v2 - security - correct the proxy design implementation #1998

Activity

1. Vincent Biret (baywet)

   added

   type:bugA broken experienceA broken experience

   on Dec 19, 2024
2. baywet commented on Dec 27, 2024

   

   Vincent Biret (baywet)

   on Dec 27, 2024

   MemberAuthor

   More actions

   This is also causing bugs as we copy the values from the target, but throw away the copy all the time here.

   OpenAPI.NET/src/Microsoft.OpenApi/Models/References/OpenApiSchemaReference.cs

   Line 29 in f5fb254

   OpenApiSchema resolved = new OpenApiSchema(_target);

   schema = new OpenApiSchemaReference("foo", null);
   // Assume foo is not nullable.
   schema.Nullable = true;
   // The reference to foo is still not nullable.

   The implementation should leverage lazy loading, and KEEP the new OpenAPI schema once created.
3. baywet commented on Dec 27, 2024

   

   Vincent Biret (baywet)

   on Dec 27, 2024

   MemberAuthor

   More actions

   Another issue is that the compiler doesn't help people know which properties are writeable for a reference since it currently inherits from OpenAPISchema.

   I believe that we should introduce a new interface IOpenAPISchema which ONLY has the getters for the properties.
   Then all places that currently return an OpenAPISchema should be updated to return that interface. Forcing consumers to do a type assertion and handle the different cases (any property being or not writeable, or updating the source component).

   The target should probably also be a public property, in case the consumers want to walk up the reference.

   Lastly, the reference resolving mechanism is cumbersome for write scenarios: you need to manually register the components before they can be resolved.
4. baywet commented on Dec 30, 2024

   

   Vincent Biret (baywet)

   on Dec 30, 2024

   MemberAuthor

   More actions

   Additional details from additional internal discussions:

   • we don't want to use an interface if we can avoid it, as adding properties would be a breaking change. Maybe introducing an abstract base class is a better middle ground.
   • We'll need to work on additional registration methods to make creation of documents from other object models (yoko, asp.net, etc...) easier. I'll start addressing that in an upcoming PR.
5. darrelmiller commented on Jan 15, 2025

   

   Darrel (darrelmiller)

   on Jan 15, 2025

   Member

   More actions

   The OpenApiSchema should not clone the object.

   I'm not convinced about the derived base class thing. Can you add just setters in a derived class?
   I'm fine with making target public.

   We need to make all the references implement IOpenApiReferenceable because the walker relies on it.
6. Maggie Kimani (MaggieKimani1)

   added this to the v2-Preview6 milestone on Jan 27, 2025
7. Vincent Biret (baywet)

   closed this as completedin #2111on Feb 3, 2025