Security req rule - #290
Merged
Merged
Conversation
golangci-lint renamed exhaustruct to exhaustruct_v5, and the disable list carried only the old name, so the linter fired 120 times across the repo. wsl/wsl_v5 and gomodguard/gomodguard_v2 already list both names. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
A security requirement names a scheme and lists the scopes an operation needs from it. The JSON meta-schema types it as an object of string arrays and never reads securityDefinitions, so it cannot check either against the other. validateSecurityRequirements walks the document's own security array and each operation's, and reports: - a name securityDefinitions does not declare (error); - scopes on a scheme that is not oauth2, which must list none (error); - an oauth2 scope its scheme does not declare (warning). The last one warns rather than errors because Swagger 2.0 never says a requirement and its scheme must agree on scope names. testdata/bugs/2649 (the GoToSocial spec) requires read:bookmarks, read:reports and write:reports without declaring any of them, and stays valid. Findings carry a location, /paths/~1pets/get/security/0/basic_auth. An empty requirement object and an empty security array both pass: they mean optional security and no security. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
A discriminator names the property that tells subtypes apart, and Swagger 2.0 asks two things of it: the schema must define that property, and must list it as required. An instance carries its subtype in that property, so a subtype cannot be resolved from an instance with nowhere to put the value, or free to leave it out. The JSON meta-schema types discriminator as a plain string and never compares it against properties or required, so it can express neither check. validateDiscriminators walks every definition and the schemas it holds inline, and reports both faults where they apply. A property an allOf member contributes counts as defined, and one that member requires counts as required: declaresProperty already reads a composed definition that way for the required rule, and requiresProperty is its required-list counterpart. A schema written as a $ref is left alone, so a fault is reported where the definition is written rather than once per pointer at it, and a recursive definition terminates. The third clause, that the value must name this schema or one that inherits it, constrains the data rather than the document. It stays unimplemented and moves to the known limitations in doc.go. Fixes go-openapi#54 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
collectionFormat says how to join the members of an array into one value on the wire. There is nothing to join when the type is not array, so a collectionFormat written on a string or an integer does nothing. validateCollectionFormats warns about one, in a parameter, a response header, or the items of either, at any nesting depth. Swagger 2.0 defines the member as applying when the type is array without forbidding it elsewhere, so this is a warning and the document stays valid. Only spec.SimpleSchema carries a collectionFormat, through spec.Items, spec.Header and spec.Parameter; spec.Schema has none. The rule therefore walks what the operations declare and never reads a schema, so validating an ordinary JSON schema cannot reach it. A test pins that down and breaks if the member ever moves onto Schema. The rest of the collectionFormat rules need no code: the meta-schema already caps the value to csv, ssv, tsv or pipes, widens it with multi for a query or formData parameter, and forbids the member outright on a body parameter, at every location each applies to. doc.go claimed none of the rules were implemented; it now records what is checked and where. validateItems built its list of responses inline. That moves to responsesOf, which both rules call. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
The check sat in the "not yet supported" list, which reads as a backlog item. It is a decision: the clause constrains an instance rather than the document, so it moves out of the list into a sentence saying why. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #290 +/- ##
==========================================
+ Coverage 96.93% 96.94% +0.01%
==========================================
Files 31 34 +3
Lines 3618 3763 +145
==========================================
+ Hits 3507 3648 +141
- Misses 106 110 +4
Partials 5 5 ☔ View full report in Codecov by Harness. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Change type
Please select: 🆕 New feature or enhancement|🔧 Bug fix'|📃 Documentation update
Short description
Fixes
Full description
Checklist