Skip to content

Bug: Default values still count as properties even if setting them is disabled. #767

@orshlom

Description

@orshlom

kin-openapi/openapi3/schema.go

Lines 1774 to 1816 in ecb06bc

func (schema *Schema) visitJSONObject(settings *schemaValidationSettings, value map[string]interface{}) error {
if schemaType := schema.Type; schemaType != "" && schemaType != TypeObject {
return schema.expectedType(settings, value)
}
var me MultiError
if settings.asreq || settings.asrep {
properties := make([]string, 0, len(schema.Properties))
for propName := range schema.Properties {
properties = append(properties, propName)
}
sort.Strings(properties)
for _, propName := range properties {
propSchema := schema.Properties[propName]
reqRO := settings.asreq && propSchema.Value.ReadOnly && !settings.readOnlyValidationDisabled
repWO := settings.asrep && propSchema.Value.WriteOnly && !settings.writeOnlyValidationDisabled
if value[propName] == nil {
if dlft := propSchema.Value.Default; dlft != nil && !reqRO && !repWO {
value[propName] = dlft
if f := settings.defaultsSet; f != nil {
settings.onceSettingDefaults.Do(f)
}
}
}
if value[propName] != nil {
if reqRO {
me = append(me, fmt.Errorf("readOnly property %q in request", propName))
} else if repWO {
me = append(me, fmt.Errorf("writeOnly property %q in response", propName))
}
}
}
}
// "properties"
properties := schema.Properties
lenValue := int64(len(value))
// "minProperties"
if v := schema.MinProps; v != 0 && lenValue < int64(v) {

In visitJSONObject, if value[propName] is nil, it is assigned with the default value regardless of the setting (line 1794).

This counts towards lenValue (line 1813) and can falsely pass validations like minProperties that way.

I will add a PR to fix this bug.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions