Refreshing Swagger page with ?tags in URL breaks the Swagger page permanently

[pcroc]

Issue

We recently upgraded from hapi-swagger v12 to v15, and found the following issue when we access the Swagger page filtering by tags.

Environment

npx envinfo --npmPackages '*hapi*' --binaries

  Binaries:
    Node: 16.18.1 - C:\Program Files\nodejs\node.EXE
    Yarn: 1.22.19 - C:\Program Files (x86)\Yarn\bin\yarn.CMD
    npm: 8.19.2 - C:\Program Files\nodejs\npm.CMD
  npmPackages:
    hapi-dev-errors: 4.x.x => 4.0.0
    hapi-pagination: 4.x.x => 4.0.0
    hapi-pino: ^11.0.1 => 11.0.1
    hapi-swagger: =15.x.x => 15.0.0
    @hapi/boom: 10.0.0 => 10.0.0
    @hapi/catbox: ^11.1.x => 11.1.1
    @hapi/hapi: ^21.0.0 => 21.0.0
    @hapi/inert: 7.0.0 => 7.0.0
    @hapi/validate: ^2.0.0 => 2.0.0
    @hapi/vision: 7.0.0 => 7.0.0

Steps to Reproduce

1. Start hapi
2. Open Swagger page with tags in query: http://localhost:8000/documentation?tags=v3
3. Page loads ok
4. Note the swagger.json URL displayed on the page: /swagger.json?tags=v3
5. Refresh the page, it is now broken (no endpoints shown)
6. Note the swagger.json URL displayed on the page: /swagger.json?tags=v3?tags=v3
7. Keep refreshing the page, the swagger.json URL gets longer and longer with extra ?tags=v3 appended each time
8. Close and reopen browser, or switch to another browser, and the problem persists

Plugin config:

  // HapiSwagger
  {
    plugin: HapiSwagger,
    options: {
      basePath: '/',
      pathReplacements: [{
        replaceIn: 'all',
        pattern: /v([0-9]+)\//,
        replacement: ''
      }],
      pathPrefixSize: 1,
      swaggerUI: true,
      reuseDefinitions: true,
      info: {
        version,
        title: '...',
        description: '...'
      },
      tags: [
      {
        name: 'group1',
        description: '....'
      },
      {
        name: 'group2',
        description: '...'
      }],
      sortTags: 'alpha',
      sortEndpoints: 'ordered',
      securityDefinitions: {
        simple: {
          type: 'apiKey',
          name: 'Authorization',
          in: 'header'
        }
      },
      security: [{ simple: [] }]
    }
  },

Expected Behavior

swagger.json URL does not keep getting tags appended to it, page works after refreshing.

Actual Behavior

See above

Reproducible Demo

Easily reproducible.

Initial investigation

I believe this problem was introduced by this commit: 88c3316. The previous version of appendQueryString parses the original URL then replaces the query. The new version of the function appends to the URL each time.

I think this is also part of the problem:

hapi-swagger/lib/index.js

Lines 331 to 333 in d9c2089

	settings.jsonPath = request.query.tags
	? Utilities.appendQueryString(settings.jsonPath, 'tags', request.query.tags)
	: Utilities.appendQueryString(settings.jsonPath);

The (presumably global) settings object is being modified on every request, rather than the cloned copy, so every request to the Swagger page causes another ?tags=xxx to be appended to the jsonPath permanently.

[robmcguinness]

@pcroc can you submit a PR?

[AndriiNyzhnyk]

I will have a look.