swagger-api / swagger-api/swagger-parser
[Bug]: Const: Null when passed in OpenApi 3.1 Yaml file is silently dropped by the swagger parser, hence producing invalid results
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 867
- Forks
- 560
- Avg merge
- 2d 21h
- Merged PRs (30d)
- 7
Description
Description
When parsing an OpenAPI 3.1 document, schema.getConst() returns null (Java null) when the const keyword is set to a YAML null literal on a scalar field schema. This makes it impossible to distinguish between "no const keyword present" and "const: null is explicitly declared". Both cases produce schema.getConst() == null, so the const: null constraint is silently lost.
By contrast, when null appears as a property value inside an object-typed const (e.g. const: {code: 0, msg: null}), the outer ObjectNode is correctly returned from schema.getConst(), and the inner null is accessible via the node's fields — so object const null properties are not affected.
Affected keyword: const
Affected version: OpenAPI 3.1
Affected Version
io.swagger.parser.v3:swagger-parser-v3:2.1.42
Confirmed by bytecode inspection of OpenAPIDeserializer.class from this jar. The same logic exists in 2.1.32 (also inspected). Likely present since const support was added.
Steps to Reproduce
Spec (YAML):
openapi: "3.1.0"
info:
title: Test
version: "1.0"
paths: {}
components:
schemas:
MySchema:
type: object
properties:
msg:
type: string
const: null # <-- scalar const: null on individual field
code:
type: integer
const: 0
const:
code: 0
msg: null # <-- null inside object const (works correctly)
Test code:
SwaggerParseResult result = new OpenAPIV3Parser().readContents(yaml);
Schema<?> msgSchema = result.getOpenAPI()
.getComponents().getSchemas().get("MySchema")
.getProperties().get("msg");
System.out.println(msgSchema.getConst()); // prints: null (BUG — should be NullNode or distinguishable sentinel)
// No-const field for comparison:
Schema<?> noConst = new Schema<>();
System.out.println(noConst.getConst()); // also prints: null (same result — indistinguishable)
Expected Behavior
schema.getConst() should return a non-null value (e.g. a Jackson NullNode) when const: null is explicitly declared in the spec. This is what happens for all other const value types (const: "hello" → TextNode, const: 42 → IntNode, const: true → BooleanNode, const: {key: val} → ObjectNode).
Consumers of the API need to distinguish "const is not set" from "const is explicitly null". Currently there is no way to make this distinction.
Actual Behavior
schema.getConst() returns Java null for both "no const keyword" and "const: null". The const: null constraint is silently dropped.
Root Cause (Bytecode-Confirmed)
In OpenAPIDeserializer.getAnyType(), the method reads the raw JsonNode for the key. For a YAML null value, Jackson produces a NullNode. The method correctly identifies it at the end of its type-dispatch chain
So schema.setConst(NullNode) is called. The bug is not in the parser placing the value — it is in Schema.getConst() itself. The Schema class has a bindTypes mechanism and a BIND_TYPE_AND_TYPES flag. At some point after deserialization (likely during resolve() or post-processing), Schema transforms or loses the _const field when its value is a NullNode.
Specifically, Schema._const is typed T (generic). When the resolved type T is incompatible with NullNode, or when Jackson's databind serialisation/deserialisation of the schema model converts NullNode to null during a re-serialisation pass (e.g. during $ref resolution), the NullNode is lost and _const becomes Java null.
Environment
- Java version: OpenJDK 21 (IBM Semeru Runtime 21.0.10)
- Build tool: Gradle 8.14
- OS: macOS Darwin 25.3.0 arm64
- swagger-parser-v3:
2.1.42 - swagger-core-jakarta:
2.2.52 - swagger-models-jakarta:
2.2.52
Workaround
Since schema.getConst() is unusable for the null case, a consumer must access the raw parsed JsonNode tree directly via OpenAPIV3Parser.readContents() and traverse the components/schemas/.../properties/.../const path manually, checking JsonNode.isNull() rather than relying on Schema.getConst().
Additional Context
This affects any implementation that relies on schema.getConst() to implement OpenAPI 3.1 const: null validation. JSON Schema (which OAS 3.1 aligns with) explicitly states that const: null is a valid constraint meaning "the value must be null". Silently dropping it means validators cannot enforce null constraints on individual scalar fields.
Object-level const is not affected: const: {key: null} correctly returns an ObjectNode from schema.getConst(), because the outer non-null ObjectNode survives the round-trip. Only the scalar const: null case is broken.
Checklist
- I have searched the existing issues and this is not a duplicate.
- I have provided sufficient information for maintainers to reproduce the issue.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing OpenAPIV3Parser.readContents through OpenAPIDeserializer.getAnyType and Schema.getConst(), checking where a NullNode becomes Java null during parsing or resolution. Add coverage for scalar const: null versus an absent const, and verify that object const values with null properties remain unchanged.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- api
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100