Colon in OpenAPI path are mistaken as parameters

Describe the bug

I’m working on some APIs that follow the format of /accounts:lookUp for example. Right now, EOV treats it the same as /accounts{lookUp} instead of the literal colon followed by some more words.

BTW, I’m happy to help fixing this.

To Reproduce

1. Load an API specification that has /accounts:lookUp > get as one of the methods. (See example below.)
2. Optionally also set operationHandlers.
3. Send an HTTP request to GET /accounts:bogus.

Actual behavior

EOV populates the metadata of /accounts:lookUp to the bogus request as well, with pathParams set to {lookUp: "bogus"} (as if lookUp were a parameter).

If operationHandlers is used, the handler for the lookUp operation is also called for the bogus request. (This is even more problematic if there are multiple operations like /accounts:lookUp, /accounts:signIn since one can shadow the others depending on ordering.)

Expected behavior

As far as I can tell, colons do not have special meanings in OpenAPI v2 / v3 spec, and EOV should just treat it as a literal colon. (This means the implementation should probably escape : to (:) before passing it to express / pathToRegexp. And then {pathParam} replacements can follow.)

EDIT: Escaping : to \\: won’t work in Express 4 (which depends on very old path-to-regexp), but (:) works (which is an unnamed capture that matches only the : character).

Examples and context

paths:
  "/accounts:lookUp":
    get:
       # ...

[yuchenshi]

@cdimascio I believe : is a valid URL character in the path part of an HTTP(S) URL. To quote RFC3986:

      path-absolute = "/" [ segment-nz *( "/" segment ) ]
      segment       = *pchar
      segment-nz    = 1*pchar
      pchar         = unreserved / pct-encoded / sub-delims / ":" / "@"

The last line above explictly allows : in pchar. In practice, there also exists many URLs like https://en.wikipedia.org/wiki/Template:Welcome and APIs like Google Identity Platform accounts:signInWithPassword that make use of colons in paths. I ran into this when I was trying to work with an existing API like the latter.

See also: https://stackoverflow.com/a/43283492

[siimsoni]

Hi all,

It appears I’m having the same problem with conversion of OpenAPI routes to Express routes.

Example:

• OpenAPI route “/{param1}:{param2}”
• Converted to Express route: “/:param1::param2” (causes exception: “Missing parameter name at X”)

Edit:

This seems to (sort-of) fix it, at least as far as avoiding the crash goes, but admittedly I haven’t tested this too much yet: https://github.com/siimsoni/express-openapi-validator/commit/ace87f66786c86875c44894b0e18276779adb8fe