libopenapi-validator icon indicating copy to clipboard operation
libopenapi-validator copied to clipboard

Content-Type header validation fails if the content type contains custom header values

Open AtomicTroop opened this issue 6 months ago • 0 comments

A response with, for example, a Content-Type: application/json; version=2 header fails validation against a spec that defines that same type as a valid response type, like so:

... path and operation omitted ...
"responses": {
  "200": {
    "content": {
      "application/json; version=2": {
        "schema": { ... }
      }
    }
  }
}

The returned validation error:

Message: GET / 200 operation response content type 'application/json' does not exist
HowToFix: The content type is invalid, Use one of the 1 supported types for this operation: application/json; version=2

This seems to be happening because helpers.ExtractContentType() assumes Charset and Boundary as the only valid header values for Content-Type and discards everything else.

Further down the validation logic, on L72 of responseBodyValidator.ValidateResponseBodyWithPathItem(), this content type stripped to a media type is then being compared directly with the content types allowed by the specification. This will of course always fail if any additional header values are present in the spec.

AtomicTroop avatar Aug 13 '24 13:08 AtomicTroop