swagger-api/swagger-codegen

[SWIFT3] URL parameters are not escaped

Open

#6,400 建立於 2017年8月29日

在 GitHub 查看
 (11 留言) (0 反應) (0 負責人)HTML (5,474 fork)batch import
Client: SwiftIssue: Bughelp wanted

倉庫指標

Star
 (12,701 star)
PR 合併指標
 (30 天內沒有已合併 PR)

描述

Description

swagger-codegen does not properly escape parametrized parts of a URL.

For example:

    var path = "/recipient/{recipient}"
    path = path.replacingOccurrences(of: "{recipient}", with: "\(recipient)", options: .literal, range: nil)

The "recipient" variable should be URLEscaped, but it isn't. Thus, if recipient contains spaces or illegal characters, the request fails. Depending on the source of the parameters, this could also lead to vulnerable code.

Swagger-codegen version

git commit id 18c57a65ed5def618be6495e86fd2d0c73f89882

Swagger declaration file content or url

n/a

Command line used for generation

not relevnt

Steps to reproduce

Use a swagger API that has parameters in the URL, for example: /article/{articleName}, then use "Hello World ../" as articleName

Related issues/PRs

n/a

Suggest a fix/enhancement

Properly url escape the passed parameters:

let param1 = param.addingPercentEncoding(withAllowedCharacters: .urlPathAllowed)

貢獻者指南