OpenAPI validation fails on Multiple methods defined on the same path

[h6ah4i]

In OpenAPI, we can declare multiple methods under an endpoint path like this.

/users:
    get:
        ...
    post:
        ...

However, runn gives error like the following;

Failure/Error: http request failed on "***: openapi3 validation error: Error: POST operation request content type 'POST' does not exist, Reason: The path was found, but there was no 'POST' method found in the spec, Line: ***, Column: ***

ref.) https://swagger.io/docs/specification/describing-responses/

(I have not confirmed yet, but it seems pb33f/libopenapi does not support the syntax.)

[k1LoW]

@h6ah4i Thank you for yor report!

Are you talking about the same structure as this one? ( get and put methods )

runn/http_validator_test.go

Lines 47 to 74 in 583c63a

	/users/{id}:
	get:
	parameters:
	- description: ID
	explode: false
	in: path
	name: id
	required: true
	schema:
	type: string
	responses:
	'200':
	description: OK
	content:
	application/json:
	schema:
	properties:
	data:
	type: object
	properties:
	username:
	type: string
	required:
	- username
	- email
	required:
	- data
	put:

[h6ah4i]

Are you talking about the same structure as this one? ( get and put methods )

It might be something different from the current test code. I'll create a sample code to reproduce the issue.

[k1LoW]

I'll create a sample code to reproduce the issue.

@h6ah4i 🙏 Thank you!!

[h6ah4i]

@k1LoW
I have managed to create a minimal test code to reproduce this issue. It seems reusing the same OpenAPI validator object and nullable are related to the issue, and declaring multiple methods on the same path is not required. Could you take a look at the following code? Thank you.

c0c7714

[k1LoW]

@h6ah4i Thank you!!

[k1LoW]

A workaround has been added to this issue.
We will continue to investigate libopenapi-validator to fix the root cause.

[h6ah4i]

@k1LoW In v0.105.1, still I get so many OpenAPI validation errors like the followings in my setup.

• openapi3 validation error: Error: POST operation request content type 'POST' does not exist, Reason: The path was found, but there was no 'POST' method found in the spec, Line: ***, Column: ***
• openapi3 validation error: Error: GET operation request content type 'GET' does not exist, Reason: The path was found, but there was no 'GET' method found in the spec, Line: ***, Column: ***
• openapi3 validation error: Error: Query parameter '***' is missing, Reason: The query parameter '***' is defined as being required, however it's missing from the requests, Line: ***, Column: ***
• openapi3 validation error: Error: POST request body for '***' failed to validate schema, Reason: The request body is defined as an object. However, it does not meet the schema requirements of the specification, Validation Errors: [Reason: missing properties: '***', '***', '***', '***', '***', Location: /required], Line: ***, Column: ***

However, I noticed a very important signal that triggers this issue today. These errors only occurs when I use the --concurrent on option.

It seems that the validator instances of libopenapi-validator are not thread-safe (maybe they are not immutable object, says it has internal states). Basically, they should not be shared among threads. Otherwise you need to implement appropriate synchronization mechanism by using mutex or something else.

I suppose the fix of the issue #889 was not perfect. It can avoid panics, but it is not sufficient to protect from concurrency access to the validator instances.

[k1LoW]

@h6ah4i Thank you for your report!

Fixed to have a validator for each HTTP runner (v0.105.2) and added the following tests.

runn/http_validator_test.go

Lines 762 to 801 in 0f97e31

	for i, tt := range tests {
	for range 10 {
	for j, v := range []*openAPI3Validator{v, v2, v3} {
	fn := func(tt testset, i, j int) func() error {
	return func() error {
	t.Run(fmt.Sprintf("%d-%d", i, j), func(t *testing.T) {
	req := tt.req.Clone(ctx)
	req.Body = io.NopCloser(bytes.NewReader(reqbs[i]))
	res := &http.Response{
	StatusCode: tt.res.StatusCode,
	Header: tt.res.Header.Clone(),
	Body: io.NopCloser(bytes.NewReader(resbs[i])),
	}
	if err := v.ValidateRequest(ctx, req); err != nil {
	if !tt.wantErr {
	t.Errorf("got error: %v", err)
	}
	return
	}
	if err := v.ValidateResponse(ctx, req, res); err != nil {
	if !tt.wantErr {
	t.Errorf("got error: %v", err)
	}
	return
	}
	if tt.wantErr {
	t.Error("want error")
	}
	})
	return nil
	}
	}(tt, i, j)
	eg.Go(fn)
	}
	}
	}
	if err := eg.Wait(); err != nil {
	t.Error(err)
	}
	}

[h6ah4i]

@k1LoW Thank you so much! I have confirmed that v0.105.2 resolved all OpenAPI validation errors in my setup 🎉