fix: validate discriminated oneOf schemas against only the branch selected by the discriminator in the drift command#2957
Conversation
…ected by the discriminator in the drift command
🦋 Changeset detectedLatest commit: df2eb9a The changes in this PR will be included in the next version bump. This PR includes changesets to release 3 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Coverage Report
File Coverage
|
||||||||||||||||||||||||||||||||||||||||||||
Performance Benchmark (Lower is Faster)
|
|
@cursor review |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit ce416ab. Configure here.
Co-authored-by: Jacek Łękawa <164185257+JLekawa@users.noreply.github.com>
| // Ajv rejects loosely defined discriminators at compile time (for example | ||
| // when the tag property has no `const`/`enum` or is not required); such | ||
| // schemas fall back to being validated against every oneOf branch. | ||
| this.fallbackAjv = new AjvConstructor({ ...ajvOptions, discriminator: false }); |
There was a problem hiding this comment.
How does the lint handle this case? i cant find any fallback
There was a problem hiding this comment.
Lint doesn't have a fallback — it just reports that Ajv couldn't compile the schema (the try/catch is in validateExample in packages/core/src/rules/utils.ts), which is fair there, since it points to an issue in the OAD itself. Drift is a different story. Lint only compiles a schema when it has an example attached, so even a spec with no lint issues can contain a loose discriminator. Without the fallback, drift would then report "Schema compilation failed" for every exchange hitting that schema — errors about perfectly valid traffic. The fallback is used in compileSchema() at the bottom of this file: if the strict instance throws, the schema is recompiled with discriminator: false, which validates against every oneOf branch — same as drift did before this PR.
3 participants
What/Why/How?
Fix for handling
oneOfschemas with adiscriminatorinsidedriftcommand. Extended list of well known headers from 3rd party providers.Reference
Testing
Screenshots (optional)
Check yourself
Security
Note
Medium Risk
Changes drift reporting for body/schema and header checks; incorrect discriminator handling could hide real issues, though loose schemas keep the prior fallback path.
Overview
Fixes false-positive
schema-consistencyfindings when payloads useoneOfwith adiscriminator.SchemaValidatorturns on Ajv’sdiscriminator: trueso traffic is checked against the branch implied by the discriminator value, not every branch. Schemas Ajv cannot compile for discriminator rules still use a second Ajv instance (discriminator: false) so behavior matches the old “validate all branches” approach.Separately, the drift command’s default undocumented-header allowlist grows:
x-amzn-*,x-github-*, andx-hub-signature/x-hub-signature-256(replacing a singlex-amzn-trace-identry with the prefix rule). Tests cover both areas.Reviewed by Cursor Bugbot for commit df2eb9a. Bugbot is set up for automated code reviews on this repo. Configure here.