Missing null check for array items

[jdeflander]

Problem statement

go-swagger allows null values for array items where it shouldn't. When defining an array having items that result in Go pointers, go-swagger inserts a special case to skip validation for nil pointers.

Swagger specification

consumes:
  - application/json
info:
  title: Foo
  version: 1.0.0
paths:
  /foo:
    put:
      parameters:
        - in: body
          name: foo
          required: true
          schema:
            items:
              properties:
                foo:
                  type: boolean
              type: object
            type: array
      responses:
        200:
          description: OK
swagger: "2.0"

Steps to reproduce

1. Generate a new server with the specification given above.
2. Run the server.
3. Perform a PUT request to the /foo endpoint with [null] as body and observe that validation succeeds.

Environment

swagger version: v0.25.0
go version: go1.13
OS: darwin

[veleek]

Here's an example of the generated validation code that explicitly ignores nil values in an array.

func (m *QueryRequest) validateOrder(formats strfmt.Registry) error {
	if swag.IsZero(m.Order) { // not required
		return nil
	}

	for i := 0; i < len(m.Order); i++ {
		if swag.IsZero(m.Order[i]) { // not required
			continue
		}

		if m.Order[i] != nil {
			if err := m.Order[i].Validate(formats); err != nil {
				if ve, ok := err.(*errors.Validation); ok {
					return ve.ValidateName("order" + "." + strconv.Itoa(i))
				}
				return err
			}
		}

	}

	return nil
}