Skip to content

PathParameterShouldBeInThePath false positive #2781

@davidrea-MS

Description

@davidrea-MS

Describe the bug
OpenApiParameterRules.PathParameterShouldBeInThePath, compares the context.PathString, which is uses the JSON pointer-encoded path segments, to the unencoded parameter.Name.
This means that a path parameter which contains a / character (or after #2780 is fixed, a ~ character as well) doesn't get detected when referenced in the path. This causes a false positive detection in PathParameterShouldBeInThePath.

OpenApi File To Reproduce

{
    "openapi": "3.0.0",
    "info": {
      "title": "Test",
      "version": "1.0.0"
    },
    "paths": {
      "/{my/path/param}": {
        "get": {
          "parameters": [
            {
              "name": "my/path/param",
              "in": "path",
              "required": true,
              "schema": {
                "type": "string"
              }
            }
          ],
          "responses": {
            "200": {
              "description": "OK"
            }
          }
        }
      }
    }
  }

Expected behavior
When running validation with the default rule set, I don't expect a 'PathParameterShouldBeInThePath' error. I expect either no error, or an error indicating some kind of path template format issue (e.g. no forward-slashes inside braces).

Additional context
In my reading of the OpenAPI specs, there is never any clear guidance as to whether a path /{a/b} is invalid, should be interpreted as a literal string, or contains a reference to parameter {a/b}.
For what it's worth, my team interprets such paths as invalid due to the ambiguity.

Note that if #2780 is fixed, this issue will be effected - replace the parameter name with my~path~param in the above example.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions