Skip to content

Commit 13261d1

Browse files
k1LoWdaveshanley
k1LoW
authored and
daveshanley
committed
Raise an error if the securityScheme to be referenced does not exist.
1 parent 8287065 commit 13261d1

File tree

1 file changed

+83
-72
lines changed

1 file changed

+83
-72
lines changed

‎parameters/validate_security.go‎

Lines changed: 83 additions & 72 deletions
Original file line numberDiff line numberDiff line change
@@ -41,88 +41,99 @@ func (v *paramValidator) ValidateSecurity(request *http.Request) (bool, []*error
4141
secName := pair.Key()
4242

4343
// look up security from components
44+
if v.document.Components == nil || v.document.Components.SecuritySchemes.GetOrZero(secName) == nil {
45+
return false, []*errors.ValidationError{
46+
{
47+
Message: fmt.Sprintf("Security scheme '%s' is missing", secName),
48+
Reason: fmt.Sprintf("The security scheme '%s' is defined as being required, "+
49+
"however it's missing from the components", secName),
50+
ValidationType: "security",
51+
SpecLine: sec.GoLow().Requirements.ValueNode.Line,
52+
SpecCol: sec.GoLow().Requirements.ValueNode.Column,
53+
HowToFix: "Add the missing security scheme to the components",
54+
},
55+
}
56+
}
4457
secScheme := v.document.Components.SecuritySchemes.GetOrZero(secName)
45-
if secScheme != nil {
46-
switch strings.ToLower(secScheme.Type) {
47-
case "http":
48-
switch strings.ToLower(secScheme.Scheme) {
49-
case "basic", "bearer", "digest":
50-
// check for an authorization header
51-
if request.Header.Get("Authorization") == "" {
52-
return false, []*errors.ValidationError{
53-
{
54-
Message: fmt.Sprintf("Authorization header for '%s' scheme", secScheme.Scheme),
55-
Reason: "Authorization header was not found",
56-
ValidationType: "security",
57-
ValidationSubType: secScheme.Scheme,
58-
SpecLine: sec.GoLow().Requirements.ValueNode.Line,
59-
SpecCol: sec.GoLow().Requirements.ValueNode.Column,
60-
HowToFix: "Add an 'Authorization' header to this request",
61-
},
62-
}
58+
switch strings.ToLower(secScheme.Type) {
59+
case "http":
60+
switch strings.ToLower(secScheme.Scheme) {
61+
case "basic", "bearer", "digest":
62+
// check for an authorization header
63+
if request.Header.Get("Authorization") == "" {
64+
return false, []*errors.ValidationError{
65+
{
66+
Message: fmt.Sprintf("Authorization header for '%s' scheme", secScheme.Scheme),
67+
Reason: "Authorization header was not found",
68+
ValidationType: "security",
69+
ValidationSubType: secScheme.Scheme,
70+
SpecLine: sec.GoLow().Requirements.ValueNode.Line,
71+
SpecCol: sec.GoLow().Requirements.ValueNode.Column,
72+
HowToFix: "Add an 'Authorization' header to this request",
73+
},
6374
}
6475
}
76+
}
6577

66-
case "apikey":
67-
// check if the api key is in the request
68-
if secScheme.In == "header" {
69-
if request.Header.Get(secScheme.Name) == "" {
70-
return false, []*errors.ValidationError{
71-
{
72-
Message: fmt.Sprintf("API Key %s not found in header", secScheme.Name),
73-
Reason: "API Key not found in http header for security scheme 'apiKey' with type 'header'",
74-
ValidationType: "security",
75-
ValidationSubType: "apiKey",
76-
SpecLine: sec.GoLow().Requirements.ValueNode.Line,
77-
SpecCol: sec.GoLow().Requirements.ValueNode.Column,
78-
HowToFix: fmt.Sprintf("Add the API Key via '%s' as a header of the request", secScheme.Name),
79-
},
80-
}
78+
case "apikey":
79+
// check if the api key is in the request
80+
if secScheme.In == "header" {
81+
if request.Header.Get(secScheme.Name) == "" {
82+
return false, []*errors.ValidationError{
83+
{
84+
Message: fmt.Sprintf("API Key %s not found in header", secScheme.Name),
85+
Reason: "API Key not found in http header for security scheme 'apiKey' with type 'header'",
86+
ValidationType: "security",
87+
ValidationSubType: "apiKey",
88+
SpecLine: sec.GoLow().Requirements.ValueNode.Line,
89+
SpecCol: sec.GoLow().Requirements.ValueNode.Column,
90+
HowToFix: fmt.Sprintf("Add the API Key via '%s' as a header of the request", secScheme.Name),
91+
},
8192
}
8293
}
83-
if secScheme.In == "query" {
84-
if request.URL.Query().Get(secScheme.Name) == "" {
85-
copyUrl := *request.URL
86-
fixed := &copyUrl
87-
q := fixed.Query()
88-
q.Add(secScheme.Name, "your-api-key")
89-
fixed.RawQuery = q.Encode()
94+
}
95+
if secScheme.In == "query" {
96+
if request.URL.Query().Get(secScheme.Name) == "" {
97+
copyUrl := *request.URL
98+
fixed := &copyUrl
99+
q := fixed.Query()
100+
q.Add(secScheme.Name, "your-api-key")
101+
fixed.RawQuery = q.Encode()
90102

91-
return false, []*errors.ValidationError{
92-
{
93-
Message: fmt.Sprintf("API Key %s not found in query", secScheme.Name),
94-
Reason: "API Key not found in URL query for security scheme 'apiKey' with type 'query'",
95-
ValidationType: "security",
96-
ValidationSubType: "apiKey",
97-
SpecLine: sec.GoLow().Requirements.ValueNode.Line,
98-
SpecCol: sec.GoLow().Requirements.ValueNode.Column,
99-
HowToFix: fmt.Sprintf("Add an API Key via '%s' to the query string "+
100-
"of the URL, for example '%s'", secScheme.Name, fixed.String()),
101-
},
102-
}
103+
return false, []*errors.ValidationError{
104+
{
105+
Message: fmt.Sprintf("API Key %s not found in query", secScheme.Name),
106+
Reason: "API Key not found in URL query for security scheme 'apiKey' with type 'query'",
107+
ValidationType: "security",
108+
ValidationSubType: "apiKey",
109+
SpecLine: sec.GoLow().Requirements.ValueNode.Line,
110+
SpecCol: sec.GoLow().Requirements.ValueNode.Column,
111+
HowToFix: fmt.Sprintf("Add an API Key via '%s' to the query string "+
112+
"of the URL, for example '%s'", secScheme.Name, fixed.String()),
113+
},
103114
}
104115
}
105-
if secScheme.In == "cookie" {
106-
cookies := request.Cookies()
107-
cookieFound := false
108-
for _, cookie := range cookies {
109-
if cookie.Name == secScheme.Name {
110-
cookieFound = true
111-
break
112-
}
116+
}
117+
if secScheme.In == "cookie" {
118+
cookies := request.Cookies()
119+
cookieFound := false
120+
for _, cookie := range cookies {
121+
if cookie.Name == secScheme.Name {
122+
cookieFound = true
123+
break
113124
}
114-
if !cookieFound {
115-
return false, []*errors.ValidationError{
116-
{
117-
Message: fmt.Sprintf("API Key %s not found in cookies", secScheme.Name),
118-
Reason: "API Key not found in http request cookies for security scheme 'apiKey' with type 'cookie'",
119-
ValidationType: "security",
120-
ValidationSubType: "apiKey",
121-
SpecLine: sec.GoLow().Requirements.ValueNode.Line,
122-
SpecCol: sec.GoLow().Requirements.ValueNode.Column,
123-
HowToFix: fmt.Sprintf("Submit an API Key '%s' as a cookie with the request", secScheme.Name),
124-
},
125-
}
125+
}
126+
if !cookieFound {
127+
return false, []*errors.ValidationError{
128+
{
129+
Message: fmt.Sprintf("API Key %s not found in cookies", secScheme.Name),
130+
Reason: "API Key not found in http request cookies for security scheme 'apiKey' with type 'cookie'",
131+
ValidationType: "security",
132+
ValidationSubType: "apiKey",
133+
SpecLine: sec.GoLow().Requirements.ValueNode.Line,
134+
SpecCol: sec.GoLow().Requirements.ValueNode.Column,
135+
HowToFix: fmt.Sprintf("Submit an API Key '%s' as a cookie with the request", secScheme.Name),
136+
},
126137
}
127138
}
128139
}

0 commit comments

Comments
 (0)