swagger-api / swagger-api/swagger-ui

Query string parameters override path parameter and are then ignored in request.

Open
#9,384 1 comment 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
JavaScript
Stars
29k
Forks
9.3k
Avg merge
2d 23h
Merged PRs (30d)
25

Description

Q&A (please complete the following information)
  • OS: Linux
  • Browser: Firefox
  • Version: 119.0 (64-bit)
  • Method of installation: dist assets from cdnjs
  • Swagger-UI version: 5.9.0 (reproduced on 5.7.0, not reproducable on 5.6.2)
  • Swagger/OpenAPI version: OpenAPI 3.0.3
Content & configuration

Example Swagger/OpenAPI definition:

{
  "openapi": "3.0.3",
  "info": {
    "title": "Schema",
    "version": "v2",
    "description": "Schema"
  },
  "paths": {
    "/api/v2/dosim/{project_id}/components/": {
      "get": {
        "operationId": "dosim_components_list",
        "description": "Component list view filtering via query parameter ``name``.",
        "parameters": [
          {
            "name": "limit",
            "required": false,
            "in": "query",
            "description": "Number of results to return per page.",
            "schema": {
              "type": "integer"
            }
          },
          {
            "in": "query",
            "name": "name",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "offset",
            "required": false,
            "in": "query",
            "description": "The initial index from which to return the results.",
            "schema": {
              "type": "integer"
            }
          },
          {
            "in": "path",
            "name": "project_id",
            "schema": {
              "type": "string",
              "format": "uuid"
            },
            "required": true
          }
        ],
        "tags": [
          "dosim"
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PaginatedComponentV2List"
                }
              }
            },
            "description": ""
          }
        }
      }
    }
  },
  "components": {
    "schemas": {
      "ComponentListIUPACV2": {
        "type": "object",
        "properties": {
          "iupac_id": {
            "type": "string"
          },
          "name": {
            "type": "string"
          }
        },
        "required": [
          "iupac_id",
          "name"
        ]
      },
      "ComponentV2": {
        "type": "object",
        "properties": {
          "formula": {
            "type": "string"
          },
          "id": {
            "type": "string",
            "format": "uuid",
            "readOnly": true
          },
          "iupac": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/ComponentListIUPACV2"
            }
          },
          "max_concentration": {
            "type": "string",
            "format": "decimal",
            "pattern": "^-?\\d{0,6}(?:\\.\\d{0,4})?$"
          },
          "min_concentration": {
            "type": "string",
            "format": "decimal",
            "pattern": "^-?\\d{0,6}(?:\\.\\d{0,4})?$"
          },
          "name": {
            "type": "string",
            "maxLength": 300
          }
        },
        "required": [
          "formula",
          "id",
          "iupac",
          "max_concentration",
          "min_concentration",
          "name"
        ]
      },
      "PaginatedComponentV2List": {
        "type": "object",
        "properties": {
          "count": {
            "type": "integer",
            "example": 123
          },
          "next": {
            "type": "string",
            "nullable": true,
            "format": "uri",
            "example": "http://api.example.org/accounts/?offset=400&limit=100"
          },
          "previous": {
            "type": "string",
            "nullable": true,
            "format": "uri",
            "example": "http://api.example.org/accounts/?offset=200&limit=100"
          },
          "results": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/ComponentV2"
            }
          }
        }
      }
    }
  }
}

Swagger-UI configuration options:

<!DOCTYPE html>
<html lang="en">

<head>
    <title>Swagger</title>
    <meta charset="utf-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1" />
    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/5.9.0/swagger-ui.min.css"
        integrity="sha512-wjyFPe3jl9Y/d+vaEDd04b2+wzgLdgKPVoy9m1FYNpJSMHM328G50WPU57xayVkZwxWi45vA+4QN+9erPZIeig=="
        crossorigin="anonymous" referrerpolicy="no-referrer" />
</head>

<body>
    <div id="swagger-ui"></div>
    <script src="https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/5.9.0/swagger-ui-bundle.min.js"
        integrity="sha512-i/z7yBzITwsqNRT2FPfSsK2eTWhXTZDvDkAYQ4RTUnTpYWNUyx6cRURA84FkaCAa+2sOv4an2Dri2DX9bLaWmw=="
        crossorigin="anonymous" referrerpolicy="no-referrer"></script>
    <script src="https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/5.9.0/swagger-ui-standalone-preset.min.js"
        integrity="sha512-qwGi7EG31HcylzamsmacHLZJrfUGRuuHEaCMcOojuNpMu+paR554VjaCZ9LdUVTrmF8xC03YVqTzuKx0SDdruA=="
        crossorigin="anonymous" referrerpolicy="no-referrer"></script>
    <script id="schema-urls" type="application/json">[{"name": "v2", "url": "/api/v2/schema.json"}]</script>
    <script>
        window.onload = () => {
            const schemaUrls = JSON.parse(document.getElementById('schema-urls').textContent);
            window.ui = SwaggerUIBundle({
                dom_id: '#swagger-ui',
                layout: "StandaloneLayout",
                presets: [
                    SwaggerUIBundle.presets.apis,
                    SwaggerUIStandalonePreset
                ],
                urls: schemaUrls,
                "urls.primaryName": "v2",
                requestInterceptor: (request) => {
                    request.headers["X\u002DCSRFTOKEN"] = "16bWKP4OZimumybE8ewIOulWYevnsGCFj7Y9EIV78wzJK15D8Ct5YefAcD8hNiHh"
                    return request;
                }
            })
        }
    </script>
</body>

</html>

Describe the bug you're encountering

When modifying any query string parameter in an "operation", the path parameter gets overridden. Additionally, the query string parameter is then ignored in the final request.

https://github.com/swagger-api/swagger-ui/assets/475613/e8aa0b30-e161-4ca9-bf1c-0e99232bd861

When entering a value for limit the value for project_id is overridden. When then clicking "Execute", I'd expect the limit value of 1 to be correctly passed as a query string parameter.

To reproduce...

I've encountered the bug on Swagger UI 5.7.0 and following. Reverting to 5.6.2 resolves the issue.

  1. Expand the operation
  2. Click the "Try it out"
  3. Enter a value for e.g. limit (or offset or name)
  4. You'll see the value for project_id to be updated
Expected behavior

I'd expect that the values entered for any of the parameters are only used for those and do not affect any other parameter.

I'd also expect that the entered values are taken into account when making the request, and are correctly passed on as query string parameters.

Screenshots

Please see video recording above.

Additional context or thoughts

At the time of writing, I cannot reproduce the bug on https://editor.swagger.io/. However, I also do not see the version of Swagger UI that's used there.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the issue in Swagger UI 5.9.0 with the supplied OpenAPI definition, then compare the behavior with 5.6.2. Verify that editing limit, offset, or name does not alter project_id and that each entered value appears in the executed query string.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
frontend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.