Parameters are treated as deep object even if not configured

[fgreinacher]

Description

We define array parameters which names contain brackets, like this:

    SurnameFilterInQuery:
      name: filter[surname]
      description: ...
      in: query
      required: false
      explode: false
      schema:
        type: array
        items:
          $ref: "#/components/schemas/Surname"

    # ...

    Surname:
      type: string
      description: ...

Note that we do not define deepObject style and simply want to pass comma-separated array items.

Now we perform slightly malformed queries to our service, like this:

curl -H "https://api.example.com/?filter[surname]_bogus=greinacher" # url-decoded for readability

Actual behaviour

Connexion crashes with this message:

ERROR:asyncio:'dict' object has no attribute 'split'

Which is caused by this line: https://github.com/spec-first/connexion/blob/v2/connexion/decorators/uri_parsing.py#L259.

Expected behaviour

Connexion does not crash but fail because the parameter filter[surname]_bogus is not declared.

Steps to reproduce

See above

Additional info:

Output of the commands:

• poetry run python --version: Python 3.9.13
• poetry show connexion | grep "^version" : version : 2.14.0

[fgreinacher]

What do you think about changing https://github.com/spec-first/connexion/blob/v2/connexion/decorators/uri_parsing.py#L191 to check the parameter style before doing any transformations?

[fgreinacher]

@RobbeSneyders What do you think? I'm happy to prepare a PR but want to see what maintainers think first 🙏

[RobbeSneyders]

Thanks for the report @fgreinacher.

I'm currently on my phone, so hard to dive into the code. But based on a quick look, I don't think this is due to treatment as a deepobject. The method that fails is used to split form style parameters, which seems correct here.

Could you post the full stack trace so I can see which code path is followed?

[fgreinacher]

@RobbeSneyders Sure, here is a stack trace:

Traceback (most recent call last):
  File "/home/repo/.venv/lib/python3.9/site-packages/connexion/apis/aiohttp_api.py", line 55, in problems_middleware
    response = await handler(request)
  File "/home/repo/.venv/lib/python3.9/site-packages/aiohttp/web_middlewares.py", line 108, in impl
    return await handler(request)
  File "/home/repo/.venv/lib/python3.9/site-packages/connexion/decorators/decorator.py", line 53, in wrapper
    connexion_response = function(connexion_request)
  File "/home/repo/.venv/lib/python3.9/site-packages/connexion/decorators/uri_parsing.py", line 146, in wrapper
    request.query = self.resolve_query(query)
  File "/home/repo/.venv/lib/python3.9/site-packages/connexion/decorators/uri_parsing.py", line 229, in resolve_query
    return self.resolve_params(query_data, 'query')
  File "/home/repo/.venv/lib/python3.9/site-packages/connexion/decorators/uri_parsing.py", line 120, in resolve_params
    resolved_param[k] = self._split(values, param_defn, _in)
  File "/home/repo/.venv/lib/python3.9/site-packages/connexion/decorators/uri_parsing.py", line 259, in _split
    return value.split(delimiter)
AttributeError: 'dict' object has no attribute 'split'

[fgreinacher]

@RobbeSneyders Sorry for bothering you, but we're currently thinking about whether we do a local workaround or wait for this, and it would be great to get a rough feeling from the maintainers here (/you 😄). Thanks a ton!

[RobbeSneyders]

@fgreinacher no worries, thanks for the reminder. I didn't have access to my laptop before due to holidays.

Looking at the stack trace, you're indeed right that we're processing the parameter as a deep object even when it isn't. I would propose to fix this here though: https://github.com/spec-first/connexion/blob/1ce3e2ed2d985bb288fe93756179c5618b2ef3bb/connexion/decorators/uri_parsing.py#L227-L229

You can see an example of how to check the style here: https://github.com/spec-first/connexion/blob/1ce3e2ed2d985bb288fe93756179c5618b2ef3bb/connexion/decorators/uri_parsing.py#L243-L244

Feel free to submit a PR if you'd like. I would propose to target the v2 branch, so we can release this as a minor 2.X release. We can cherrypick to main for 3.X later.