Skip to content

Conversation

@richardwhiuk
Copy link
Contributor

@richardwhiuk richardwhiuk commented Dec 28, 2019

If we have an API which has multiple auth types, we may panic. This is because
in Hyper 0.11, the following code will panic:

use hyper::header::{Authorization, Basic, Bearer, Headers};

fn main() {
    let mut headers = Headers::default();
    let basic = Basic { username: "richard".to_string(), password: None };
    headers.set::<Authorization<Basic>>(Authorization(basic));
    println!("Auth: {:?}", headers.get::<Authorization<Bearer>>());
}

as it mixes up an Authorization<Basic> and Authorization<Bearer> as both
have Authorization: as the header name.

This is fixed by using swagger::SafeHeaders added in
Metaswitch/swagger-rs#90

This code is no longer relevant once the Hyper 0.12 work is merged, but that is a breaking change, so this is put in for the 4.x branch.

Rust Technical Committee

@frol @farcaller @bjgill

PR checklist

  • Read the contribution guidelines.
  • If contributing template-only or documentation-only changes which will change sample output, build the project before.
  • Run the shell script(s) under ./bin/ (or Windows batch scripts under.\bin\windows) to update Petstore samples related to your fix. This is important, as CI jobs will verify all generator outputs of your HEAD commit, and these must match the expectations made by your contribution. You only need to run ./bin/{LANG}-petstore.sh, ./bin/openapi3/{LANG}-petstore.sh if updating the code or mustache templates for a language ({LANG}) (e.g. php, ruby, python, etc).
  • File the PR against the correct branch: master, 4.3.x, 5.0.x. Default: master.
  • Copy the technical committee to review the pull request if your PR is targeting a particular programming language.

@richardwhiuk
Copy link
Contributor Author

richardwhiuk commented Dec 28, 2019

If any of the Rust technical committee want to jump in and review feel free - 😄 - or I'll merge this in time for the next 4.x release.

If we have an API which has multiple auth types, we may panic. This is because
in Hyper 0.11, the following code will panic:

```
use hyper::header::{Authorization, Basic, Bearer, Headers};
fn main() {
    let mut headers = Headers::default();
    let basic = Basic { username: "richard".to_string(), password: None };
    headers.set::<Authorization<Basic>>(Authorization(basic));
    println!("Auth: {:?}", headers.get::<Authorization<Bearer>>());
}
```

as it mixes up an `Authorization<Basic>` and `Authorization<Bearer>` as both
have `Authorization:` as the header name.

This is fixed by using `swagger::SafeHeaders` added in
Metaswitch/swagger-rs#90
@richardwhiuk richardwhiuk merged commit 79d11d7 into OpenAPITools:master Jan 5, 2020
@richardwhiuk richardwhiuk deleted the rust-server-safe-headers branch January 5, 2020 14:46
jimschubert added a commit to jimschubert/openapi-generator that referenced this pull request Jan 11, 2020
* master: (187 commits)
  [core] Initial FeatureSet structures and definitions (OpenAPITools#3614)
  Add Cisco to the user list (OpenAPITools#4971)
  comment out php slim4 in ensure-up-to-date
  update samples
  [Python] Allow models to have properties of type self (OpenAPITools#4888)
  Add npmRepository option to javascript generators (OpenAPITools#4956)
  [Slim4] Add ref support to Data Mocker (OpenAPITools#4932)
  Fix auto-labeler for jax-rs (OpenAPITools#4943)
  [doc] full generator details (OpenAPITools#4941)
  comment out python flask 2 test (OpenAPITools#4949)
  [jaxrs-spec][quarkus] update to version 1.1.1.Final (OpenAPITools#4935)
  [cli] Full config help details (OpenAPITools#4928)
  Add RequestFile to typescript-node model template (OpenAPITools#4903)
  [csharp] enum suffix changes enumValueNameSuffix to enumValueSuffix (OpenAPITools#4927)
  [C#] allow customization of generated enum suffixes (OpenAPITools#4301)
  [Kotlin] Correct isInherited flag for Kotlin generators (OpenAPITools#4254)
  [Rust Server] Fix panic handling headers (OpenAPITools#4877)
  Initial CODEOWNERS (OpenAPITools#4924)
  [scala] Support for Set when array has uniqueItems=true (OpenAPITools#4926)
  remove nodejs server samples, scripts (OpenAPITools#4919)
  ...
@wing328 wing328 added this to the 4.2.3 milestone Jan 31, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants