jhthorsen / mojolicious-plugin-openapi

OpenAPI / Swagger plugin for Mojolicious
53 stars 41 forks source link

OpenAPI plugin reports `valid_input` on non-matching content-type #218

Closed myrrhlin closed 3 years ago

myrrhlin commented 3 years ago

My OpenAPI schema requires application/json content, but plug-in's valid_input reports true (no errors) no receiving a request with content text/plain, regardless of the actual content.

Code in the validator only checks that content-type exists, not that it matches the required type(s):

https://metacpan.org/release/JSON-Validator/source/lib/JSON/Validator/Schema/OpenAPIv3.pm#L271

if (@{$param->{accepts}} and !$val->{content_type}) {
    $val->{valid} = 0;
    return E "/$param->{name}", [join(', ', @{$param->{accepts}}) => type => $val->{content_type}];
  }

Here are the contents of variables at this point (from the perl debugger -- line number don't match because i inserted a $DB::single in there...

  DB<3> l
276==>     if ($param->{required} and !$val->{exists}) {
277:        return E "/$param->{name}", [qw(object required)];
278       }
279:      if ($val->{exists}) {
280:        local $self->{"validate_$direction"} = 1;
281:        my @errors = map { $_->path(_prefix_error_path($param->{name}, $_->path)); $_ }
282:          $self->validate($val->{value}, $param->{content}{$val->{content_type}}{schema});
283:        $val->{valid} = @errors ? 0 : 1;
284:        return @errors;
285       }
  DB<3> x $param
0  HASH(0x55ff9c5d5388)
   'accepts' => ARRAY(0x55ff9c47b550)
      0  'application/json'
   'content' => HASH(0x55ff9acccb58)
      'application/json' => HASH(0x55ff9bd0a7e8)
         'schema' => HASH(0x55ff9bf16430)
            '$ref' => 'schemas.yaml#/schemas/event_model'
   'in' => 'body'
   'name' => 'body'
   'required' => JSON::PP::Boolean=SCALAR(0x55ff9a068070)
      -> 1
  DB<4> x $val
0  HASH(0x55ff9c6d2140)
   'content_type' => 'text/plain'
   'exists' => 1
   'in' => 'body'
   'name' => 'body'
   'value' => undef
jhthorsen commented 3 years ago

I don't quite understand your description, but I hope this is a duplicate of #209.