-
Notifications
You must be signed in to change notification settings - Fork 37
Open
Labels
Description
The header value isn't validated properly if the value type is string. Judging by the code, validation only occurs if the schema specifies valid enum values; in all other cases, validation is completely ignored. If type: is left blank, the default validation for the schema will be triggered, and a validation error will be returned for invalid_value.
Versions in my go.mod
github.com/pb33f/libopenapi v0.28.0
github.com/pb33f/libopenapi-validator v0.6.4
Example
package main
import (
"fmt"
"net/http"
"github.com/pb33f/libopenapi"
"github.com/pb33f/libopenapi-validator/parameters"
)
func main() {
spec := `openapi: 3.1.0
paths:
/burgers/beef:
get:
parameters:
- name: X-Request-Test
in: header
required: true
schema:
type: string
format: uuid
pattern: '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'
`
doc, _ := libopenapi.NewDocument([]byte(spec))
m, _ := doc.BuildV3Model()
v := parameters.NewParameterValidator(&m.Model)
request, _ := http.NewRequest(http.MethodGet, "https://things.com/burgers/beef", nil)
request.Header.Add("X-Request-Test", "invalid_value")
valid, errors := v.ValidateHeaderParams(request)
fmt.Println(valid) // valid == True, should be False
fmt.Println(errors) // errors == [], should be not empty
}akira28