Skip to content

Fix/align url normalization - #308

Merged
fredbi merged 2 commits into
go-openapi:masterfrom
fredbi:fix/align-url-normalization
Aug 25, 2026
Merged

Fix/align url normalization#308
fredbi merged 2 commits into
go-openapi:masterfrom
fredbi:fix/align-url-normalization

Conversation

@fredbi

@fredbi fredbi commented Aug 25, 2026

Copy link
Copy Markdown
Member

Change type

Please select: 🆕 New feature or enhancement|🔧 Bug fix'|📃 Documentation update

Short description

Fixes

Full description

Checklist

  • I have signed all my commits with my name and email (see DCO. This does not require a PGP-signed commit
  • I have rebased and squashed my work, so only one commit remains
  • I have added tests to cover my changes.
  • I have properly enriched go doc comments in code.
  • I have properly documented any breaking change.

fredbi and others added 2 commits August 25, 2026 14:28
jsonreference v1.0.1 stops NormalizeURL from turning a parseable URI into an
unparseable one: "https://:a:443" used to come back as "https://:a", where ":a"
is not a valid port.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
The normalizer kept the spelling it was handed, while jsonreference lower-cases
the host, drops a default port and re-escapes path and fragment. Both meet every
$ref - the normalizer builds the URI, and jsonreference re-renders it as soon as
the string becomes a Ref - so one document could be cached under two spellings
of itself, and a $ref written back by denormalizeRef did not normalize to what
it came from.

normalizeURI and normalizeBase now end in canonicalString, which renders through
NewRef. Only the branch returning a $ref that is already canonical and the two
returns of normalizeBase were spelling their own answer; a relative $ref went
through the join onto the base, which already re-rendered. A URI jsonreference
cannot parse is returned as it stands and logged, rather than panicking through
MustCreateRef.

forgetSpelling drops url.URL.RawPath and RawFragment once Path has been rewritten
by path.Clean or by the join. String returns RawPath whenever it still decodes to
Path, so a stale one could be rendered instead: normalizeBase("%2F") returned
"file://%2F", where the escaped form has no leading slash and what is left reads
as an authority - a base that no longer parses.

FuzzNormalizer drops the respelled() fence its fourth property carried, so
denormalizing now has to round-trip for every input rather than for those the two
sides happened to spell alike. 9.6M executions clean. TestNormalizer_Canonicalization
and TestNormalizer_CanonicalBase pin the rules case by case, including the
degenerate authorities, the runs of slashes and the escaping.

One rule is recorded rather than fixed, in TestNormalizer_EscapedSlashIsDecoded:
jsonreference decodes %2F into a separator, which RFC 3986 section 6.2.2.2 forbids. A
$ref loses the escape anyway when the document model turns it into a Ref, so
keeping it in the normalizer would only hide that. It belongs upstream.

Also drops the parentheses in expander.go that gofumpt flags, untouched since
2021, so a full golangci-lint run comes out clean.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
@codecov

codecov Bot commented Aug 25, 2026

Copy link
Copy Markdown

❌ 2 Tests Failed:

Tests completed Failed Passed Skipped
633 2 631 0
View the top 2 failed test(s) by shortest run time
github.com/go-openapi/spec::TestNormalizer_CanonicalBase
Stack Traces | 0s run time
Failed
github.com/go-openapi/spec::TestNormalizer_CanonicalBase/escaped_path_rendering
Stack Traces | 0s run time
Failed

To view more test analytics, go to the Test Analytics Dashboard
📋 Got 3 mins? Take this short survey to help us improve Test Analytics.

@fredbi
fredbi merged commit 34af4e1 into go-openapi:master Aug 25, 2026
18 of 22 checks passed
@fredbi
fredbi deleted the fix/align-url-normalization branch August 25, 2026 13:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant