-
Notifications
You must be signed in to change notification settings - Fork 286
Description
Describe the bug
OpenApiParameterRules.PathParameterShouldBeInThePath, compares the context.PathString, which is uses the JSON pointer-encoded path segments, to the unencoded parameter.Name.
This means that a path parameter which contains a / character (or after #2780 is fixed, a ~ character as well) doesn't get detected when referenced in the path. This causes a false positive detection in PathParameterShouldBeInThePath.
OpenApi File To Reproduce
{
"openapi": "3.0.0",
"info": {
"title": "Test",
"version": "1.0.0"
},
"paths": {
"/{my/path/param}": {
"get": {
"parameters": [
{
"name": "my/path/param",
"in": "path",
"required": true,
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "OK"
}
}
}
}
}
}
Expected behavior
When running validation with the default rule set, I don't expect a 'PathParameterShouldBeInThePath' error. I expect either no error, or an error indicating some kind of path template format issue (e.g. no forward-slashes inside braces).
Additional context
In my reading of the OpenAPI specs, there is never any clear guidance as to whether a path /{a/b} is invalid, should be interpreted as a literal string, or contains a reference to parameter {a/b}.
For what it's worth, my team interprets such paths as invalid due to the ambiguity.
Note that if #2780 is fixed, this issue will be effected - replace the parameter name with my~path~param in the above example.