mirror of
https://github.com/kennethreitz/responder.git
synced 2026-07-21 18:39:29 +00:00
kennethreitz
c839db5eac
## Summary
Follow-up hardening from the fresh audit. The client generator
interpolated OpenAPI path-parameter names directly into single-quoted
string literals in the generated Python/JavaScript/Ruby clients:
```python
path_expr += f".replace('{{{raw_name}}}', _quote({py_name}))" # Python, before
```
A path-param name containing a `'` or `\` — reachable from an
**untrusted** OpenAPI spec (the path-param regex `{([^}:]+)...}` allows
both) — breaks out of the literal and produces a client that fails to
parse. Impact is limited to broken *generated* output (not generator
RCE), but it's a real correctness bug for third-party specs.
## Fix
Emit the `{name}` placeholder through a proper per-language string
escaper:
- **Python** → `repr(...)`
- **JavaScript/TypeScript** → the existing `_js_string(...)`
- **Ruby** → a new `_ruby_string(...)` (single-quoted literal; also
applied to the Ruby base path and query-hash keys, which had the same
`repr`-for-Ruby quirk where a value with a quote could force a
double-quoted literal and re-enable `#{}` interpolation)
**PHP was already correct** and is unchanged — `_php_string` escapes `\`
and `'`, and single-quoted PHP tolerates literal newlines (so the
audit's PHP "newline" finding was a false positive).
## Tests
New `tests/test_clientgen_pathparam_escaping.py`: feeds a hostile spec
(path-param name `a'b\c\n d`) and asserts the generated **Python
compiles** (`compile()` — would `SyntaxError` before), and that the
JS/Ruby placeholders are emitted through the escaper. The existing
multi-language native syntax checks (`test_clientgen.py`) still pass.
Full suite: **759 passed**, 1 skipped (php toolchain not installed
locally; runs in CI); ruff clean; mypy clean.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>