Validation of Exploded Form Parameters is Faulty

[Former user]

OpenApi supports certain formatting options for paramters. One of them is style: form, explode: true. It causes all properties of the parameter object to be serialized individually.
Currently, validating such a schema raises a validation.request.parameter.query.missing and a validation.request.parameter.query.unexpected validation error since the validator is not respecting the style option and searches for the wrong parameter.

To reproduce:

Request: GET /api/paged?page=2&pageSize=11
openapi.yaml:

openapi: 3.0.1
info:
  title: Test Service
  version: 0.1.0
servers:
  - url: /
paths:
  /api/paged:
    get:
      parameters:
        - $ref: '#/components/parameters/PageRequest'
      responses:
        200:
          description: success
components:
  parameters:
    PageRequest:
      name: PageRequest
      in: query
      required: true
      style: form
      explode: true
      schema:
        $ref: '#/components/schemas/PageRequest'
  schemas:
    PageRequest:
      type: object
      properties:
        page:
          description: The desired page number
          type: integer
          minimum: 0
        pageSize:
          description: The desired number of items per page
          type: integer
          minimum: 1

Related Code

com\atlassian\oai\validator\interaction\request\RequestValidator.java#244

Maybe treat exploded parameter objects simmilarily to the deepObject style. Alternatively, break up the paramater spec into queryParameter fragments (one paramter spec per property of the object).

---

I am new to this issue board, feel free to change this issue or move it somewhere it belongs.

[Sirisha Goka]

The issue is around here in RequestValidator.java@417, the validatatParam(..) method is just verifying the parameter values and required parameter.

And also the validation for query params when “style”=form and “explode”=true is not handled properly.

[Slimane DEB]

facing the same problem, any updates guys?

[James Navin]

Available in 2.27.0

[Bindiya C]

Tried 2.27.0, looks like it works when we just have one query param object and not more than one query param objects? Can this be fixed to handle more than one query param objects like before. Sample openapi yml.

parameters:
- in: query
name: example1
description: description 1
style: form
explode: true
required: false
schema:
\$ref: '#/components/schemas/Example1'
example: "attr1=AO&attr2=6&attr3=4"
- in: query
name: example2
description: description 2
style: form
explode: true
required: false
schema:
\$ref: '#/components/schemas/Example2'
example: "attr4=20&attr5=0"

‌