Redocly / Redocly/redoc

Mock server fails to decode URL-encoded parameters before regex validation

Open
#2,765 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Type: Bug
Dominant language
TypeScript
Stars
25.9k
Forks
2.4k
Avg merge
13h 10m
Merged PRs (30d)
4

Description

Describe the bug
The mock server from Redocly does not decode URL-encoded query parameters (e.g., %3A for :) before applying the regular expression validation. As a result, when a query parameter contains special characters like :, the server fails validation because it compares the URL-encoded value (e.g., eip155%3A1) instead of the decoded value (e.g., eip155:1).

Expected behavior
The mock server should decode URL-encoded query parameters before applying the regular expression validation. This ensures that query parameters such as eip155:1 pass validation when checked against the regular expression pattern ^[a-z0-9]{3,8}:[-_a-zA-Z0-9]{1,32}$.

Minimal reproducible OpenAPI snippet

openapi: 3.0.0
info:
  title: Simple API with Query Parameter Validation
  version: 1.0.0
paths:
  /example:
    get:
      summary: Example endpoint with query parameter validation
      parameters:
        - name: chain_id
          in: query
          description: A query parameter representing the blockchain identifier.
          required: true
          schema:
            type: string
            pattern: "^[a-z0-9]{3,8}:[-_a-zA-Z0-9]{1,32}$"
          example: "eip155:1"
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                example:
                  message: "Valid chain_id received"
        '400':
          description: Bad Request (if the `chain_id` doesn't match the pattern)
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                example:
                  error: "Invalid chain_id format"

Screenshots

Image

Additional context
Currently, when the chain_id parameter contains URL-encoded characters (e.g., eip155%3A1), the mock server does not decode these characters before validation. As a result, the regular expression validation fails. However, if the regular expression is modified to include the encoded form (%3A), like pattern: "^[a-z0-9]{3,8}(%3A)[-_a-zA-Z0-9]{1,32}$", validation passes successfully. This workaround is not ideal, as the server should decode URL parameters before applying the validation pattern.

This behavior contradicts standard URL parameter handling, where parameters are typically decoded before validation or processing. It would be beneficial if the mock server adhered to this common practice and decoded URL-encoded values prior to validation.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the mock server's query-parameter parsing and validation path, using the minimal OpenAPI snippet and encoded chain_id value from the report to reproduce the failure. Done means the decoded eip155:1 value is used for regex validation while invalid values still fail.

Written by the indexing model from the issue text.

Assessment

Tech stack
openapi, typescript
Domain
api
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.