swagger-api/swagger-codegen
Auf GitHub ansehen[SWIFT3] URL parameters are not escaped
Open
#6.400 geöffnet am 29. Aug. 2017
Client: SwiftIssue: Bughelp wanted
Repository-Metriken
- Stars
- (12.701 Stars)
- PR-Merge-Metriken
- (Keine gemergten PRs in 30 T)
Beschreibung
Description
swagger-codegen does not properly escape parametrized parts of a URL.
For example:
var path = "/recipient/{recipient}"
path = path.replacingOccurrences(of: "{recipient}", with: "\(recipient)", options: .literal, range: nil)
The "recipient" variable should be URLEscaped, but it isn't. Thus, if recipient contains spaces or illegal characters, the request fails. Depending on the source of the parameters, this could also lead to vulnerable code.
Swagger-codegen version
git commit id 18c57a65ed5def618be6495e86fd2d0c73f89882
Swagger declaration file content or url
n/a
Command line used for generation
not relevnt
Steps to reproduce
Use a swagger API that has parameters in the URL, for example: /article/{articleName}, then use "Hello World ../" as articleName
Related issues/PRs
n/a
Suggest a fix/enhancement
Properly url escape the passed parameters:
let param1 = param.addingPercentEncoding(withAllowedCharacters: .urlPathAllowed)