Skip to content

fix: normalize raw local path base URI for OpenAPI 3.1 ref resolution (#2365)#2366

Open
seonwooj0810 wants to merge 1 commit into
swagger-api:masterfrom
seonwooj0810:fix/issue-2365-raw-path-with-spaces-uri
Open

fix: normalize raw local path base URI for OpenAPI 3.1 ref resolution (#2365)#2366
seonwooj0810 wants to merge 1 commit into
swagger-api:masterfrom
seonwooj0810:fix/issue-2365-raw-path-with-spaces-uri

Conversation

@seonwooj0810

Copy link
Copy Markdown

Fixes #2365

Root cause

OpenAPIV3Parser.readLocation(...) accepts a raw local filesystem path, and that path becomes the base URI for OpenAPI 3.1 reference resolution. Resolution then builds java.net.URI instances from the base in several places (ReferenceUtils.resolve/toBaseURI and Visitor#readURI). When the raw path contains a character that is illegal in a URI — most commonly a space — those new URI(...) calls throw URISyntaxException: Illegal character in path. The exception is caught in ReferenceVisitor and recorded as a parse message, so a self-contained single-file spec resolving same-file refs (e.g. #/components/responses/...) returns a result polluted with an Illegal character in path error.

Fix

Normalize the location once, at the entry to resolve(...): if the location is not already a valid URI, convert it to a proper file: URI via Paths.get(location).toUri() so the base is URI-safe everywhere downstream. Locations that already parse as a URI (including scheme-less relative paths without illegal characters) are left untouched, so existing behavior is unchanged.

Test evidence

Added a regression test OpenAPIV31RawPathWithSpacesTest#resolveSameFileReferenceFromRawPathWithSpaces that writes a single-file 3.1 spec with same-file response/schema $refs into a temp directory whose path contains spaces and asserts the parse result carries no Illegal character in path message. It fails before the change (Illegal character in path at index 12: ...) and passes after.

Verification done: full swagger-parser-v3 module test suite green (584 + 25 tests, 0 failures) with the fix; the new regression test fails before / passes after. (The safe-url-resolver module has pre-existing JDK 25 mock failures unrelated to this change.)

A raw local filesystem path accepted by OpenAPIV3Parser.readLocation is used
as the base URI for reference resolution, where ReferenceUtils and
Visitor#readURI build java.net.URI instances from it. A path containing
characters illegal in a URI (most commonly a space) makes those
constructions throw "Illegal character in path", which surfaces as a parse
error even for a self-contained single-file spec resolving same-file refs.

Normalize the location to a proper file: URI when it is not already a valid
URI, so the base is URI-safe everywhere downstream. Valid URIs (including
scheme-less relative paths) are left untouched.

Fixes swagger-api#2365

Signed-off-by: seonwoo_jung <79202163+seonwooj0810@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: OpenAPI 3.1 same-file $ref resolution reports illegal path when raw local path contains spaces

1 participant