express-openapi-validator - npm Package Compare versions

Comparing version 5.2.0 to 5.3.1

dist/middlewares/openapi.metadata.js

@@ -58,3 +58,3 @@ "use strict";
     function lookupRoute(req, useRequestUrl) {
-        const path = useRequestUrl ? req.url : req.originalUrl.split('?')[0];
+        const path = useRequestUrl ? req.url.split('?')[0] : req.originalUrl.split('?')[0];
         const method = req.method;
@@ -61,0 +61,0 @@ const routeEntries = Object.entries(openApiContext.expressRouteMap);

dist/middlewares/parsers/req.parameter.mutator.d.ts

 import Ajv from 'ajv';
-import { OpenAPIV3, OpenApiRequest, ValidationSchema } from '../../framework/types';
+import { OpenApiRequest, OpenAPIV3, ValidationSchema } from '../../framework/types';
 /**
@@ -14,3 +14,3 @@ * A class top parse and mutate the incoming request parameters according to the openapi spec.
     /**
-     * Modifies an incoing request object by applying the openapi schema
+     * Modifies an incoming request object by applying the openapi schema
      * req values may be parsed/mutated as a JSON object, JSON Exploded Object, JSON Array, or JSON Exploded Array
@@ -24,2 +24,11 @@ * @param req
     private parseJsonAndMutateRequest;
+    /**
+     * used for !explode array parameters
+     * @param req
+     * @param $in
+     * @param name
+     * @param delimiter
+     * @param rawQuery
+     * @private
+     */
     private parseJsonArrayAndMutateRequest;
@@ -26,0 +35,0 @@ private explodedJsonObjectAndMutateRequest;

dist/middlewares/parsers/req.parameter.mutator.js

@@ -34,3 +34,3 @@ "use strict";
     /**
-     * Modifies an incoing request object by applying the openapi schema
+     * Modifies an incoming request object by applying the openapi schema
      * req values may be parsed/mutated as a JSON object, JSON Exploded Object, JSON Array, or JSON Exploded Array
@@ -49,5 +49,8 @@ * @param req
             const queryString = req.originalUrl.substr(i + 1);
-            if (parameter.in === 'query' && !parameter.allowReserved) {
+            if (parameter.in === 'query' && !parameter.allowReserved && !!parameter.explode) { //} && !!parameter.explode) {
                 this.validateReservedCharacters(name, rawQuery);
             }
+            if (parameter.in === 'query' && !parameter.allowReserved && !parameter.explode) { //} && !!parameter.explode) {
+                this.validateReservedCharacters(name, rawQuery, true);
+            }
             if (parameter.content) {
@@ -71,3 +74,3 @@ this.handleContent(req, name, parameter);
                 this.validateArrayDelimiter(delimiter, parameter);
-                this.parseJsonArrayAndMutateRequest(req, parameter.in, name, delimiter);
+                this.parseJsonArrayAndMutateRequest(req, parameter.in, name, delimiter, rawQuery);
             }
@@ -193,6 +196,15 @@ else if (type === 'array' && explode) {
     }
-    parseJsonArrayAndMutateRequest(req, $in, name, delimiter) {
-        var _a;
+    /**
+     * used for !explode array parameters
+     * @param req
+     * @param $in
+     * @param name
+     * @param delimiter
+     * @param rawQuery
+     * @private
+     */
+    parseJsonArrayAndMutateRequest(req, $in, name, delimiter, rawQuery) {
+        var _a, _b;
         /**
-         * array deserialization
+         * array deserialization for query and params
          * filter=foo,bar,baz
@@ -203,7 +215,23 @@ * filter=foo|bar|baz
         const field = REQUEST_FIELDS[$in];
-        if ((_a = req[field]) === null || _a === void 0 ? void 0 : _a[name]) {
+        const rawValues = [];
+        if (['query'].includes($in)) {
+            // perhaps split query from params
+            rawValues.concat((_a = rawQuery.get(name)) !== null && _a !== void 0 ? _a : []);
+        }
+        let i = 0;
+        if ((_b = req[field]) === null || _b === void 0 ? void 0 : _b[name]) {
             if (Array.isArray(req[field][name]))
                 return;
             const value = req[field][name].split(delimiter);
-            req[field][name] = value;
+            const rawValue = rawValues[i++];
+            if (rawValue === null || rawValue === void 0 ? void 0 : rawValue.includes(delimiter)) { // TODO add && !allowReserved to improve performance. When allowReserved is true, commas are common and we do not need to do this extra work
+                // Currently, rawValue is only populated for query params
+                // if the raw value contains a delimiter, decode manually
+                // parse the decode value and update req[field][name]
+                const manuallyDecodedValues = rawValue.split(delimiter).map(v => decodeURIComponent(v));
+                req[field][name] = manuallyDecodedValues;
+            }
+            else {
+                req[field][name] = value;
+            }
         }
@@ -266,3 +294,3 @@ }
     }
-    validateReservedCharacters(name, pairs) {
+    validateReservedCharacters(name, pairs, allowComma = false) {
         const vs = pairs.get(name);
@@ -272,5 +300,8 @@ if (!vs)
         for (const v of vs) {
-            if (v === null || v === void 0 ? void 0 : v.match(RESERVED_CHARS)) {
-                const message = `Parameter '${name}' must be url encoded. Its value may not contain reserved characters.`;
-                throw new types_1.BadRequest({ path: `/query/${name}`, message: message });
+            const svs = allowComma ? v.split(',') : [v];
+            for (const sv of svs) {
+                if (sv === null || sv === void 0 ? void 0 : sv.match(RESERVED_CHARS)) {
+                    const message = `Parameter '${name}' must be url encoded. Its value may not contain reserved characters.`;
+                    throw new types_1.BadRequest({ path: `/query/${name}`, message: message });
+                }
             }
@@ -277,0 +308,0 @@ }

package.json

 {
   "name": "express-openapi-validator",
-  "version": "5.2.0",
+  "version": "5.3.1",
   "description": "Automatically validate API requests and responses with OpenAPI 3 and Express.",
@@ -36,5 +36,5 @@ "main": "dist/index.js",
   "dependencies": {
-    "@apidevtools/json-schema-ref-parser": "^11.6.2",
+    "@apidevtools/json-schema-ref-parser": "^11.6.4",
     "@types/multer": "^1.4.11",
-    "ajv": "^8.14.0",
+    "ajv": "^8.15.0",
     "ajv-draft-04": "^1.0.0",
@@ -41,0 +41,0 @@ "ajv-formats": "^2.1.1",

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

368479

increased by0.77%

Lines of code

6265

increased by0.64%

Worsened metrics

Published versions last two months

5

decreased by-16.67%

Published versions last year

21

decreased by-4.55%

Dependency changes

• Updated@apidevtools/json-schema-ref-parser@^11.6.4

• Updatedajv@^8.15.0