Andrea Cosentino created CAMEL-25887:
----------------------------------------
Summary: camel-rest-openapi - option to restrict the external
references of the OpenAPI specification
Key: CAMEL-25887
URL: https://issues.apache.org/jira/browse/CAMEL-25887
Project: Camel
Issue Type: Improvement
Components: camel-openapi-java, camel-rest-openapi
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
{{RestOpenApiEndpoint.loadSpecificationFrom()}} parses the specification with
{{ParseOptions.setResolveFully(true)}}. swagger-parser then loads every
external {{$ref}} of the document when the consumer or producer is created:
absolute http(s) URLs (following up to five redirects), relative references
(against the working directory and then the classpath for a local
specification, or against the specification URL for a remote one) and absolute
file paths. The component has no option to restrict this, and the component
page does not mention it. The behaviour dates from 4.0 (CAMEL-18963); Camel 3
did not resolve references.
Since CAMEL-25747 the messages of the parser are logged as a WARN, so a
reference that could not be loaded is at least visible. The endpoint still
starts with the partially resolved model.
{{RestOpenApiReader}} in camel-openapi-java, which serves the specification of
a contract-first REST DSL as api-doc, parses it with
{{OpenAPIV3Parser.readContents(String)}}, whose defaults also resolve external
references.
Proposal:
# Add an option that restricts which external references the specification may
use, on the rest-openapi endpoint and component and on the {{openApi}} element
of the REST DSL, with the current behaviour as the default: {{all}} (default),
{{local}} (the classpath and the file system only, so no http(s) reference, and
no relative reference for a remote specification) and {{none}} (only {{#/...}}
references inside the document). A reference the option does not allow fails
the creation of the consumer or producer with a message that names it, instead
of a WARN and a partially resolved model.
# Apply the same option in {{RestOpenApiReader}} for the api-doc.
# Document the option on the component page and on the contract-first page of
the REST DSL.
Notes:
* swagger-parser's own {{ParseOptions.setSafelyResolveURL(true)}} (2.1.37 on
4.18.x, 2.1.45 on 4.22.x, 2.1.48 on main) is not a "local only" mode. For an
OpenAPI 3.0 document, {{ResolverCache.loadRef()}} checks the raw reference with
{{PermittedUrlsChecker.verify()}}, which rejects relative and file references
and only lets through http(s) URLs that resolve to public addresses or are on
the allow list. For an OpenAPI 3.1 document only
{{ReferenceVisitor.readHttp()}} is gated. And a rejected reference only becomes
a parser message. So the check is better done on the document before the parser
resolves it.
* Tests should cover OpenAPI 3.0 and 3.1 documents, a specification split over
several local files, and a remote reference.
_Claude Code on behalf of oscerd_
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
