OpenAPITools / OpenAPITools/openapi-generator
[BUG][ruby] config shared across instances
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 26.8k
- Forks
- 7.7k
- PR merge metrics
- PR metrics pending
Description
Description
In the ruby generator, config is shared across all instances. For example, setting config.api_key on one, changes it for all others as well.
This may be a security issue if separate instances are used to authenticate with different credentials.
openapi-generator version
7.19.0-SNAPSHOT
Steps to reproduce
$ git clone https://github.com/OpenAPITools/openapi-generator.git --depth 1
$ cd openapi-generator/samples/client/petstore/ruby
$ bundle install
$ irb -Ilib
irb(main):001> require 'petstore'
irb(main):002> client1 = Petstore::ApiClient.new
irb(main):003> client2 = Petstore::ApiClient.new
irb(main):004> client1.config.api_key
=> {}
irb(main):005> client2.config.api_key
=> {}
irb(main):006> client1.config.api_key['api_key_query'] = 'foo'
irb(main):007> client1.config.api_key
=> {"api_key_query" => "foo"}
irb(main):008> client2.config.api_key
=> {"api_key_query" => "foo"}
Suggest a fix
Currently, Configuration.default is a singleton and the default when instantiating a new ApiClient.
To fix this issue, we could create a new Configuration instance when instantiating a new ApiClient, merely copying the default configuration. While this would break calling .configure after instantiating a client, this was probably already surprising behavior as well. In any case, the new approach would match behavior of ActiveSupport::Configurable, for example.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with modules/openapi-generator/src/main/resources/ruby-client/api_client.mustache, especially the Configuration.default usage cited in the issue. Reproduce the shared-state behavior in samples/client/petstore/ruby using the shown IRB steps, then verify that separately created ApiClient instances no longer share configuration while the documented default behavior remains consistent.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ruby
- Domain
- api, tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 55/100