[dependabot]

Bumps the dependencies group with 1 update in the / directory: github.com/oapi-codegen/oapi-codegen/v2.

Updates github.com/oapi-codegen/oapi-codegen/v2 from 2.8.1 to 2.8.2

Release notes

Sourced from github.com/oapi-codegen/oapi-codegen/v2's releases.

v2.8.2: Security fixes for code generation

🎉 Notable changes

This is a security release on top of v2.8.1. It addresses two further security findings reported against oapi-codegen, both in code generation:

• A schema name could inject Go code through the implicit discriminator mapping of a oneOf/anyOf
• A whole-document external $ref could inject Go code through the property names of the inlined document

Both only matter when you generate code from a specification, or a document it references, that you do not control. Thanks to @​manus-use for reporting them.

Implicit discriminator mapping keys are validated

When a discriminated oneOf or anyOf lists a $ref variant that the mapping does not name, the generator maps it under the schema's name and writes that name into the generated ValueByDiscriminator switch. Explicit mapping keys were already checked, but the implicit ones were not, and a schema name is otherwise allowed to contain quotes. The derived key is now validated like an explicit one, including when the union is assembled by an allOf merge from a member holding the variants and another holding the discriminator, and a backslash is now rejected in any mapping key, since it would start an escape sequence in the generated case label. A null-typed branch, which the generator skips as a nullability marker, is left alone.

The contents of whole-document $refs are validated

A $ref without a fragment, such as $ref: ./other.yaml, has no name the generated code could refer to, so the generator inlines the referenced document as if it were written in place. Spec validation stopped at every $ref on the assumption that external content is never copied into the output, so the property names, parameter names and header names of such a document reached struct tags and string literals unchecked. The validator now walks a whole-document reference's contents for schemas, parameters, request bodies, responses, headers and callbacks, visiting each document once. References with a fragment are still not followed, and a document replaced by an x-go-type override is not walked either, since none of it reaches the generated code.

As with v2.8.1, valid specifications generate byte-for-byte the same code as before; a specification that would have produced code it had no business producing is now rejected with an error that points at the offending value.

🐛 Bug fixes

• Validate implicit discriminator mapping keys and the contents of whole-document $refs (2.8.x backport) (#2649) @​mromaszewicz

Sponsors

We would like to thank our sponsors for their support during this release.

We'd also like to thank Greptile for allowing our project to use their code review system.

Commits

• a2b197f Validate implicit discriminator mapping keys and the contents of whole-docume...
• See full diff in compare view