Merge branch 'main' into dependabot/gradle/io.spring.dependency-management-1.1.6

Author: pboos

gradle/libs.versions.toml

@@ -1,23 +1,23 @@
 [versions]
-spring-boot = "3.3.0"
+spring-boot = "3.3.3"
 spring-dependency-management = "1.1.6"
 openapi-generator = "7.4.0"
 openapi-tools = "0.2.6"
 swagger = "2.2.22"
-swagger-request-validator = "2.40.0"
+swagger-request-validator = "2.41.0"
 jakarta-validation = "3.1.0"
-lombok = "1.18.32"
+lombok = "1.18.34"
 commons-codec = "1.17.0"
 find-bugs = "3.0.2"
 gradle-nexus-publish-plugin = "2.0.0"
-datadog-statsd = "4.4.0"
+datadog-statsd = "4.4.2"
 # Verify
 checkstyle = "8.44"
 pmd = "6.55.0"
 jacoco = "0.8.7"
 # Testing
 mockito = "5.12.0"
-junit-jupiter = "5.10.2"
+junit-jupiter = "5.11.0"
 
 [libraries]
 openapi-tools-jacksonDatabindNullable = { group = "org.openapitools", name = "jackson-databind-nullable", version.ref = "openapi-tools" }

openapi-validation-api/src/main/java/com/getyourguide/openapi/validation/api/selector/DefaultTrafficSelector.java

@@ -12,6 +12,7 @@ public class DefaultTrafficSelector implements TrafficSelector {
 
     private final double sampleRate;
     private final Set<String> excludedPaths;
+    private final Set<String> defaultExcludedPaths;
     private final List<ExcludedHeader> excludedHeaders;
     private final Boolean shouldFailOnRequestViolation;
     private final Boolean shouldFailOnResponseViolation;
@@ -28,6 +29,7 @@ public DefaultTrafficSelector(
         Boolean shouldFailOnResponseViolation
     ) {
         this.sampleRate = sampleRate;
+        this.defaultExcludedPaths = Set.of("/graphql", "/graphiql");
         this.excludedPaths = excludedPaths != null ? excludedPaths : Set.of();
         this.excludedHeaders = excludedHeaders != null ? excludedHeaders : Collections.emptyList();
         this.shouldFailOnRequestViolation = shouldFailOnRequestViolation != null ? shouldFailOnRequestViolation : false;
@@ -82,7 +84,8 @@ private boolean isRequestExcludedByHeader(RequestMetaData request) {
     }
 
     private boolean isRequestExcludedByPath(RequestMetaData request) {
-        return excludedPaths.contains(request.getUri().getPath());
+        var path = request.getUri().getPath();
+        return defaultExcludedPaths.contains(path) || excludedPaths.contains(path);
     }
 
     private static boolean methodEquals(String method, String expectedMethod) {

openapi-validation-api/src/test/java/com/getyourguide/openapi/validation/api/selector/DefaultTrafficSelectorTest.java

@@ -31,11 +31,18 @@ public void testIsExcludedByHeaderPattern() {
 
         assertHeaderIsExcluded(true, "x-is-bot", "true");
         assertHeaderIsExcluded(false, "x-is-bot", "truebot");
+    }
+
+    @Test
+    public void testIsExcludedByPath() {
+        // Default exclusions
+        assertPathIsExcluded(true, "/graphql");
+        assertPathIsExcluded(true, "/graphiql");
 
+        assertPathIsExcluded(false, "/v1/path");
     }
 
     private void assertHeaderIsExcluded(boolean expectedExclusion, String headerName, String headerValue) {
-
         var request = new RequestMetaData(
             "GET",
             URI.create("https://api.example.com/v1/path"),
@@ -48,6 +55,15 @@ private void assertHeaderIsExcluded(boolean expectedExclusion, String headerName
         assertEquals(!expectedExclusion, trafficSelector.shouldRequestBeValidated(request));
     }
 
+    private void assertPathIsExcluded(boolean expectedExclusion, String path) {
+        var request = new RequestMetaData(
+            "GET",
+            URI.create("https://api.example.com" + path),
+            Map.of("Content-Type", "application/json")
+        );
+        assertEquals(!expectedExclusion, trafficSelector.shouldRequestBeValidated(request));
+    }
+
     private Map<String, String> toCaseInsensitiveMap(Map<String, String> map) {
         var newMap = new TreeMap<String, String>(String.CASE_INSENSITIVE_ORDER);
         newMap.putAll(map);