From 5ac7141d04fdbbdeb0b15e28528c2292c59136ec Mon Sep 17 00:00:00 2001 From: Frederic BIDON Date: Mon, 20 Jul 2026 19:36:49 +0200 Subject: [PATCH] feat: inject a confined document loader into flatten and schema analysis Flattening and schema analysis resolve remote and relative $ref through the spec package loader, which by default is unsandboxed. A caller processing an untrusted specification had no way to confine that loading, exposing arbitrary file read and SSRF (the same class of issue addressed in go-openapi/spec). Add an injectable, option-aware loader to the two paths that actually load documents: - FlattenOpts.PathLoaderWithOptions, forwarded through ExpandOpts. This covers the whole flatten feature, since ExpandSpec, ResolveRefWithBase and DeepestRef all go through ExpandOpts. - SchemaOpts.PathLoaderWithOptions, threaded through AnalyzedSchema and the recursive Schema() calls; inferFromRef now uses spec.ExpandSchemaWithOptions (new in spec v0.22.8) instead of the default-settings ExpandSchema. Flatten's Schema() call sites propagate the loader too. Set either to a confined loader (e.g. built with loading.WithRoot / loading.WithHTTPClient, or a restricted loader from go-openapi/loads) to safely process untrusted specs. Left nil, behavior is unchanged. The New() analyzer and the diff package were audited and do not load external documents (in-memory cataloguing and definition-map lookups only), so they need no loader. Bumps spec to v0.22.8 (for ExpandSchemaWithOptions) and aligns swag to v0.27.3; the testintegration module moves to spec v0.22.8 and loads v0.24.1. Co-Authored-By: Claude Opus 4.8 (1M context) Signed-off-by: Frederic BIDON --- flatten.go | 6 +-- flatten_options.go | 19 ++++++++-- go.mod | 20 +++++----- go.sum | 44 +++++++++++----------- internal/testintegration/go.mod | 24 ++++++------ internal/testintegration/go.sum | 48 ++++++++++++------------ schema.go | 66 +++++++++++++++++++++------------ schema_test.go | 24 ++++++++++++ 8 files changed, 154 insertions(+), 97 deletions(-) diff --git a/flatten.go b/flatten.go index 1e50166..789449a 100644 --- a/flatten.go +++ b/flatten.go @@ -243,7 +243,7 @@ func nameInlinedSchemas(opts *FlattenOpts) error { continue } - asch, err := Schema(SchemaOpts{Schema: sch.Schema, Root: opts.Swagger(), BasePath: opts.BasePath}) + asch, err := Schema(SchemaOpts{Schema: sch.Schema, Root: opts.Swagger(), BasePath: opts.BasePath, PathLoaderWithOptions: opts.PathLoaderWithOptions}) if err != nil { return ErrAtKey(key, err) } @@ -657,7 +657,7 @@ func stripOAIGenForRef(opts *FlattenOpts, k string, r *newRef) (bool, error) { // determine if the previous substitution did inline a complex schema if r.schema != nil && r.schema.Ref.String() == "" { // inline schema - asch, err := Schema(SchemaOpts{Schema: r.schema, Root: opts.Swagger(), BasePath: opts.BasePath}) + asch, err := Schema(SchemaOpts{Schema: r.schema, Root: opts.Swagger(), BasePath: opts.BasePath, PathLoaderWithOptions: opts.PathLoaderWithOptions}) if err != nil { return false, err } @@ -761,7 +761,7 @@ func flattenAnonPointer(key string, v SchemaRef, refsToReplace map[string]Schema debugLog("namePointers at %s for %s", key, v.Ref.String()) // qualify the expanded schema - asch, ers := Schema(SchemaOpts{Schema: v.Schema, Root: opts.Swagger(), BasePath: opts.BasePath}) + asch, ers := Schema(SchemaOpts{Schema: v.Schema, Root: opts.Swagger(), BasePath: opts.BasePath, PathLoaderWithOptions: opts.PathLoaderWithOptions}) if ers != nil { return ErrAtKey(key, ers) } diff --git a/flatten_options.go b/flatten_options.go index 0984941..84d92db 100644 --- a/flatten_options.go +++ b/flatten_options.go @@ -4,9 +4,11 @@ package analysis import ( + "encoding/json" "log" "github.com/go-openapi/spec" + "github.com/go-openapi/swag/loading" "github.com/go-openapi/swag/mangling" ) @@ -33,6 +35,16 @@ type FlattenOpts struct { KeepNames bool // Do not attempt to jsonify names from references when flattening ManglerOpts []mangling.Option // Options for the name mangler used to jsonify names + // PathLoaderWithOptions injects the document loader used to resolve remote and relative $ref + // while flattening or expanding the specification. It matches the option-aware loader signature + // of github.com/go-openapi/swag/loading (and go-openapi/loads). + // + // Security: when flattening a specification obtained from an untrusted source, set this to a + // confined loader — for example one built with loading.WithRoot (to confine local reads) and + // loading.WithHTTPClient (to restrict remote fetches), or a restricted loader from + // go-openapi/loads. Left nil, the spec package default (unsandboxed) loader is used. + PathLoaderWithOptions func(string, ...loading.Option) (json.RawMessage, error) + /* Extra keys */ _ struct{} // require keys } @@ -40,9 +52,10 @@ type FlattenOpts struct { // ExpandOpts creates a spec.[spec.ExpandOptions] to configure expanding a specification document. func (f *FlattenOpts) ExpandOpts(skipSchemas bool) *spec.ExpandOptions { return &spec.ExpandOptions{ - RelativeBase: f.BasePath, - SkipSchemas: skipSchemas, - ContinueOnError: f.ContinueOnError, + RelativeBase: f.BasePath, + SkipSchemas: skipSchemas, + ContinueOnError: f.ContinueOnError, + PathLoaderWithOptions: f.PathLoaderWithOptions, } } diff --git a/go.mod b/go.mod index 11c7a26..f5d73b3 100644 --- a/go.mod +++ b/go.mod @@ -2,23 +2,23 @@ module github.com/go-openapi/analysis require ( github.com/go-openapi/jsonpointer v1.0.0 - github.com/go-openapi/spec v0.22.6 + github.com/go-openapi/spec v0.22.8 github.com/go-openapi/strfmt v0.27.0 - github.com/go-openapi/swag/jsonutils v0.27.0 - github.com/go-openapi/swag/loading v0.27.0 - github.com/go-openapi/swag/mangling v0.27.0 + github.com/go-openapi/swag/jsonutils v0.27.3 + github.com/go-openapi/swag/loading v0.27.3 + github.com/go-openapi/swag/mangling v0.27.3 github.com/go-openapi/testify/v2 v2.6.0 golang.org/x/text v0.40.0 ) require ( github.com/go-openapi/errors v0.22.8 // indirect - github.com/go-openapi/jsonreference v0.21.6 // indirect - github.com/go-openapi/swag/conv v0.27.0 // indirect - github.com/go-openapi/swag/jsonname v0.26.1 // indirect - github.com/go-openapi/swag/stringutils v0.26.1 // indirect - github.com/go-openapi/swag/typeutils v0.27.0 // indirect - github.com/go-openapi/swag/yamlutils v0.27.0 // indirect + github.com/go-openapi/jsonreference v1.0.0 // indirect + github.com/go-openapi/swag/conv v0.27.3 // indirect + github.com/go-openapi/swag/pools v0.27.3 // indirect + github.com/go-openapi/swag/stringutils v0.27.3 // indirect + github.com/go-openapi/swag/typeutils v0.27.3 // indirect + github.com/go-openapi/swag/yamlutils v0.27.3 // indirect github.com/go-viper/mapstructure/v2 v2.5.0 // indirect github.com/google/uuid v1.6.0 // indirect github.com/oklog/ulid/v2 v2.1.1 // indirect diff --git a/go.sum b/go.sum index b8402f7..9226672 100644 --- a/go.sum +++ b/go.sum @@ -2,30 +2,30 @@ github.com/go-openapi/errors v0.22.8 h1:oP7sW7TWc3wFFjrzzj0nI83H2qMBkNjNfSd+XRej github.com/go-openapi/errors v0.22.8/go.mod h1:BuUoHcYrU6E7V9gfj1I5wLQqgtIHnup/alXZ8KdgQ0w= github.com/go-openapi/jsonpointer v1.0.0 h1:kR9tHqY0CtZaOPVFm622dPVNhrvYpwr4uCxgL3h1H8s= github.com/go-openapi/jsonpointer v1.0.0/go.mod h1:Z3rw7dWu1p9IgitXCFamSlA5lmDiklEB6vkaxcNZW5Y= -github.com/go-openapi/jsonreference v0.21.6 h1:NZ5nGfnaM1n4I43Xjm1e5/M2GjOwQwndQz22uhxwD+Y= -github.com/go-openapi/jsonreference v0.21.6/go.mod h1:xzbgtQ3ZbWxvET3AxdzCJlJt6vkovbf+IfSPJjD0tUY= -github.com/go-openapi/spec v0.22.6 h1:Tyy1pLaNCM8GBCFLoGYLonjJi6zykqyLCjXLc19ZPic= -github.com/go-openapi/spec v0.22.6/go.mod h1:HZvTHat+iH0PALQRWhrqIHtU/PEqxqd89fu0MxGlMeM= +github.com/go-openapi/jsonreference v1.0.0 h1:jlmTr6torcd1YgDQvSfNmRtKzYDO4FGBkrAdlAVWnpY= +github.com/go-openapi/jsonreference v1.0.0/go.mod h1:jtwdyGbJk0Xhe5Y+rwtglQP6Sb1WZST4rT32LWB+sv0= +github.com/go-openapi/spec v0.22.8 h1:Nx5XYgR0nTjRLHdtTp+mpdw/QhVTiDXMNDRrhkUrgaI= +github.com/go-openapi/spec v0.22.8/go.mod h1:b/mNUYIOQOyIiUzUzXEE8xzyZqf93KvM9hQGP91yfl0= github.com/go-openapi/strfmt v0.27.0 h1:kbcTeaD9TXuXD0hhMXzuYa1sdTo6+dWGvwjW93E80IM= github.com/go-openapi/strfmt v0.27.0/go.mod h1:s/qhDqfY72irigXUGJmtgid2Rm+3tnz3k8hZaRmvWYc= -github.com/go-openapi/swag/conv v0.27.0 h1:EKOH4feXrvdo8DbSsXSAqRT8fz1epEnS5O2IfXUOzE8= -github.com/go-openapi/swag/conv v0.27.0/go.mod h1:pfiv0uKQTbaGApk8Zs/lZV3uSjmSpa2FO1y183YngN8= -github.com/go-openapi/swag/jsonname v0.26.1 h1:VReupaV6WxlAsCn0e4DUfgV6bPmINnPpyJDLqSfNPcE= -github.com/go-openapi/swag/jsonname v0.26.1/go.mod h1:OvdW6BoWoj33pTfi7x9vFrgmT+fk7aw0BRwvCE0YOuc= -github.com/go-openapi/swag/jsonutils v0.27.0 h1:VYtd9jEQYeU4j8q5vdn5KWotF4vKywhGdMBrALtAsfE= -github.com/go-openapi/swag/jsonutils v0.27.0/go.mod h1:U7pb8AGuwhok3RDicHeHwSG4L3PXSq6PAL98Aon632g= -github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.0 h1:+d7C7Ur/SsGg/UZ9G0JEovnfRqtMNZCJQGKc2h/ojoE= -github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.0/go.mod h1:mofwUWx70wvskwESqRJ//k/9kURmCgyJl5m5Ppoh5kY= -github.com/go-openapi/swag/loading v0.27.0 h1:s8DA9aPEdFH6OluHUYUn3DnIuoTdyWs9RwffXBUfyeI= -github.com/go-openapi/swag/loading v0.27.0/go.mod h1:VOz+Jg6UGGywcmRvYsI4fvtp+bd7NfioseGEPleYdA4= -github.com/go-openapi/swag/mangling v0.27.0 h1:rpPJuqQHa6z2pDiP3iIpXOyNXlSs9cQCxnJSAxzdfOc= -github.com/go-openapi/swag/mangling v0.27.0/go.mod h1:jtBE2+V+3pILxOR7Vgce+Cwp6A2PgZbvVqfNntbVs0w= -github.com/go-openapi/swag/stringutils v0.26.1 h1:f88uYyTso7TnHrKM/bUBsQ5e2wKf37cpgo6pvbzd9yU= -github.com/go-openapi/swag/stringutils v0.26.1/go.mod h1:Sc6d3bU8fgk5AyZR8/8jEQ+Is/Ald+TD/IIggPN8UJk= -github.com/go-openapi/swag/typeutils v0.27.0 h1:aCf4MSGo8NLwZP8Q6t32DWLJSvl/WwNqgmEG+xJ6v2o= -github.com/go-openapi/swag/typeutils v0.27.0/go.mod h1:Srm0xFNRZ1Y+vCxJclo5qzx8aj+1pAKda/YfFPrG0dQ= -github.com/go-openapi/swag/yamlutils v0.27.0 h1:bQ6eAMil5X9tdcf7dMn4t15alzG6jddnrKPuKa/zxKM= -github.com/go-openapi/swag/yamlutils v0.27.0/go.mod h1:yRfIo7qqVkmJRQjX8exjA3AfcI8rH1KDNPsTparoCv4= +github.com/go-openapi/swag/conv v0.27.3 h1:iqJFmGEjmX3AY0lSszABFqRVqOSt99XS0LzNIMJYuhU= +github.com/go-openapi/swag/conv v0.27.3/go.mod h1:nPRmN6jgNme99hpf+nM0auDZGALWIqlwhisKPK/bQhQ= +github.com/go-openapi/swag/jsonutils v0.27.3 h1:1DEz+O82frtSMBcos/7XIn1GnpNTbsD4Bru4Dc/uhRc= +github.com/go-openapi/swag/jsonutils v0.27.3/go.mod h1:qiDCoQvzkMxrV3G8FLEdIU5L+EFYc0zcDOHWT3Yofvo= +github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.3 h1:h/eT9kmGCDdFLJF29lOhzLtF0FmP1AX2MhLJWVebsb8= +github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.3/go.mod h1:mofwUWx70wvskwESqRJ//k/9kURmCgyJl5m5Ppoh5kY= +github.com/go-openapi/swag/loading v0.27.3 h1:L9nQkEgzU7QgFQL+pLEMfGUKxeM4pWwGwbET9Z3weW0= +github.com/go-openapi/swag/loading v0.27.3/go.mod h1:rJ0NeaKsF4CVPnMGjPQl7JlSHzvD0bc2DKXLss1hiuE= +github.com/go-openapi/swag/mangling v0.27.3 h1:gRzzD1PAUoLTtGMgI3KpBmCSOlTuLTFWnviLxLcTnyg= +github.com/go-openapi/swag/mangling v0.27.3/go.mod h1:jtBE2+V+3pILxOR7Vgce+Cwp6A2PgZbvVqfNntbVs0w= +github.com/go-openapi/swag/pools v0.27.3 h1:gXjImP3F6/56wRRcFgEPld084Y6u2gs21ikPBt8NKBk= +github.com/go-openapi/swag/pools v0.27.3/go.mod h1:kVQefhSK5RWuRe7BXsL8htgBPAMpN7HDGpGEknqugeE= +github.com/go-openapi/swag/stringutils v0.27.3 h1:Ru28hnbAvN5wycALQYy8IobHvASq+FUFMlp1QzLM0JI= +github.com/go-openapi/swag/stringutils v0.27.3/go.mod h1:lzRN95CxXmA03XcDWHLOb6nOMcxCqR5rGY0lOgsfRoM= +github.com/go-openapi/swag/typeutils v0.27.3 h1:l6SSrx5eR5/WVwrGNzN6bQ9WqL04mrxNBl9YgQ3rcJ4= +github.com/go-openapi/swag/typeutils v0.27.3/go.mod h1:Srm0xFNRZ1Y+vCxJclo5qzx8aj+1pAKda/YfFPrG0dQ= +github.com/go-openapi/swag/yamlutils v0.27.3 h1:cRFCAoYtslYn9L9T0xWryHy1t7c1MACC+DMj3CLvwvs= +github.com/go-openapi/swag/yamlutils v0.27.3/go.mod h1:6JYBGj8sw/NawMllyZY+cTA8Mzk2etS3ZBASdcyPsiU= github.com/go-openapi/testify/enable/yaml/v2 v2.6.0 h1:gGHwAJ0R/5jU8BEGDbfRNR3hL68dAVi84WuOApp29B0= github.com/go-openapi/testify/enable/yaml/v2 v2.6.0/go.mod h1:tY+St1SGq4NFl0QIqdTY4aEdbChAHxhyB77XQi9iJCo= github.com/go-openapi/testify/v2 v2.6.0 h1:5PKH2HE7YJ/LuRPQGvSxBRlFXNQhSetBLlGAgUEu3ug= diff --git a/internal/testintegration/go.mod b/internal/testintegration/go.mod index e3ae64a..ef0d1de 100644 --- a/internal/testintegration/go.mod +++ b/internal/testintegration/go.mod @@ -3,25 +3,25 @@ module github.com/go-openapi/analysis/internal/testintegration go 1.25.0 require ( - github.com/go-openapi/analysis v0.25.2 - github.com/go-openapi/loads v0.24.0 - github.com/go-openapi/spec v0.22.6 - github.com/go-openapi/swag/loading v0.27.0 + github.com/go-openapi/analysis v0.25.3 + github.com/go-openapi/loads v0.24.1 + github.com/go-openapi/spec v0.22.8 + github.com/go-openapi/swag/loading v0.27.3 github.com/go-openapi/testify/v2 v2.6.0 ) require ( github.com/go-openapi/errors v0.22.8 // indirect github.com/go-openapi/jsonpointer v1.0.0 // indirect - github.com/go-openapi/jsonreference v0.21.6 // indirect + github.com/go-openapi/jsonreference v1.0.0 // indirect github.com/go-openapi/strfmt v0.27.0 // indirect - github.com/go-openapi/swag/conv v0.27.0 // indirect - github.com/go-openapi/swag/jsonname v0.26.1 // indirect - github.com/go-openapi/swag/jsonutils v0.27.0 // indirect - github.com/go-openapi/swag/mangling v0.27.0 // indirect - github.com/go-openapi/swag/stringutils v0.26.1 // indirect - github.com/go-openapi/swag/typeutils v0.27.0 // indirect - github.com/go-openapi/swag/yamlutils v0.27.0 // indirect + github.com/go-openapi/swag/conv v0.27.3 // indirect + github.com/go-openapi/swag/jsonutils v0.27.3 // indirect + github.com/go-openapi/swag/mangling v0.27.3 // indirect + github.com/go-openapi/swag/pools v0.27.3 // indirect + github.com/go-openapi/swag/stringutils v0.27.3 // indirect + github.com/go-openapi/swag/typeutils v0.27.3 // indirect + github.com/go-openapi/swag/yamlutils v0.27.3 // indirect github.com/go-viper/mapstructure/v2 v2.5.0 // indirect github.com/google/uuid v1.6.0 // indirect github.com/oklog/ulid/v2 v2.1.1 // indirect diff --git a/internal/testintegration/go.sum b/internal/testintegration/go.sum index 48eb463..a41eaf4 100644 --- a/internal/testintegration/go.sum +++ b/internal/testintegration/go.sum @@ -2,32 +2,32 @@ github.com/go-openapi/errors v0.22.8 h1:oP7sW7TWc3wFFjrzzj0nI83H2qMBkNjNfSd+XRej github.com/go-openapi/errors v0.22.8/go.mod h1:BuUoHcYrU6E7V9gfj1I5wLQqgtIHnup/alXZ8KdgQ0w= github.com/go-openapi/jsonpointer v1.0.0 h1:kR9tHqY0CtZaOPVFm622dPVNhrvYpwr4uCxgL3h1H8s= github.com/go-openapi/jsonpointer v1.0.0/go.mod h1:Z3rw7dWu1p9IgitXCFamSlA5lmDiklEB6vkaxcNZW5Y= -github.com/go-openapi/jsonreference v0.21.6 h1:NZ5nGfnaM1n4I43Xjm1e5/M2GjOwQwndQz22uhxwD+Y= -github.com/go-openapi/jsonreference v0.21.6/go.mod h1:xzbgtQ3ZbWxvET3AxdzCJlJt6vkovbf+IfSPJjD0tUY= -github.com/go-openapi/loads v0.24.0 h1:4LLorXRPTzIN9V6ngMUZbAscsBOUBk3Oa8cClu/bFrQ= -github.com/go-openapi/loads v0.24.0/go.mod h1:xQMgX+hw5xRAhGrcDXxeMw78IFqUpIzhleu3HqPhyF4= -github.com/go-openapi/spec v0.22.6 h1:Tyy1pLaNCM8GBCFLoGYLonjJi6zykqyLCjXLc19ZPic= -github.com/go-openapi/spec v0.22.6/go.mod h1:HZvTHat+iH0PALQRWhrqIHtU/PEqxqd89fu0MxGlMeM= +github.com/go-openapi/jsonreference v1.0.0 h1:jlmTr6torcd1YgDQvSfNmRtKzYDO4FGBkrAdlAVWnpY= +github.com/go-openapi/jsonreference v1.0.0/go.mod h1:jtwdyGbJk0Xhe5Y+rwtglQP6Sb1WZST4rT32LWB+sv0= +github.com/go-openapi/loads v0.24.1 h1:oeiIolegnV9MtqfKHQwOeZ96vEwTFY5YxGMj3QpDeJw= +github.com/go-openapi/loads v0.24.1/go.mod h1:Ijkjm2ljm+20aoIwp9smqNyFsTJoighhNcLvcZVxrwc= +github.com/go-openapi/spec v0.22.8 h1:Nx5XYgR0nTjRLHdtTp+mpdw/QhVTiDXMNDRrhkUrgaI= +github.com/go-openapi/spec v0.22.8/go.mod h1:b/mNUYIOQOyIiUzUzXEE8xzyZqf93KvM9hQGP91yfl0= github.com/go-openapi/strfmt v0.27.0 h1:kbcTeaD9TXuXD0hhMXzuYa1sdTo6+dWGvwjW93E80IM= github.com/go-openapi/strfmt v0.27.0/go.mod h1:s/qhDqfY72irigXUGJmtgid2Rm+3tnz3k8hZaRmvWYc= -github.com/go-openapi/swag/conv v0.27.0 h1:EKOH4feXrvdo8DbSsXSAqRT8fz1epEnS5O2IfXUOzE8= -github.com/go-openapi/swag/conv v0.27.0/go.mod h1:pfiv0uKQTbaGApk8Zs/lZV3uSjmSpa2FO1y183YngN8= -github.com/go-openapi/swag/jsonname v0.26.1 h1:VReupaV6WxlAsCn0e4DUfgV6bPmINnPpyJDLqSfNPcE= -github.com/go-openapi/swag/jsonname v0.26.1/go.mod h1:OvdW6BoWoj33pTfi7x9vFrgmT+fk7aw0BRwvCE0YOuc= -github.com/go-openapi/swag/jsonutils v0.27.0 h1:VYtd9jEQYeU4j8q5vdn5KWotF4vKywhGdMBrALtAsfE= -github.com/go-openapi/swag/jsonutils v0.27.0/go.mod h1:U7pb8AGuwhok3RDicHeHwSG4L3PXSq6PAL98Aon632g= -github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.0 h1:+d7C7Ur/SsGg/UZ9G0JEovnfRqtMNZCJQGKc2h/ojoE= -github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.0/go.mod h1:mofwUWx70wvskwESqRJ//k/9kURmCgyJl5m5Ppoh5kY= -github.com/go-openapi/swag/loading v0.27.0 h1:s8DA9aPEdFH6OluHUYUn3DnIuoTdyWs9RwffXBUfyeI= -github.com/go-openapi/swag/loading v0.27.0/go.mod h1:VOz+Jg6UGGywcmRvYsI4fvtp+bd7NfioseGEPleYdA4= -github.com/go-openapi/swag/mangling v0.27.0 h1:rpPJuqQHa6z2pDiP3iIpXOyNXlSs9cQCxnJSAxzdfOc= -github.com/go-openapi/swag/mangling v0.27.0/go.mod h1:jtBE2+V+3pILxOR7Vgce+Cwp6A2PgZbvVqfNntbVs0w= -github.com/go-openapi/swag/stringutils v0.26.1 h1:f88uYyTso7TnHrKM/bUBsQ5e2wKf37cpgo6pvbzd9yU= -github.com/go-openapi/swag/stringutils v0.26.1/go.mod h1:Sc6d3bU8fgk5AyZR8/8jEQ+Is/Ald+TD/IIggPN8UJk= -github.com/go-openapi/swag/typeutils v0.27.0 h1:aCf4MSGo8NLwZP8Q6t32DWLJSvl/WwNqgmEG+xJ6v2o= -github.com/go-openapi/swag/typeutils v0.27.0/go.mod h1:Srm0xFNRZ1Y+vCxJclo5qzx8aj+1pAKda/YfFPrG0dQ= -github.com/go-openapi/swag/yamlutils v0.27.0 h1:bQ6eAMil5X9tdcf7dMn4t15alzG6jddnrKPuKa/zxKM= -github.com/go-openapi/swag/yamlutils v0.27.0/go.mod h1:yRfIo7qqVkmJRQjX8exjA3AfcI8rH1KDNPsTparoCv4= +github.com/go-openapi/swag/conv v0.27.3 h1:iqJFmGEjmX3AY0lSszABFqRVqOSt99XS0LzNIMJYuhU= +github.com/go-openapi/swag/conv v0.27.3/go.mod h1:nPRmN6jgNme99hpf+nM0auDZGALWIqlwhisKPK/bQhQ= +github.com/go-openapi/swag/jsonutils v0.27.3 h1:1DEz+O82frtSMBcos/7XIn1GnpNTbsD4Bru4Dc/uhRc= +github.com/go-openapi/swag/jsonutils v0.27.3/go.mod h1:qiDCoQvzkMxrV3G8FLEdIU5L+EFYc0zcDOHWT3Yofvo= +github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.3 h1:h/eT9kmGCDdFLJF29lOhzLtF0FmP1AX2MhLJWVebsb8= +github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.3/go.mod h1:mofwUWx70wvskwESqRJ//k/9kURmCgyJl5m5Ppoh5kY= +github.com/go-openapi/swag/loading v0.27.3 h1:L9nQkEgzU7QgFQL+pLEMfGUKxeM4pWwGwbET9Z3weW0= +github.com/go-openapi/swag/loading v0.27.3/go.mod h1:rJ0NeaKsF4CVPnMGjPQl7JlSHzvD0bc2DKXLss1hiuE= +github.com/go-openapi/swag/mangling v0.27.3 h1:gRzzD1PAUoLTtGMgI3KpBmCSOlTuLTFWnviLxLcTnyg= +github.com/go-openapi/swag/mangling v0.27.3/go.mod h1:jtBE2+V+3pILxOR7Vgce+Cwp6A2PgZbvVqfNntbVs0w= +github.com/go-openapi/swag/pools v0.27.3 h1:gXjImP3F6/56wRRcFgEPld084Y6u2gs21ikPBt8NKBk= +github.com/go-openapi/swag/pools v0.27.3/go.mod h1:kVQefhSK5RWuRe7BXsL8htgBPAMpN7HDGpGEknqugeE= +github.com/go-openapi/swag/stringutils v0.27.3 h1:Ru28hnbAvN5wycALQYy8IobHvASq+FUFMlp1QzLM0JI= +github.com/go-openapi/swag/stringutils v0.27.3/go.mod h1:lzRN95CxXmA03XcDWHLOb6nOMcxCqR5rGY0lOgsfRoM= +github.com/go-openapi/swag/typeutils v0.27.3 h1:l6SSrx5eR5/WVwrGNzN6bQ9WqL04mrxNBl9YgQ3rcJ4= +github.com/go-openapi/swag/typeutils v0.27.3/go.mod h1:Srm0xFNRZ1Y+vCxJclo5qzx8aj+1pAKda/YfFPrG0dQ= +github.com/go-openapi/swag/yamlutils v0.27.3 h1:cRFCAoYtslYn9L9T0xWryHy1t7c1MACC+DMj3CLvwvs= +github.com/go-openapi/swag/yamlutils v0.27.3/go.mod h1:6JYBGj8sw/NawMllyZY+cTA8Mzk2etS3ZBASdcyPsiU= github.com/go-openapi/testify/enable/yaml/v2 v2.6.0 h1:gGHwAJ0R/5jU8BEGDbfRNR3hL68dAVi84WuOApp29B0= github.com/go-openapi/testify/enable/yaml/v2 v2.6.0/go.mod h1:tY+St1SGq4NFl0QIqdTY4aEdbChAHxhyB77XQi9iJCo= github.com/go-openapi/testify/v2 v2.6.0 h1:5PKH2HE7YJ/LuRPQGvSxBRlFXNQhSetBLlGAgUEu3ug= diff --git a/schema.go b/schema.go index bedea65..2c25046 100644 --- a/schema.go +++ b/schema.go @@ -4,8 +4,11 @@ package analysis import ( + "encoding/json" + "github.com/go-openapi/spec" "github.com/go-openapi/strfmt" + "github.com/go-openapi/swag/loading" ) // SchemaOpts configures the schema analyzer. @@ -13,7 +16,17 @@ type SchemaOpts struct { Schema *spec.Schema Root any BasePath string - _ struct{} + + // PathLoaderWithOptions injects the document loader (with loading options) used to resolve + // remote and relative $ref while analyzing a schema. + // + // Security: set this to a confined loader — for example one built with loading.WithRoot and + // loading.WithHTTPClient, or a restricted loader from go-openapi/loads — when the schema may + // derive from an untrusted source. Left nil, the spec package default (unsandboxed) loader is + // used. + PathLoaderWithOptions func(string, ...loading.Option) (json.RawMessage, error) + + _ struct{} } // Schema analysis, will classify the schema according to known @@ -24,9 +37,10 @@ func Schema(opts SchemaOpts) (*AnalyzedSchema, error) { } a := &AnalyzedSchema{ - schema: opts.Schema, - root: opts.Root, - basePath: opts.BasePath, + schema: opts.Schema, + root: opts.Root, + basePath: opts.BasePath, + pathLoaderWithOptions: opts.PathLoaderWithOptions, } a.initializeFlags() @@ -54,9 +68,10 @@ func Schema(opts SchemaOpts) (*AnalyzedSchema, error) { // AnalyzedSchema indicates what the schema represents. type AnalyzedSchema struct { - schema *spec.Schema - root any - basePath string + schema *spec.Schema + root any + basePath string + pathLoaderWithOptions func(string, ...loading.Option) (json.RawMessage, error) hasProps bool hasAllOf bool @@ -103,19 +118,32 @@ func (a *AnalyzedSchema) inherits(other *AnalyzedSchema) { a.IsEnum = other.IsEnum } +// subSchemaOpts builds SchemaOpts for a nested schema, propagating the root, base path and the +// injected document loader so that confinement applies throughout the recursive analysis. +func (a *AnalyzedSchema) subSchemaOpts(sch *spec.Schema) SchemaOpts { + return SchemaOpts{ + Schema: sch, + Root: a.root, + BasePath: a.basePath, + PathLoaderWithOptions: a.pathLoaderWithOptions, + } +} + +// expandOpts builds the spec expand options for this analysis, carrying the injected loader so +// remote/relative $ref are resolved through it (rather than the unsandboxed package default). +func (a *AnalyzedSchema) expandOpts() *spec.ExpandOptions { + return &spec.ExpandOptions{PathLoaderWithOptions: a.pathLoaderWithOptions} +} + func (a *AnalyzedSchema) inferFromRef() error { if a.hasRef { sch := new(spec.Schema) sch.Ref = a.schema.Ref - err := spec.ExpandSchema(sch, a.root, nil) + err := spec.ExpandSchemaWithOptions(sch, a.root, nil, a.expandOpts()) if err != nil { return err } - rsch, err := Schema(SchemaOpts{ - Schema: sch, - Root: a.root, - BasePath: a.basePath, - }) + rsch, err := Schema(a.subSchemaOpts(sch)) if err != nil { // NOTE(fredbi): currently the only cause for errors is // unresolved ref. Since spec.ExpandSchema() expands the @@ -159,11 +187,7 @@ func (a *AnalyzedSchema) inferMap() error { // maps if a.schema.AdditionalProperties.Schema != nil { - msch, err := Schema(SchemaOpts{ - Schema: a.schema.AdditionalProperties.Schema, - Root: a.root, - BasePath: a.basePath, - }) + msch, err := Schema(a.subSchemaOpts(a.schema.AdditionalProperties.Schema)) if err != nil { return err } @@ -186,11 +210,7 @@ func (a *AnalyzedSchema) inferArray() error { a.IsArray = a.isArrayType() && (a.schema.Items == nil || a.schema.Items.Schemas == nil) if a.IsArray && a.hasItems { if a.schema.Items.Schema != nil { - itsch, err := Schema(SchemaOpts{ - Schema: a.schema.Items.Schema, - Root: a.root, - BasePath: a.basePath, - }) + itsch, err := Schema(a.subSchemaOpts(a.schema.Items.Schema)) if err != nil { return err } diff --git a/schema_test.go b/schema_test.go index cbf0cc2..ecfb658 100644 --- a/schema_test.go +++ b/schema_test.go @@ -14,10 +14,34 @@ import ( "github.com/go-openapi/analysis/internal/antest" "github.com/go-openapi/spec" + "github.com/go-openapi/swag/loading" "github.com/go-openapi/testify/v2/assert" "github.com/go-openapi/testify/v2/require" ) +// TestSchema_PathLoaderWithOptions verifies that a document loader injected through +// SchemaOpts is the one used to resolve a remote $ref during schema analysis — the hook a caller +// uses to confine loading when the schema may come from an untrusted source. +func TestSchema_PathLoaderWithOptions(t *testing.T) { + serv := refServer() + defer serv.Close() + + var calls int + loader := func(pth string, opts ...loading.Option) (json.RawMessage, error) { + calls++ + return loading.LoadFromFileOrHTTP(pth, opts...) + } + + refs := knownRefs(serv.URL) + sch, err := Schema(SchemaOpts{ + Schema: refSchema(refs[0]), + PathLoaderWithOptions: loader, + }) + require.NoError(t, err) + assert.TrueT(t, sch.IsKnownType) + assert.TrueT(t, calls > 0, "expected the injected loader to resolve the remote $ref") +} + func TestSchemaAnalysis_KnownTypes(t *testing.T) { for i, v := range knownSchemas() { sch, err := Schema(SchemaOpts{Schema: v})