OpenAPITools / OpenAPITools/openapi-generator
[BUG] [JAVA] [CLIENT] [JERSEY2] Using default constructor for generated API uses a not Threadsafe ApiClient
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 26.8k
- Forks
- 7.7k
- PR merge metrics
- PR metrics pending
Description
Bug Report Checklist
- Have you provided a full/minimal spec to reproduce the issue?
- Have you validated the input using an OpenAPI validator (example)?
- What's the version of OpenAPI Generator used? 4.3.1
- Have you search for related issues/PRs?
- What's the actual output vs expected output?
- [Optional] Bounty to sponsor the fix (example)
Description
When generating a Jersey2 Client, using the default constructor for the api uses a single static isntance of the ApiClient Class.
import generated.api.testlogging.api.LogsApi;
import generated.api.testlogging.api.invoker.ApiClient;
public Class ServiceApi {
private final LogsApi logsApiNotThreadSafe;
private final LogsApi logsApiThreadSafe;
public ServiceApi{
this.logsApiNotThreadSafe = new LogsApi(); // <-- Default Constructor, not Threadsafe!
this.logsApiThreadSafe = new LogsApi(new ApiClient()); // <-- Threadsafe
}
Snipped from generated LogsApi.class
public class LogsApi {
private ApiClient apiClient;
public LogsApi() {
this(Configuration.getDefaultApiClient());
}
public LogsApi(ApiClient apiClient) {
this.apiClient = apiClient;
}
}
Generated Configuration.class
public class Configuration {
private static ApiClient defaultApiClient = new ApiClient();
/**
* Get the default API client, which would be used when creating API
* instances without providing an API client.
*
* @return Default API client
*/
public static ApiClient getDefaultApiClient() {
return defaultApiClient;
}
/**
* Set the default API client, which would be used when creating API
* instances without providing an API client.
*
* @param apiClient API client
*/
public static void setDefaultApiClient(ApiClient apiClient) {
defaultApiClient = apiClient;
}
}
openapi-generator version
4.3.1 (I assume all versions are affected)
OpenAPI declaration file content or url
Input
https://gist.github.com/FloKaemmerer/eba930a252ddf7f4c6ce6638994a6175
Configuration
<plugin>
<groupId>org.openapitools</groupId>
<artifactId>openapi-generator-maven-plugin</artifactId>
<version>4.3.1</version>
<executions>
<execution>
<id>testlogging</id>
<goals>
<goal>generate</goal>
</goals>
<configuration>
<inputSpec>${testlogging-api-input-spec-file}</inputSpec>
<generatorName>java</generatorName>
<invokerPackage>generated.api.testlogging.invoker</invokerPackage>
<modelPackage>generated.api.testlogging.model</modelPackage>
<apiPackage>generated.api.testlogging.api</apiPackage>
<templateDirectory>swagger/java</templateDirectory>
<generateApiTests>false</generateApiTests>
<generateModelTests>false</generateModelTests>
<generateModelDocumentation>false</generateModelDocumentation>
<configOptions>
<library>jersey2</library>
<hideGenerationTimestamp>true</hideGenerationTimestamp>
<delegatePattern>true</delegatePattern>
<java8>true</java8>
<dateLibrary>java8</dateLibrary>
</configOptions>
</configuration>
</execution>
</executions>
</plugin>
Command line used for generation
mvn clean compile
Steps to reproduce
Generate the Api and check LogsApi.java
Related issues/PRs
Suggest a fix
Don't make the Default constructor use a static instance of the ApiClient
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the generation with the provided Maven configuration and inspect the generated LogsApi.java and Configuration.class. Compare the default and ApiClient-taking constructors and trace how the default client is obtained. Done means the generated Jersey2 client no longer shares an unsafe static ApiClient through its default constructor, with the generated output verified after mvn clean compile.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, openapi
- Domain
- api, tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100