v0.7.19

Security fix

High severity: Overbroad path-parameter regex in generated Ory Oathkeeper access rules could cause an authentication/authorization bypass.

Previously, every OpenAPI string path parameter (and any parameter type the generator couldn't classify) was compiled to the unanchored regex token <.+>. Because . matches / in Go's regexp engine — and in Ory Oathkeeper's regexp matching strategy — a rule generated for a single path segment (e.g. /public/{slug}) also matched deeper, unrelated paths under the same prefix (e.g. /public/admin/delete-all-users). If those deeper paths weren't defined as their own, more specific OpenAPI operations, the broader (often unauthenticated noop) rule would match and proxy them instead of being rejected.

Generated rules for string and unclassified path parameters now use <[^/]+>, anchored to a single URL segment, matching the behavior already documented for numeric parameters.

Action required: Regenerate your Ory Oathkeeper access rules with this version and redeploy them. Rules generated by earlier versions using string path parameters may be broader than intended.

See GHSA-9f3w-vm54-7gfc for full details. Thanks to @EQSTLab for the responsible disclosure.

What's Changed

• fix(generator): anchor string path-parameter regex to a single URL segment by @emmanuelgautier in #142

Full Changelog: v0.7.18...v0.7.19