[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/oapi-codegen/oapi-codegen/v2	v2.8.0 → v2.8.2

---

Release Notes

oapi-codegen/oapi-codegen (github.com/oapi-codegen/oapi-codegen/v2)

v2.8.2: : Security fixes for code generation

Compare Source

🎉 Notable changes

This is a security release on top of v2.8.1. It addresses two further security findings reported against oapi-codegen, both in code generation:

• A schema name could inject Go code through the implicit discriminator mapping of a oneOf/anyOf
• A whole-document external $ref could inject Go code through the property names of the inlined document

Both only matter when you generate code from a specification, or a document it references, that you do not control. Thanks to @​manus-use for reporting them.

Implicit discriminator mapping keys are validated

When a discriminated oneOf or anyOf lists a $ref variant that the mapping does not name, the generator maps it under the schema's name and writes that name into the generated ValueByDiscriminator switch. Explicit mapping keys were already checked, but the implicit ones were not, and a schema name is otherwise allowed to contain quotes. The derived key is now validated like an explicit one, including when the union is assembled by an allOf merge from a member holding the variants and another holding the discriminator, and a backslash is now rejected in any mapping key, since it would start an escape sequence in the generated case label. A null-typed branch, which the generator skips as a nullability marker, is left alone.

The contents of whole-document $refs are validated

A $ref without a fragment, such as $ref: ./other.yaml, has no name the generated code could refer to, so the generator inlines the referenced document as if it were written in place. Spec validation stopped at every $ref on the assumption that external content is never copied into the output, so the property names, parameter names and header names of such a document reached struct tags and string literals unchecked. The validator now walks a whole-document reference's contents for schemas, parameters, request bodies, responses, headers and callbacks, visiting each document once. References with a fragment are still not followed, and a document replaced by an x-go-type override is not walked either, since none of it reaches the generated code.

As with v2.8.1, valid specifications generate byte-for-byte the same code as before; a specification that would have produced code it had no business producing is now rejected with an error that points at the offending value.

🐛 Bug fixes

• Validate implicit discriminator mapping keys and the contents of whole-document $refs (2.8.x backport) (#​2649) @​mromaszewicz

Sponsors

We would like to thank our sponsors for their support during this release.

We'd also like to thank Greptile for allowing our project to use their code review system.

v2.8.1: : Security fixes for codegen and at runtime

Compare Source

🎉 Notable changes

This is a security release on top of v2.8.0. It addresses five security findings reported against oapi-codegen:

• Strict servers could bind a different request body than the one the validation middleware checked (runtime behaviour of generated servers)
• Remote $refs in an untrusted specification could make the generator issue requests to arbitrary hosts (code generation)
• An operationId could inject Go code through the Echo per-operation middleware key (code generation)
• A request body content type could inject Go code through the webhook and callback initiators (code generation)
• Server x-go-name, server variables and non-string enum values could inject Go code (code generation)

Four of the five only matter when you generate code from a specification you do not control. The first one affects running servers, so please upgrade the generated code and the oapi-codegen/runtime and validation middleware modules together, as described below.

Allow-listing the remote documents a specification may reference

oapi-codegen resolves external $refs while it loads a specification. Until now it fetched any http(s) URL a document named, so a specification written by someone else could make the generator reach any host the build machine can see.

There is a new top-level configuration option, allow-remote-refs-from. Each entry is the URL of a referenced document exactly as it appears in the $ref, without the #... fragment, or "*" to allow any URL:

allow-remote-refs-from:
  - https://raw.githubusercontent.com/example/specs/main/common.yaml

For compatibility, this release defaults the option to "*" when it is omitted, so existing configurations keep working unchanged. The next minor release will default to refusing remote references. If your specification downloads other documents at generation time, tighten this now by listing them, or set the option to [] to refuse them all.

Better still, for reproducible builds, download the specifications you depend on, commit them next to your own, and reference them by relative path. References to local files are always followed, with no allow-listing involved, and your generated code no longer depends on a remote host being up and unchanged.

Strict servers bind the value the validation middleware validated

A validation middleware decodes the JSON request body to validate it, and the generated strict server then decoded it a second time. encoding/json matches member names case-insensitively, so a body such as

{"role": "user", "ROLE": "admin"}

validates as role: user but was bound as Role: "admin", bypassing the schema's constraints.

Strict servers for every supported framework now bind the value the middleware already validated, with exact member-name matching, and only fall back to decoding the body themselves when no validated value is present. For the fix to take effect you need all three of:

• code generated with this release;
• github.com/oapi-codegen/runtime v1.8.0 or later;
• a validation middleware that keeps the validated value, which the following versions do by default:
  • github.com/oapi-codegen/nethttp-middleware v1.3.1
  • github.com/oapi-codegen/echo-middleware v1.2.1
  • github.com/oapi-codegen/echo-v5-middleware v0.2.1
  • github.com/oapi-codegen/gin-middleware v1.2.1
  • github.com/oapi-codegen/iris-middleware v1.2.1
  • github.com/oapi-codegen/fiber-middleware v1.3.0
  • github.com/oapi-codegen/fiber-v3-middleware v0.3.0

Without them the generated code behaves as before, so the upgrade is safe to roll out in any order, but the fix is only in effect once all three are updated.

Fewer specification strings reach the generated code unescaped

Every string that the generator copies from a specification into Go source is now either emitted through strconv.Quote or checked before generation: content types in the webhook and callback initiators, the Echo per-operation middleware key, security scopes, non-string enum values (which must now be number or boolean literals), response status keys, component names, response header styles, and, when server-urls is enabled, server names, variables and their enum values. Valid specifications generate byte-for-byte the same code as before; a specification that would have produced code it had no business producing is now rejected with an error that points at the offending value.

🐛 Bug fixes

• Quote or validate every spec string that reaches generated Go source (2.8.x backport) (#​2626) @​mromaszewicz
• Apply the allow-remote-refs-from "*" default to the loader used after an overlay (2.8.x) (#​2624) @​mromaszewicz
• Refuse remote $refs unless their host is in allow-remote-refs-from (2.8.x backport, default "*") (#​2623) @​mromaszewicz
• Bind the validated request body value in all strict servers (2.8.x backport) (#​2621) @​mromaszewicz

Sponsors

We would like to thank our sponsors for their support during this release.

We'd also like to thank Greptile for allowing our project to use their code review system.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.