`OpenAPIParser::SchemaValidator.validate` ignores `type`/`$ref` in `additionalProperties`

[kbarry-aurora]

Also see https://github.com/OAI/OpenAPI-Specification/blob/main/versions/3.0.0.md#model-with-mapdictionary-properties.

Example:

spec = <<~YAML
  openapi: 3.0.0
  components:
    schemas:
      Object:
        type: object
        additionalProperties:
          type: string
YAML
payload = {
  "abc" => "123",
  "def" => 456
}
schemas = OpenAPIParser.parse(
  YAML.load(spec),
  strict_reference_validation: true
).components.schemas

### This should raise an exception due to "def" not being a string. ###
OpenAPIParser::SchemaValidator.validate(
  payload,
  schemas["Object"],
  OpenAPIParser::SchemaValidator::Options.new(coerce_value: false)
)

Thanks!

[geemus]

@kbarry-aurora Thanks for the detailed report and reproducible case.

From digging into the code it looks like this remains as a todo, skipping any real validation, as per this comment:

openapi_parser/lib/openapi_parser/schema_validator/object_validator.rb

Lines 33 to 35 in 1a3890c

	# TODO: we need to perform a validation based on schema.additional_properties here, if
	# additionalProperties are defined
	[v, nil]

So it looks like there would be some work to do in order to add this. Would you be interested in attempting to address this with whatever guidance I can provide? Thanks.

[kbarry-aurora]

The following change seems to fix the issue and also preserve the true/false cases:

diff --git a/lib/openapi_parser/schema_validator/object_validator.rb b/lib/openapi_parser/schema_validator/object_validator.rb
index 230b65f..af519cb 100644
--- a/lib/openapi_parser/schema_validator/object_validator.rb
+++ b/lib/openapi_parser/schema_validator/object_validator.rb
@@ -10,6 +10,7 @@ class OpenAPIParser::SchemaValidator
       return OpenAPIParser::ValidateError.build_error_result(value, schema) unless value.kind_of?(Hash)

       properties = schema.properties || {}
+      additional_properties = schema.additional_properties

       required_set = schema.required ? schema.required.to_set : Set.new
       remaining_keys = value.keys
@@ -29,9 +30,10 @@ class OpenAPIParser::SchemaValidator
         coerced, err = if s
                          remaining_keys.delete(name)
                          validatable.validate_schema(v, s)
+                       elsif additional_properties.is_a? OpenAPIParser::Schemas::Schema
+                         remaining_keys.delete(name)
+                         validatable.validate_schema(v, additional_properties)
                        else
-                         # TODO: we need to perform a validation based on schema.additional_properties here, if
-                         # additionalProperties are defined
                          [v, nil]
                        end

@@ -43,7 +45,7 @@ class OpenAPIParser::SchemaValidator

       remaining_keys.delete(discriminator_property_name) if discriminator_property_name

-      if !remaining_keys.empty? && !parent_all_of && !schema.additional_properties
+      if !remaining_keys.empty? && !parent_all_of && !additional_properties
         # If object is nested in all of, the validation is already done in allOf validator. Or if
         # additionalProperties are defined, we will validate using that
         return [nil, OpenAPIParser::NotExistPropertyDefinition.new(remaining_keys, schema.object_reference)]

Sorry, I'm having some trouble getting the repo set up for testing.

[geemus]

@kbarry-aurora - thanks for taking a look. I think #187 should fix this, though I allowed it to skip the validation in allOf cases, as it seems poorly defined what the behavior should actually be there (and it would seemed painful/complicated to try to fix). For that case it falls back to the old behavior, so it should be no-worse anyway.

Could you check that and see if it fixes the problem for you? Tests appear to pass for me locally at least, so if that looks good for you we are hopefully good for now. Thanks!

[kbarry-aurora]

LGTM. Thanks!

[geemus]

released in 2.3.0

[kbarry-aurora]

I updated to 2.3.0 and everything works as expected. Thanks!