swagger-api/swagger-ui

Vertical bar character | is not escaped in cURL (CMD) request snipped body

Open

#10,540 建立於 2025年8月4日

在 GitHub 查看
 (2 留言) (0 反應) (1 負責人)JavaScript (25,447 star) (8,801 fork)batch import
Good first issueP3pull-request-welcometype: bug

描述

Q&A (please complete the following information)

  • OS: Windows 11
  • Browser: chrome
  • Version: 138.0.7204.169
  • Method of installation: springdoc-openapi
  • Swagger-UI version: 5.21.0
  • Swagger/OpenAPI version: Swagger 2.2.30, OpenAPI 3.0

Content & configuration

Swagger-UI configuration options (request snippets enabled):

requestSnippetsEnabled: true

Describe the bug you're encountering

The vertical bar character | in the cURL (CMD) request body of the request snippet is not escaped. When running the generated CMD command, the first string after the | is considered a command.

To reproduce...

Steps to reproduce the behavior:

  1. Enable request snippets
  2. Construct a "Try it out" request with a JSON request body having the vertical bar/pipe character |
  3. Execute the request and copy the generated cURL (CMD) snippet into a Windows cmd.exe
  4. The | character is not escaped which leads to a 'some-string' is not recognized as an internal or external command, operable program or batch file. error message in CMD

Expected behavior

The vertical bar character | in the request body of CMD curl snippets is escaped (with a caret ^)

Screenshots

Not escaped | in request body:

Escaped | in request body:

貢獻者指南

技術棧
javascript
領域
frontendapi
議題類型
bug
難度面向新貢獻者的預計實作難度，1 表示很小改動，5 表示專家級工作。
2
預計時間有經驗貢獻者完成調查、實作、測試並準備 pull request 的粗略時間範圍。
under 1 hour
活動狀態議題目前的可參與程度：新鮮、活躍、陳舊、阻塞或等待維護者輸入。
blocked
清晰度議題是否清楚說明預期改動、驗收標準和下一步。
clear
前置要求
無
新手友善度1-100 的估計分數，表示該議題對首次貢獻者的友善程度。
90
研究方向
The bug is in src/core/plugins/request snippets/fn.js at line 31, where pipe characters (|) are not escaped. The fix is to add a replacement for '|' with '^|' in the cURL CMD escaping logic. Ensure the escaping is only applied to the CMD variant and not other shells. The existing code shows similar escaping for other special characters like &, <, >, etc. The issue has been assigned, so check if there is any ongoing work.