Skip to content

Harden parsing of [Range] attribute values #59043

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Nov 20, 2024
Merged

Harden parsing of [Range] attribute values #59043

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 17 additions & 2 deletions src/OpenApi/src/Extensions/JsonNodeSchemaExtensions.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,8 +91,23 @@ internal static void ApplyValidationAttributes(this JsonNode schema, IEnumerable
}
else if (attribute is RangeAttribute rangeAttribute)
{
schema[OpenApiSchemaKeywords.MinimumKeyword] = decimal.Parse(rangeAttribute.Minimum.ToString()!, CultureInfo.InvariantCulture);
schema[OpenApiSchemaKeywords.MaximumKeyword] = decimal.Parse(rangeAttribute.Maximum.ToString()!, CultureInfo.InvariantCulture);
// Use InvariantCulture if explicitly requested or if the range has been set via the
// RangeAttribute(double, double) or RangeAttribute(int, int) constructors.
var targetCulture = rangeAttribute.ParseLimitsInInvariantCulture || rangeAttribute.Minimum is double || rangeAttribute.Maximum is int
? CultureInfo.InvariantCulture
: CultureInfo.CurrentCulture;

var minString = rangeAttribute.Minimum.ToString();
var maxString = rangeAttribute.Maximum.ToString();

if (decimal.TryParse(minString, NumberStyles.Any, targetCulture, out var minDecimal))
{
schema[OpenApiSchemaKeywords.MinimumKeyword] = minDecimal;
}
if (decimal.TryParse(maxString, NumberStyles.Any, targetCulture, out var maxDecimal))
{
schema[OpenApiSchemaKeywords.MaximumKeyword] = maxDecimal;
}
}
else if (attribute is RegularExpressionAttribute regularExpressionAttribute)
{
Expand Down
60 changes: 60 additions & 0 deletions ...Core.OpenApi.Tests/Services/OpenApiSchemaService/OpenApiSchemaService.ParameterSchemas.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,12 @@

using System.ComponentModel;
using System.ComponentModel.DataAnnotations;
using System.Globalization;
using System.Text.Json;
using System.Text.Json.Serialization;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.InternalTesting;
using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Routing;
using Microsoft.Extensions.DependencyInjection;
Expand Down Expand Up @@ -338,6 +340,7 @@ await VerifyOpenApiDocument(action, document =>
[([MinLength(2)] int[] id) => {}, (OpenApiSchema schema) => Assert.Equal(2, schema.MinItems)],
[([Length(4, 8)] int[] id) => {}, (OpenApiSchema schema) => { Assert.Equal(4, schema.MinItems); Assert.Equal(8, schema.MaxItems); }],
[([Range(4, 8)]int id) => {}, (OpenApiSchema schema) => { Assert.Equal(4, schema.Minimum); Assert.Equal(8, schema.Maximum); }],
[([Range(typeof(DateTime), "2024-02-01", "2024-02-031")] DateTime id) => {}, (OpenApiSchema schema) => { Assert.Null(schema.Minimum); Assert.Null(schema.Maximum); }],
[([StringLength(10)] string name) => {}, (OpenApiSchema schema) => { Assert.Equal(10, schema.MaxLength); Assert.Equal(0, schema.MinLength); }],
[([StringLength(10, MinimumLength = 5)] string name) => {}, (OpenApiSchema schema) => { Assert.Equal(10, schema.MaxLength); Assert.Equal(5, schema.MinLength); }],
[([Url] string url) => {}, (OpenApiSchema schema) => { Assert.Equal("string", schema.Type); Assert.Equal("uri", schema.Format); }],
Expand Down Expand Up @@ -365,6 +368,63 @@ await VerifyOpenApiDocument(builder, document =>
});
}

public static object[][] RouteParametersWithRangeAttributes =>
[
[([Range(4, 8)] int id) => {}, (OpenApiSchema schema) => { Assert.Equal(4, schema.Minimum); Assert.Equal(8, schema.Maximum); }],
[([Range(int.MinValue, int.MaxValue)] int id) => {}, (OpenApiSchema schema) => { Assert.Equal(int.MinValue, schema.Minimum); Assert.Equal(int.MaxValue, schema.Maximum); }],
[([Range(0, double.MaxValue)] double id) => {}, (OpenApiSchema schema) => { Assert.Equal(0, schema.Minimum); Assert.Null(schema.Maximum); }],
[([Range(typeof(double), "0", "1.79769313486232E+308")] double id) => {}, (OpenApiSchema schema) => { Assert.Equal(0, schema.Minimum); Assert.Null(schema.Maximum); }],
[([Range(typeof(long), "-9223372036854775808", "9223372036854775807")] long id) => {}, (OpenApiSchema schema) => { Assert.Equal(long.MinValue, schema.Minimum); Assert.Equal(long.MaxValue, schema.Maximum); }],
[([Range(typeof(DateTime), "2024-02-01", "2024-02-031")] DateTime id) => {}, (OpenApiSchema schema) => { Assert.Null(schema.Minimum); Assert.Null(schema.Maximum); }],
];

[Theory]
[MemberData(nameof(RouteParametersWithRangeAttributes))]
public async Task GetOpenApiParameters_HandlesRouteParametersWithRangeAttributes(Delegate requestHandler, Action<OpenApiSchema> verifySchema)
{
// Arrange
var builder = CreateBuilder();

// Act
builder.MapGet("/api/{id}", requestHandler);

// Assert
await VerifyOpenApiDocument(builder, document =>
{
var operation = document.Paths["/api/{id}"].Operations[OperationType.Get];
var parameter = Assert.Single(operation.Parameters);
verifySchema(parameter.Schema);
});
}

public static object[][] RouteParametersWithRangeAttributes_CultureInfo =>
[
[([Range(typeof(DateTime), "2024-02-01", "2024-02-031")] DateTime id) => {}, (OpenApiSchema schema) => { Assert.Null(schema.Minimum); Assert.Null(schema.Maximum); }],
[([Range(typeof(decimal), "1,99", "3,99")] decimal id) => {}, (OpenApiSchema schema) => { Assert.Equal(1.99m, schema.Minimum); Assert.Equal(3.99m, schema.Maximum); }],
[([Range(typeof(decimal), "1,99", "3,99", ParseLimitsInInvariantCulture = true)] decimal id) => {}, (OpenApiSchema schema) => { Assert.Equal(199, schema.Minimum); Assert.Equal(399, schema.Maximum); }],
[([Range(1000, 2000)] int id) => {}, (OpenApiSchema schema) => { Assert.Equal(1000, schema.Minimum); Assert.Equal(2000, schema.Maximum); }]
];

[Theory]
[MemberData(nameof(RouteParametersWithRangeAttributes_CultureInfo))]
[UseCulture("fr-FR")]
public async Task GetOpenApiParameters_HandlesRouteParametersWithRangeAttributes_CultureInfo(Delegate requestHandler, Action<OpenApiSchema> verifySchema)
{
// Arrange
var builder = CreateBuilder();

// Act
builder.MapGet("/api/{id}", requestHandler);

// Assert
await VerifyOpenApiDocument(builder, document =>
{
var operation = document.Paths["/api/{id}"].Operations[OperationType.Get];
var parameter = Assert.Single(operation.Parameters);
verifySchema(parameter.Schema);
});
}

[Fact]
public async Task GetOpenApiParameters_HandlesParametersWithRequiredAttribute()
{
Expand Down
Loading