Added base path stripping for the request path during path parameter validation

Author: jacobm-splunk

parameters/path_parameters.go

@@ -33,16 +33,16 @@ func (v *paramValidator) ValidatePathParams(request *http.Request) (bool, []*err
 		foundPath = v.pathValue
 	}
 
+	// split the path into segments
+	submittedSegments := strings.Split(paths.StripRequestPath(request, v.document), helpers.Slash)
+	pathSegments := strings.Split(foundPath, helpers.Slash)
+
 	// extract params for the operation
 	var params = helpers.ExtractParamsForOperation(request, pathItem)
 	var validationErrors []*errors.ValidationError
 	for _, p := range params {
 		if p.In == helpers.Path {
 
-			// split the path into segments
-			submittedSegments := strings.Split(request.URL.Path, helpers.Slash)
-			pathSegments := strings.Split(foundPath, helpers.Slash)
-
 			// var paramTemplate string
 			for x := range pathSegments {
 				if pathSegments[x] == "" { // skip empty segments

parameters/path_parameters_test.go

@@ -1403,3 +1403,37 @@ paths:
 	assert.Equal(t, "Path parameter 'burgerId' does not match allowed values", errors[0].Message)
 	assert.Equal(t, "Instead of '22334', use one of the allowed values: '1, 2, 99, 100'", errors[0].HowToFix)
 }
+
+func TestNewValidator_FillInThis(t *testing.T) {
+
+	spec := `openapi: 3.1.0
+servers:
+  - url: https://api.pb33f.io/lorem/ipsum
+    description: Live production endpoint for general use.
+paths:
+  /burgers/{burger}/locate:
+    parameters:
+      - name: burger
+        in: path
+        schema:
+          type: object
+          properties:
+            id:
+               type: integer
+            vegetarian:
+               type: boolean
+    get:
+      operationId: locateBurger`
+
+	doc, _ := libopenapi.NewDocument([]byte(spec))
+
+	m, _ := doc.BuildV3Model()
+
+	v := NewParameterValidator(&m.Model)
+
+	request, _ := http.NewRequest(http.MethodGet, "https://things.com/lorem/ipsum/burgers/id,1234,vegetarian,true/locate", nil)
+	valid, errors := v.ValidatePathParams(request)
+
+	assert.True(t, valid)
+	assert.Len(t, errors, 0)
+}

paths/paths.go

@@ -24,20 +24,8 @@ import (
 func FindPath(request *http.Request, document *v3.Document) (*v3.PathItem, []*errors.ValidationError, string) {
 	var validationErrors []*errors.ValidationError
 
-	// extract base path from document to check against paths.
-	var basePaths []string
-	for _, s := range document.Servers {
-		u, _ := url.Parse(s.URL)
-		if u != nil && u.Path != "" {
-			basePaths = append(basePaths, u.Path)
-		}
-	}
-
-	// strip any base path
-	stripped := stripBaseFromPath(request.URL.Path, basePaths)
-	if request.URL.Fragment != "" {
-		stripped = fmt.Sprintf("%s#%s", stripped, request.URL.Fragment)
-	}
+	basePaths := getBasePaths(request, document)
+	stripped := StripRequestPath(request, document)
 
 	reqPathSegments := strings.Split(stripped, "/")
 	if reqPathSegments[0] == "" {
@@ -205,6 +193,32 @@ pathFound:
 	}
 }
 
+func getBasePaths(request *http.Request, document *v3.Document) []string {
+	// extract base path from document to check against paths.
+	var basePaths []string
+	for _, s := range document.Servers {
+		u, _ := url.Parse(s.URL)
+		if u != nil && u.Path != "" {
+			basePaths = append(basePaths, u.Path)
+		}
+	}
+
+	return basePaths
+}
+
+// StripRequestPath strips the base path from the request path, based on the server paths provided in the specification
+func StripRequestPath(request *http.Request, document *v3.Document) string {
+
+	basePaths := getBasePaths(request, document)
+
+	// strip any base path
+	stripped := stripBaseFromPath(request.URL.Path, basePaths)
+	if request.URL.Fragment != "" {
+		stripped = fmt.Sprintf("%s#%s", stripped, request.URL.Fragment)
+	}
+	return stripped
+}
+
 func checkPathAgainstBase(docPath, urlPath string, basePaths []string) bool {
 	if docPath == urlPath {
 		return true