mnahkies / mnahkies/openapi-code-generator
[typescript-axios] per-route server overrides incompatible with axios 1.8.2
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 34
- Forks
- 8
- Avg merge
- 20h 27m
- Merged PRs (30d)
- 7
Description
The path sanitation introduced in https://github.com/axios/axios/pull/6810 to solve https://github.com/axios/axios/security/advisories/GHSA-jr5f-v2jv-69x6 likely breaks per route server overrides (ref; https://openapi-code-generator.nahkies.co.nz/guides/concepts/servers-object-handling).
Consider how to solve this without creating a similar vulnerability here.
I believe this can be worked around in the meantime by passing {allowAbsoluteUrls: true} in the axios config parameter / escape-hatch (if you are sure that this won't create a SSRF issue).
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the typescript-axios generator's handling of per-route server overrides, then compare it with Axios pull request 6810 and the referenced security advisory. Done means route-specific servers work with Axios 1.8.2 without reintroducing an SSRF vulnerability.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- api, security, tooling
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100