> {
-    value.as_object()?.get("$ref")?.as_str()
+    pyobj::as_dict(value)?.get("$ref")?.as_str()
 }
 
 /// Python `int(s)` for base-10 literals (ASCII digits, sign, underscores, whitespace).
 fn python_int(s: &str) -> Option<i128> {
+    let s = pyobj::decimal_to_ascii(s)?;
     let s = s.trim();
     let (negative, digits) = match s.as_bytes().first()? {
         b'-' => (true, &s[1..]),
@@ -594,5 +596,10 @@ mod tests {
         assert_eq!(python_int("1_0"), Some(10));
         assert_eq!(python_int("1__0"), None);
         assert_eq!(python_int("x"), None);
+        // Python's `int()` reads every script's decimal digits and whitespace.
+        assert_eq!(python_int("\u{660}\u{661}"), Some(1));
+        assert_eq!(python_int("\u{3000}-\u{ff11}\u{ff12} "), Some(-12));
+        assert_eq!(python_int("\u{660}x"), None);
+        assert_eq!(python_int("\u{2160}"), None);
     }
 }

{openapi_spec_validator_rs-0.2.1 → openapi_spec_validator_rs-0.2.2}/crates/openapi-spec-validator-rs/src/formats.rs

@@ -682,7 +682,7 @@ fn py_int_base16(s: &str) -> Option<bool> {
 }
 
 /// Value of a Unicode decimal digit (`unicodedata.decimal`), Unicode 15.1.
-fn decimal_value(c: char) -> Option<u32> {
+pub(crate) fn decimal_value(c: char) -> Option<u32> {
     let cp = c as u32;
     let i = DECIMAL_ZEROS.partition_point(|&z| z <= cp);
     let zero = DECIMAL_ZEROS[..i].last()?;

{openapi_spec_validator_rs-0.2.1 → openapi_spec_validator_rs-0.2.2}/crates/openapi-spec-validator-rs/src/keywords.rs

@@ -347,7 +347,7 @@ impl<'d, 'a> Walker<'d, 'a> {
             let location = self.item(parameter, "in")?;
             // jsonschema-path hands out lists and mappings as `SchemaPath`s, which are
             // hashable and equal only to the same path: such a key is never a duplicate.
-            let container = |v: &Value| v.is_array() || v.is_object();
+            let container = |v: &Value| v.is_array() || pyobj::as_dict(v).is_some();
             if container(name) || container(location) {
                 continue;
             }
@@ -451,7 +451,7 @@ impl<'d, 'a> Walker<'d, 'a> {
     /// as a nested subschema never gets the `required` check.
     fn schema(&mut self, schema: Node<'d>, require_properties: bool, meta_checked: bool) -> Step {
         let value = schema.value;
-        if !value.is_object() && !value.is_boolean() {
+        if pyobj::as_dict(value).is_none() && !value.is_boolean() {
             return self.emit_new(
                 ErrorKind::OpenApiValidation,
                 format!("{} is not of type 'object', 'boolean'", repr(value)),
@@ -675,9 +675,7 @@ impl<'d, 'a> Walker<'d, 'a> {
 
 /// `"key" in path` on a resolved node.
 fn contains(node: Node<'_>, key: &str) -> bool {
-    node.value
-        .as_object()
-        .is_some_and(|map| map.contains_key(key))
+    pyobj::as_dict(node.value).is_some_and(|map| map.contains_key(key))
 }
 
 /// `list(set(required) - set(properties) - set(nested_properties))`.

{openapi_spec_validator_rs-0.2.1 → openapi_spec_validator_rs-0.2.2}/crates/openapi-spec-validator-rs/src/lib.rs

@@ -62,7 +62,7 @@ use crate::document::Documents;
 use crate::keywords::{Stop, Walker};
 
 pub use crate::error::{ErrorKind, Outcome, SchemaErrorDetails, ValidationError, best_match};
-pub use crate::loader::{LoadError, TextErrors, load, load_text};
+pub use crate::loader::{LoadError, TextErrors, load, load_text, read_until_unreadable};
 pub use crate::pyrepr::PathItem;
 #[cfg(feature = "http")]
 pub use crate::retrieve::HttpRetriever;
@@ -188,6 +188,18 @@ pub fn validate(spec: &Value, options: &Options) -> Outcome {
     }
 }
 
+/// Reads a document file as PyYAML reads the stream `urlopen` gives upstream: only as far
+/// as the parser could get (see [`read_until_unreadable`]).
+pub(crate) fn read_file(path: &Path) -> std::io::Result<Vec<u8>> {
+    let mut file = std::fs::File::open(path)?;
+    let mut bytes = Vec::new();
+    if let Ok(metadata) = file.metadata() {
+        bytes.reserve_exact(usize::try_from(metadata.len()).unwrap_or(0));
+    }
+    read_until_unreadable(&mut file, &mut bytes)?;
+    Ok(bytes)
+}
+
 /// Stack size for validation threads: enough for documents nested as deeply as the
 /// loader allows (pages are only committed as they are used).
 const STACK_SIZE: usize = 256 << 20;
@@ -291,7 +303,7 @@ fn read_and_validate(path: &Path, options: &Options) -> Result<Outcome, LoadErro
         return Err(not_found());
     }
     let absolute = std::path::absolute(path).map_err(|_| not_found())?;
-    let bytes = std::fs::read(&absolute).map_err(|error| LoadError {
+    let bytes = read_file(&absolute).map_err(|error| LoadError {
         message: error.to_string(),
     })?;
     // Upstream reads files through `urlopen`, which is the stream name PyYAML reports.

{openapi_spec_validator_rs-0.2.1 → openapi_spec_validator_rs-0.2.2}/crates/openapi-spec-validator-rs/src/loader/libyaml.rs

@@ -45,23 +45,26 @@ pub(super) enum Source<'a> {
 }
 
 pub(super) struct Parser<'a> {
-    // Boxed so the self-referential pointers libyaml keeps (read handler data, buffers) stay valid.
-    raw: Box<unsafe_yaml::yaml_parser_t>,
-    // Read through the raw pointer registered with libyaml; owned here so it outlives the parser.
-    feed: Option<Box<TextFeed<'a>>>,
+    // Heap-allocated and only ever touched through this raw pointer: libyaml's string reader
+    // keeps a pointer to the parser inside the parser itself (`read_handler_data`), which a
+    // `Box` or `&mut` reborrow would invalidate under Rust's aliasing rules. Freed in `drop`.
+    raw: *mut unsafe_yaml::yaml_parser_t,
+    // The read handler's data, registered with libyaml and read through that pointer only;
+    // owned here so it outlives the parser. Freed in `drop`.
+    feed: Option<*mut TextFeed<'a>>,
     stream_name: &'a str,
     _input: PhantomData<&'a [u8]>,
 }
 
 impl<'a> Parser<'a> {
     pub fn new(source: Source<'a>, stream_name: &'a str) -> Self {
-        let mut uninit = Box::<unsafe_yaml::yaml_parser_t>::new_uninit();
+        let raw = Box::into_raw(Box::<unsafe_yaml::yaml_parser_t>::new_uninit())
+            .cast::<unsafe_yaml::yaml_parser_t>();
         // SAFETY: `yaml_parser_initialize` zeroes the whole struct and allocates its buffers,
         // leaving it fully initialised. With Rust's allocator it only fails by aborting.
-        let mut raw = unsafe {
-            let _ = unsafe_yaml::yaml_parser_initialize(uninit.as_mut_ptr());
-            uninit.assume_init()
-        };
+        unsafe {
+            let _ = unsafe_yaml::yaml_parser_initialize(raw);
+        }
         let mut feed = None;
         match source {
             Source::Bytes(bytes) => {
@@ -69,25 +72,20 @@ impl<'a> Parser<'a> {
                 // parser (lifetime `'a`), and libyaml only reads `bytes.len()` bytes from it.
                 unsafe {
                     unsafe_yaml::yaml_parser_set_input_string(
-                        &mut *raw,
+                        raw,
                         bytes.as_ptr(),
                         bytes.len() as u64,
                     );
                 }
             }
             Source::Text(text) => {
-                let mut boxed = Box::new(text);
-                let data: *mut TextFeed<'a> = &mut *boxed;
-                // SAFETY: the feed is heap-allocated and owned by `self`, so `data` stays valid
-                // for as long as libyaml can call `read_handler`.
+                let data = Box::into_raw(Box::new(text));
+                // SAFETY: the feed is heap-allocated and owned by `self` (freed in `drop`), so
+                // `data` stays valid for as long as libyaml can call `read_handler`.
                 unsafe {
-                    unsafe_yaml::yaml_parser_set_input(
-                        &mut *raw,
-                        read_handler,
-                        data.cast::<c_void>(),
-                    );
+                    unsafe_yaml::yaml_parser_set_input(raw, read_handler, data.cast::<c_void>());
                 }
-                feed = Some(boxed);
+                feed = Some(data);
             }
         }
         Self {
@@ -103,8 +101,7 @@ impl<'a> Parser<'a> {
         let mut event = MaybeUninit::<unsafe_yaml::yaml_event_t>::uninit();
         // SAFETY: the parser is initialised with an input; `yaml_parser_parse` zero-fills the
         // event before doing anything else, so it is initialised whatever the outcome.
-        let failed =
-            unsafe { unsafe_yaml::yaml_parser_parse(&mut *self.raw, event.as_mut_ptr()).fail };
+        let failed = unsafe { unsafe_yaml::yaml_parser_parse(self.raw, event.as_mut_ptr()).fail };
         if failed {
             return Err(self.error());
         }
@@ -123,11 +120,13 @@ impl<'a> Parser<'a> {
     }
 
     fn error(&self) -> String {
-        if let Some(message) = self.feed.as_ref().and_then(|f| f.failure.clone()) {
+        // SAFETY: the feed is live until `drop`, and libyaml is not running.
+        if let Some(message) = self.feed.and_then(|f| unsafe { (*f).failure.clone() }) {
             // The Python exception raised inside the stream's read() propagates unchanged.
             return message;
         }
-        let p: &unsafe_yaml::yaml_parser_t = &self.raw;
+        // SAFETY: the parser is live until `drop`, and libyaml is not running.
+        let p: &unsafe_yaml::yaml_parser_t = unsafe { &*self.raw };
         // SAFETY: libyaml sets `problem`/`context` to static NUL-terminated strings or null.
         let problem = unsafe { c_str(p.problem) }.map(|problem| {
             // unsafe-libyaml fixed a typo that libyaml 0.2.5 (bundled with PyYAML) still prints.
@@ -165,8 +164,16 @@ impl<'a> Parser<'a> {
 
 impl Drop for Parser<'_> {
     fn drop(&mut self) {
-        // SAFETY: the parser was initialised in `new` and is deleted exactly once.
-        unsafe { unsafe_yaml::yaml_parser_delete(&mut *self.raw) };
+        // SAFETY: the parser was initialised in `new` and is deleted exactly once; the parser
+        // and the feed were allocated with `Box::into_raw` in `new` and are freed exactly once,
+        // after libyaml can no longer reach them.
+        unsafe {
+            unsafe_yaml::yaml_parser_delete(self.raw);
+            drop(Box::from_raw(self.raw));
+            if let Some(feed) = self.feed {
+                drop(Box::from_raw(feed));
+            }
+        }
     }
 }
 

{openapi_spec_validator_rs-0.2.1 → openapi_spec_validator_rs-0.2.2}/crates/openapi-spec-validator-rs/src/loader/scalars.rs

@@ -5,6 +5,7 @@
 
 use super::bigint::BigInt;
 use super::pyfmt::{lower, repr_str, repr_str_200, strip, unicode_encode_error};
+use crate::pyobj::decimal_to_ascii;
 
 /// `sys.get_int_max_str_digits()` default.
 const MAX_STR_DIGITS: usize = 4300;
@@ -73,7 +74,8 @@ pub(super) fn py_int(s: &str, base: u32) -> Result<BigInt, String> {
             repr_str_200(s)
         )
     };
-    let t = strip(s);
+    let ascii = decimal_to_ascii(s).ok_or_else(invalid)?;
+    let t = strip(&ascii);
     let (negative, t) = match t.as_bytes().first() {
         Some(b'-') => (true, &t[1..]),
         Some(b'+') => (false, &t[1..]),
@@ -147,9 +149,11 @@ pub(super) fn float_value(s: &str) -> Result<FloatValue, String> {
     Ok(FloatValue::Num(sign * py_float(value)?))
 }
 
-/// Python's `float(s)` for ASCII input.
+/// Python's `float(s)`.
 pub(super) fn py_float(s: &str) -> Result<f64, String> {
-    let t = strip(s);
+    let invalid = || format!("could not convert string to float: {}", repr_str(s));
+    let ascii = decimal_to_ascii(s).ok_or_else(invalid)?;
+    let t = strip(&ascii);
     // Rust's grammar matches Python's for these strings: optional sign, digits with an optional
     // point and exponent, or inf/infinity/nan in any case. Underscores are already gone.
     let plausible = !t.is_empty()
@@ -158,7 +162,7 @@ pub(super) fn py_float(s: &str) -> Result<f64, String> {
     plausible
         .then(|| t.parse::<f64>().ok())
         .flatten()
-        .ok_or_else(|| format!("could not convert string to float: {}", repr_str(s)))
+        .ok_or_else(invalid)
 }
 
 /// `construct_yaml_binary`'s checks; the bytes themselves are never needed because