OpenAPITools / OpenAPITools/openapi-generator

[BUG][ruby] config shared across instances

Open
#22,709 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Issue: Bug
Dominant language
Java
Stars
26.8k
Forks
7.7k
PR merge metrics
PR metrics pending

Description

Description

In the ruby generator, config is shared across all instances. For example, setting config.api_key on one, changes it for all others as well.

This may be a security issue if separate instances are used to authenticate with different credentials.

openapi-generator version

7.19.0-SNAPSHOT

Steps to reproduce
$ git clone https://github.com/OpenAPITools/openapi-generator.git --depth 1
$ cd openapi-generator/samples/client/petstore/ruby
$ bundle install
$ irb -Ilib
irb(main):001> require 'petstore'
irb(main):002> client1 = Petstore::ApiClient.new
irb(main):003> client2 = Petstore::ApiClient.new
irb(main):004> client1.config.api_key
=> {}
irb(main):005> client2.config.api_key
=> {}
irb(main):006> client1.config.api_key['api_key_query'] = 'foo'
irb(main):007> client1.config.api_key
=> {"api_key_query" => "foo"}
irb(main):008> client2.config.api_key
=> {"api_key_query" => "foo"}
Suggest a fix

Currently, Configuration.default is a singleton and the default when instantiating a new ApiClient.

To fix this issue, we could create a new Configuration instance when instantiating a new ApiClient, merely copying the default configuration. While this would break calling .configure after instantiating a client, this was probably already surprising behavior as well. In any case, the new approach would match behavior of ActiveSupport::Configurable, for example.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with modules/openapi-generator/src/main/resources/ruby-client/api_client.mustache, especially the Configuration.default usage cited in the issue. Reproduce the shared-state behavior in samples/client/petstore/ruby using the shown IRB steps, then verify that separately created ApiClient instances no longer share configuration while the documented default behavior remains consistent.

Written by the indexing model from the issue text.

Assessment

Tech stack
ruby
Domain
api, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.