Typos in ref ids are not detected

[Medvedscak]

Hello, it looks like your library makes a good job in finding the format issues. However, incorrect ref ids are not detected. I'm not sure if it's intended or not.

Version used: 2.1.2

Schema example:

openapi: 3.0.0
info:
  title: test
  version: 1.0.0
paths:
  /get:
    get:
      summary: test
      description: test
      parameters:
        - name: param
          in: query
          description: param
          required: true
          schema:
            type: string
          example: "foo"
      responses:
        "200":
          description: Successful response
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/nonExisting1"
components:
  schemas:
    testObject:
      type: object
      properties:
        prop1:
          type: string
    searchResults:
      type: object
      properties:
        testObjects:
          type: array
          items:
            $ref: "#/components/schemas/nonExisting2"

Actual result:
"valid": true
I was using the CLI command for testing: npx -p @seriousme/openapi-schema-validator validate-api "invalid.spec.yaml"

[seriousme]

Hi,

thanks for reporting!

It should check for invalid refs (see

openapi-schema-validator/test/test-resolve.js

Line 122 in 1353040

test("non-existing path throws error", async (t) => {

)

But apparently your case falls between the cracks.

I will check!

Kind regards,
Hans

[seriousme]

ok, I checked and its a bit tricky :-)

Up until now validation only checked if the specification matched the JSONschema for that specification.
Your example matches the schema as the JSONschema of OpenAPI 3.0.0 allows for the $ref at the place where you put them, and the value of the $ref is a string as required by the JSONschema of OpenAPI 3.0.0. Hence the validator said that your schema is valid.

Since we can't validate the $ref via the JSONschema, there needs to be an extra logic check. This check was already present in resolveRefs but if you were doing a pure validation then resolveRefs would not be called as resolveRefs modifies the schema, which might be undesirable.

I have a PR in the works that adds a ref check to validation so that a specification that matches the JSONschema of OpenAPI but holds invalid refs is still marked as invalid.

Kind regards,
Hans

[seriousme]

Released as 2.1.3 on NPM.

npx -p @seriousme/openapi-schema-validator validate-api "invalid.spec.yaml" should work correctly now.

Kind regards,
Hans

[Medvedscak]

Great, thanks for such a quick fix! Everything looks cool now)