express-openapi not coercing parameters that use a $ref in their schema
See original GitHub issueWhen I use a parameter like this:
parameters:
- name: flag
in: query
schema:
$ref: '#/components/schemas/SomeFlag'
where the component looks like this:
components:
schemas:
SomeFlag:
type: boolean
The parameter that ends up in my controller action hasn’t been parsed as the appropriate type. If i inline the schema it works as expected.
Here’s a minimal reproduction of my issue: https://github.com/chadxz/param-ref-repro
When i was debugging the issue it looks like there’s no support for $ref in openapi-request-coercer, but I don’t know if the schema refs should have been resolved prior to getting to that library or not.
Issue Analytics
- State:
- Created 3 years ago
- Reactions:2
- Comments:8 (3 by maintainers)
Top Results From Across the Web
express-openapi - npm
Start using express-openapi in your project by running `npm i ... Leverages openapi parameter lists for parameter defaults, type coercion, ...
Read more >Using $ref - Swagger
To reference a definition, use the $ref keyword: ... the current document, and then finds the values of components , schemas , and...
Read more >Openapi-request-validator NPM | npm.io
Supports $ref in body schemas i.e. #/definitions/SomeType . Does not supply default values (use openapi-default-setter). Does not handle type coercion (use ...
Read more >cdimascio-oss/community - Gitter
As shown in my issue cdimascio/express-openapi-validator#183 ( and my related WIP ... some users should use the $RefParser.dereference whereas the default ...
Read more >express-openapi - UNPKG
The CDN for express-openapi. ... 25, - openapi-default-setter: Support default values from schema property in parameter objects (#551).
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Parameter validations shouldn’t silently be ignored; it is important to avoid false negatives. In a worst-case scenario this could be a security issue (though it would likely be detected before then). If express-openapi cannot and will not handle these valid openapi documents it should at least throw an exception when it notices the case.
As far as I know yes