swagger-api / swagger-api/swagger-ui

For `application/x-www-form-urlencoded` request, given a stringified JSON param, Swagger is incorrectly parsing the JSON, when it should be posting the string

Open
#10,047 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
JavaScript
Stars
29k
Forks
9.3k
Avg merge
2d 23h
Merged PRs (30d)
25

Description

Q&A (please complete the following information)
  • OS: Windows 10
  • Browser: Chrome
  • Version: 126.0.6478.63
  • Method of installation: Swashbuckle.AspNetCore (they depend on swagger-ui-dist)
  • Swagger-UI version: 5.17.10
  • Swagger/OpenAPI version:OpenAPI 3.0.1
Content & configuration

I replicated this bug on https://editor.swagger.io/ by using the below swagger definition.

Example Swagger/OpenAPI definition:

openapi: 3.0.1
info:
  title: Swagger Petstore - OpenAPI 3.0
  description: |-
    This is a sample Pet Store Server based on the OpenAPI 3.0 specification.  You can find out more about
    Swagger at [https://swagger.io](https://swagger.io). In the third iteration of the pet store, we've switched to the design first approach!
    You can now help us improve the API whether it's by making changes to the definition itself or to the code.
    That way, with time, we can improve the API in general, and expose some of the new features in OAS3.

    _If you're looking for the Swagger 2.0/OAS 2.0 version of Petstore, then click [here](https://editor.swagger.io/?url=https://petstore.swagger.io/v2/swagger.yaml). Alternatively, you can load via the `Edit > Load Petstore OAS 2.0` menu option!_
    
    Some useful links:
    - [The Pet Store repository](https://github.com/swagger-api/swagger-petstore)
    - [The source API definition for the Pet Store](https://github.com/swagger-api/swagger-petstore/blob/master/src/main/resources/openapi.yaml)
  termsOfService: http://swagger.io/terms/
  contact:
    email: apiteam@swagger.io
  license:
    name: Apache 2.0
    url: http://www.apache.org/licenses/LICENSE-2.0.html
  version: 1.0.11
externalDocs:
  description: Find out more about Swagger
  url: http://swagger.io
servers:
  - url: https://petstore3.swagger.io/api/v3
tags:
  - name: test
    description: Testing
    externalDocs:
      description: Find out more
      url: http://swagger.io
paths:
  /test:
    post:
      requestBody:
        content:
          application/x-www-form-urlencoded:
            encoding: 
              params:
                style: form
            schema:
              properties:
                params:
                  type: string
              type: object
      responses:
        400:
          description: Bad Request
components:
  schemas:
    ApiResponse:
      type: object
      properties:
        code:
          type: integer
          format: int32
        type:
          type: string
        message:
          type: string
      xml:
        name: '##default'
  securitySchemes:
    petstore_auth:
      type: oauth2
      flows:
        implicit:
          authorizationUrl: https://petstore3.swagger.io/oauth/authorize
          scopes:
            write:pets: modify pets in your account
            read:pets: read your pets
    api_key:
      type: apiKey
      name: api_key
      in: header
Describe the bug you're encountering
To reproduce...

Steps to reproduce the behavior:

  1. Setup swagger editor page with above definition
  2. Open "POST /test"
  3. Hit "Try it out"
  4. For params parameter, put in some json string ex: {"user": "Testing"}
  5. In chrome dev tools, see that the request payload was user: Testing
  6. Curl attempted is
curl -X 'POST' \
  'https://petstore3.swagger.io/api/v3/test' \
  -H 'accept: */*' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'user=Testing'
Expected behavior

HTTP request payload should be: params: {"user": "Testing"}
Curl should be

curl -X 'POST' \
  'https://petstore3.swagger.io/api/v3/test' \
  -H 'accept: */*' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'params={"user":"Testing"}'
Screenshots

image
image

Additional context or thoughts

On our upgrade from Swashbuckle.AspNetCore 6.5.0 to 6.6.2, they updated from swagger-ui-dist 4.15.5 to 5.17.10. This is working fine with swagger-ui-dist 4.15.5. But now appears to have been broken in 5.17.10.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in the Swagger Editor reproduction using the POST /test Try it out flow and the application/x-www-form-urlencoded request definition shown in the issue. Compare the generated payload and curl command with the expected params value, then verify that a stringified JSON parameter remains a string in the request.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, openapi
Domain
api, frontend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.