Skip to content

Ignore $ref sibling keywords in OAS 3.0 validators - #305

Open
josephaxisa wants to merge 1 commit into
python-openapi:masterfrom
josephaxisa:fix/oas30-ignore-ref-siblings
Open

josephaxisa wants to merge 1 commit into
python-openapi:masterfrom
josephaxisa:fix/oas30-ignore-ref-siblings

Conversation

@josephaxisa

Copy link
Copy Markdown

Fixes #304

In OpenAPI 3.0 (§4.7.24 Reference Object), a Reference Object ({"$ref": "..."}) cannot be extended and any sibling keywords next to $ref have to be ignored (matching Draft 4 / json-reference behavior). OpenAPI 3.1 and 3.2 switched to JSON Schema Draft 2020-12, where $ref siblings are evaluated alongside the referenced schema.

Because jsonschema.validators.create() defaults applicable_validators to evaluating every keyword on the schema dict (whereas Draft4Validator explicitly passes applicable_validators=_legacy_keywords.ignore_ref_siblings), _build_oas30_validator() was evaluating sibling keywords next to $ref.

In practice, OAS 3.0 specs and code-first generators often leave sibling keywords like nullable, readOnly, writeOnly, type, or minLength on $ref properties. When OAS30Validator (or downstream callers like openapi-core) validates against those schemas, two things go wrong:

  • Valid payloads get rejected when a sibling keyword (nullable: false, minLength, type, required) conflicts with or narrows the referenced target schema.
  • Required properties get silently skipped when a $ref property has a sibling readOnly: true or writeOnly: true, because required, read_required, and write_required in _keywords.py inspect prop_schema.get("readOnly") / prop_schema.get("writeOnly") directly on the parent's properties dict before $ref resolution.

What changed

  • Pass applicable_validators=_legacy_keywords.ignore_ref_siblings in _build_oas30_validator() (openapi_schema_validator/validators.py). This is inherited via extend() by OAS30Validator, OAS30StrictValidator, OAS30ReadValidator, OAS30WriteValidator, and build_enforce_properties_required_validator(OAS30*), while leaving OAS31Validator and OAS32Validator untouched.
  • Check if prop_schema and "$ref" not in prop_schema: in required, read_required, and write_required (openapi_schema_validator/_keywords.py) so sibling readOnly/writeOnly flags on a $ref property don't suppress missing-required errors in OAS 3.0.
  • Added integration and unit tests covering OAS30Validator, OAS30StrictValidator, OAS30ReadValidator, OAS30WriteValidator, build_enforce_properties_required_validator, OAS31Validator, OAS32Validator, and validate().

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

OAS30Validator evaluates sibling keywords alongside $ref instead of ignoring them per OpenAPI 3.0 §4.7.24

1 participant