openapi3: preserve origin for a $ref to a schema under an arbitrary top-level key#21
Open
reuvenharrison wants to merge 4 commits into
Open
openapi3: preserve origin for a $ref to a schema under an arbitrary top-level key#21reuvenharrison wants to merge 4 commits into
reuvenharrison wants to merge 4 commits into
Conversation
Signed-off-by: Pierre Fenoll <pierrefenoll@gmail.com>
Signed-off-by: Pierre Fenoll <pierrefenoll@gmail.com>
… (C-02) sliceMapToSlice built a []any sized to the largest attacker-supplied array index before schema validation (maxItems) ever ran, letting a ~24-byte deepObject query parameter (e.g. param[items][50000000]=x) force multi-gigabyte heap allocation. Cap the gap between supplied elements and the reconstructed slice size, and reject negative indexes. Signed-off-by: Matías Insaurralde <matias@insaurral.de>
…op-level key A $ref to a schema stored under an arbitrary top-level key in another file (e.g. "./schemas.yaml#/User", the Swagger-2-era definitions bag) resolves through T.Extensions, a generic map that carries no origin, and the json round-trip that decodes it into the typed component drops origin entirely. With IncludeOrigin enabled the resolved schema then has a nil Origin, unlike the /components/schemas path. Re-attach origins on that path: re-derive the component file's origin tree, walk to the ref fragment, and apply the subtree, so the resolved object carries the same origins a typed resolution would, with the original file's line numbers. Best-effort; any failure leaves the object without origins, as before. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BqJA1X6suZYtR3tRbX8sLj
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A
$refto a schema stored under an arbitrary top-level key in another file (e.g../schemas.yaml#/User, the Swagger-2-era "definitions bag") resolves throughT.Extensions, a generic map that carries no origin, and the json round-trip that decodes it into the typed component drops origin entirely. WithIncludeOriginenabled the resolved schema then has a nilOrigin, unlike the/components/schemaspath.Fix: on that generic-map path (and only there), re-derive the component file's origin tree, walk to the ref fragment, and apply the subtree — so the resolved object carries the same origins a typed resolution would, with the original file's line numbers. Best-effort: any failure leaves the object without origins, exactly as before. The common typed path is untouched.
Why it matters
A consumer that uses origins for source locations (error anchors, editor links, source slicing) gets the wrong location for any element behind this ref shape: the origin chain falls back to the referencing document, pointing at the
$refsite in the root file instead of the schema's own file and line. Whole-file refs (./user.yaml) and components-structured refs already carry correct origins; this closes the remaining shape.Repro test + fixtures included (
TestOrigin_ExternalRefToArbitraryTopLevelKey); fullopenapi3suite green.