Skip to content

Bug: Default values still count as properties even if setting them is disabled. #767

@orshlom

Description

@orshlom

kin-openapi/openapi3/schema.go

Lines 1774 to 1816 in ecb06bc

func (schema *Schema) visitJSONObject(settings *schemaValidationSettings, value map[string]interface{}) error {
if schemaType := schema.Type; schemaType != "" && schemaType != TypeObject {
return schema.expectedType(settings, value)
}
var me MultiError
if settings.asreq || settings.asrep {
properties := make([]string, 0, len(schema.Properties))
for propName := range schema.Properties {
properties = append(properties, propName)
}
sort.Strings(properties)
for _, propName := range properties {
propSchema := schema.Properties[propName]
reqRO := settings.asreq && propSchema.Value.ReadOnly && !settings.readOnlyValidationDisabled
repWO := settings.asrep && propSchema.Value.WriteOnly && !settings.writeOnlyValidationDisabled
if value[propName] == nil {
if dlft := propSchema.Value.Default; dlft != nil && !reqRO && !repWO {
value[propName] = dlft
if f := settings.defaultsSet; f != nil {
settings.onceSettingDefaults.Do(f)
}
}
}
if value[propName] != nil {
if reqRO {
me = append(me, fmt.Errorf("readOnly property %q in request", propName))
} else if repWO {
me = append(me, fmt.Errorf("writeOnly property %q in response", propName))
}
}
}
}
// "properties"
properties := schema.Properties
lenValue := int64(len(value))
// "minProperties"
if v := schema.MinProps; v != 0 && lenValue < int64(v) {

In visitJSONObject, if value[propName] is nil, it is assigned with the default value regardless of the setting (line 1794).

This counts towards lenValue (line 1813) and can falsely pass validations like minProperties that way.

I will add a PR to fix this bug.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions