IBM/openapi-validator

Items property is not validated properly for arrays

Closed this issue ยท 4 comments

TL;DR;

Array items validation gives false positives for certain inputs.

Extended version

Our team spotted a false positive in array properties validation.

Given a property in a schema with type: array, the validator demands that the items property is set and it's value must be of type object.
So far, so good. The problem arises when something that has a typeof items === 'object' comes to play. And for javascript, an array is an object.

Therefore, the following is being reported as valid when it's not:

components:
  schemas:
    MySchema:
      type: array
      items:
        - type: string

I have already located the bug and if your good with it I can send a PR.

Inspecting the code a little bit more I found more than a dozen of places where objects are not validated properly.

I'm thinking in making a isObject utility and patching everywhere.

@jormaechea Thanks for reporting - those bugs are tricky to spot sometimes. We would absolutely welcome a PR to resolve!

@dpopp07 you can close this whenever you want! ๐Ÿš€

Resolved in #242