[
https://issues.apache.org/jira/browse/CAMEL-25887?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on CAMEL-25887 started by Andrea Cosentino.
------------------------------------------------
> camel-rest-openapi - option to restrict the external references of the
> OpenAPI specification
> --------------------------------------------------------------------------------------------
>
> Key: CAMEL-25887
> URL: https://issues.apache.org/jira/browse/CAMEL-25887
> Project: Camel
> Issue Type: Improvement
> Components: camel-openapi-java, camel-rest-openapi
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
>
> {{RestOpenApiEndpoint.loadSpecificationFrom()}} parses the specification with
> {{ParseOptions.setResolveFully(true)}}. swagger-parser then loads every
> external {{$ref}} of the document when the consumer or producer is created:
> absolute http(s) URLs (following up to five redirects), relative references
> (against the working directory and then the classpath for a local
> specification, or against the specification URL for a remote one) and
> absolute file paths. The component has no option to restrict this, and the
> component page does not mention it. The behaviour dates from 4.0
> (CAMEL-18963); Camel 3 did not resolve references.
> Since CAMEL-25747 the messages of the parser are logged as a WARN, so a
> reference that could not be loaded is at least visible. The endpoint still
> starts with the partially resolved model.
> {{RestOpenApiReader}} in camel-openapi-java, which serves the specification
> of a contract-first REST DSL as api-doc, parses it with
> {{OpenAPIV3Parser.readContents(String)}}, whose defaults also resolve
> external references.
> Proposal:
> # Add an option that restricts which external references the specification
> may use, on the rest-openapi endpoint and component and on the {{openApi}}
> element of the REST DSL, with the current behaviour as the default: {{all}}
> (default), {{local}} (the classpath and the file system only, so no http(s)
> reference, and no relative reference for a remote specification) and {{none}}
> (only {{#/...}} references inside the document). A reference the option does
> not allow fails the creation of the consumer or producer with a message that
> names it, instead of a WARN and a partially resolved model.
> # Apply the same option in {{RestOpenApiReader}} for the api-doc.
> # Document the option on the component page and on the contract-first page of
> the REST DSL.
> Notes:
> * swagger-parser's own {{ParseOptions.setSafelyResolveURL(true)}} (2.1.37 on
> 4.18.x, 2.1.45 on 4.22.x, 2.1.48 on main) is not a "local only" mode. For an
> OpenAPI 3.0 document, {{ResolverCache.loadRef()}} checks the raw reference
> with {{PermittedUrlsChecker.verify()}}, which rejects relative and file
> references and only lets through http(s) URLs that resolve to public
> addresses or are on the allow list. For an OpenAPI 3.1 document only
> {{ReferenceVisitor.readHttp()}} is gated. And a rejected reference only
> becomes a parser message. So the check is better done on the document before
> the parser resolves it.
> * Tests should cover OpenAPI 3.0 and 3.1 documents, a specification split
> over several local files, and a remote reference.
> _Claude Code on behalf of oscerd_
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
