[jira] [Commented] (CAMEL-25168) camel-openapi-validator: a repeated request header is validated as the text of a Java collection

["Claus Ibsen (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/CAMEL-25168?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18121249#comment-18121249 ] 

Claus Ibsen commented on CAMEL-25168:
-------------------------------------

Merged to main via https://github.com/apache/camel/pull/27099 (fix version 4.23.0).

_Claude Code on behalf of davsclaus_

> camel-openapi-validator: a repeated request header is validated as the text of a Java collection
> ------------------------------------------------------------------------------------------------
>
>                 Key: CAMEL-25168
>                 URL: https://issues.apache.org/jira/browse/CAMEL-25168
>             Project: Camel
>          Issue Type: Bug
>          Components: camel-openapi-validator
>    Affects Versions: 4.22.1
>            Reporter: Thomas Raddatz
>            Priority: Minor
>             Fix For: 4.23.0
>
>
> The rest client request validator ({{OpenApiRestClientRequestValidator}}) builds the {{SimpleRequest}} for swagger-request-validator with
> {code:java}
> builder.withHeader(key, exchange.getMessage().getHeader(key, String.class));
> {code}
> A header that occurs more than once arrives on the message as a {{Collection}} ({{CollectionHelper.appendEntry}}). Converting it to {{String}} falls back to {{ToStringTypeConverter}}, so the validator checks the value {{[a, b]}}, which the client never sent.
> h3. Consequences
> * A header declared as a single value (e.g. {{"type": "string"}}) that is repeated is never reported, because {{[a, b]}} is still a string.
> * {{pattern}}, {{enum}}, {{format}} and {{maxLength}}, and the item type of an array header, are checked against the wrong value, so a valid request can be rejected or an invalid one accepted.
> * A repeated array header is checked as the text {{[a, b]}}, split at the comma into {{[a}} and {{ b]}}. With typed items such as {{integer}} it is rejected, although per [RFC 9110 section 5.3|https://www.rfc-editor.org/rfc/rfc9110#section-5.3] it is equivalent to one header with the values joined by commas. With string items it passes only by accident.
> Query parameters in the same method are already passed once per occurrence, so the equivalent repeated query parameter is validated correctly.
> h3. Reproduce
> With the petstore contract of the module ({{DELETE /pet/\{petId\}}}, header {{api_key}} {{"type": "string"}}):
> {code:java}
> exchange.getMessage().setHeader(Exchange.HTTP_METHOD, "DELETE");
> exchange.getMessage().setHeader(Exchange.HTTP_PATH, "pet/123");
> exchange.getMessage().setHeader("api_key", List.of("key-one", "key-two"));
> {code}
> *Expected:* a validation error.
> *Actual:* no error.
> h3. Known limitation (outside the scope of this issue)
> For OpenAPI 3.1 contracts swagger-request-validator 2.46.1 does not recognise header parameters as arrays (the parser produces {{JsonSchema}}, the validator checks for {{ArraySchema}}), so header arrays of a 3.1 contract do not validate at all.
> h3. Pull request
> https://github.com/apache/camel/pull/27099



--
This message was sent by Atlassian Jira
(v8.20.10#820010)