131 lines
3.8 KiB
Go
131 lines
3.8 KiB
Go
// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
package middleware
|
|
|
|
import (
|
|
stderrors "errors"
|
|
"net/http"
|
|
"strings"
|
|
|
|
"github.com/go-openapi/errors"
|
|
|
|
"github.com/go-openapi/runtime"
|
|
"github.com/go-openapi/runtime/server-middleware/mediatype"
|
|
)
|
|
|
|
type validation struct {
|
|
context *Context
|
|
result []error
|
|
request *http.Request
|
|
route *MatchedRoute
|
|
bound map[string]any
|
|
}
|
|
|
|
// validateContentType maps [mediatype.MatchFirst] to the runtime's
|
|
// validation errors:
|
|
//
|
|
// - actual fails to parse → HTTP 400 ([errors.NewParseError]).
|
|
// - actual is well-formed but
|
|
// no allowed entry accepts it → HTTP 415 ([errors.InvalidContentType]).
|
|
//
|
|
// In the standard runtime flow, malformed Content-Type headers are
|
|
// already caught upstream by [runtime.ContentType] (which itself returns
|
|
// a 400 [errors.ParseError]). This function therefore only sees the
|
|
// malformed case when invoked directly by callers that have bypassed
|
|
// that step.
|
|
func validateContentType(allowed []string, actual string, opts ...mediatype.MatchOption) error {
|
|
if len(allowed) == 0 {
|
|
return nil
|
|
}
|
|
_, ok, err := mediatype.MatchFirst(allowed, actual, opts...)
|
|
if ok {
|
|
return nil
|
|
}
|
|
if err != nil {
|
|
return errors.NewParseError(runtime.HeaderContentType, "header", actual, err)
|
|
}
|
|
return errors.InvalidContentType(actual, allowed)
|
|
}
|
|
|
|
func validateRequest(ctx *Context, request *http.Request, route *MatchedRoute) *validation {
|
|
validate := &validation{
|
|
context: ctx,
|
|
request: request,
|
|
route: route,
|
|
bound: make(map[string]any),
|
|
}
|
|
validate.debugLogf("validating request %s %s", request.Method, request.URL.EscapedPath())
|
|
|
|
validate.contentType()
|
|
if len(validate.result) == 0 {
|
|
validate.responseFormat()
|
|
}
|
|
if len(validate.result) == 0 {
|
|
validate.parameters()
|
|
}
|
|
|
|
return validate
|
|
}
|
|
|
|
func (v *validation) debugLogf(format string, args ...any) {
|
|
v.context.debugLogf(format, args...)
|
|
}
|
|
|
|
func (v *validation) parameters() {
|
|
v.debugLogf("validating request parameters for %s %s", v.request.Method, v.request.URL.EscapedPath())
|
|
result := v.route.Binder.bind(v.request, v.route.Params, v.route.Consumer, v.bound)
|
|
if result == nil {
|
|
return
|
|
}
|
|
|
|
for _, e := range result.Errors {
|
|
var validationErr *errors.Validation
|
|
if stderrors.As(e, &validationErr) {
|
|
v.result = append(v.result, validationErr)
|
|
}
|
|
}
|
|
}
|
|
|
|
func (v *validation) contentType() {
|
|
if len(v.result) > 0 || !runtime.HasBody(v.request) {
|
|
return
|
|
}
|
|
|
|
v.debugLogf("validating body content type for %s %s", v.request.Method, v.request.URL.EscapedPath())
|
|
ct, _, req, err := v.context.ContentType(v.request)
|
|
if err != nil {
|
|
v.result = append(v.result, err)
|
|
} else {
|
|
v.request = req
|
|
}
|
|
|
|
if len(v.result) == 0 {
|
|
v.debugLogf("validating content type for %q against [%s]", ct, strings.Join(v.route.Consumes, ", "))
|
|
if err := validateContentType(v.route.Consumes, ct, v.context.matchOpts()...); err != nil {
|
|
v.result = append(v.result, err)
|
|
}
|
|
}
|
|
|
|
if ct == "" || v.route.Consumer != nil {
|
|
return
|
|
}
|
|
|
|
cons, ok := mediatype.Lookup(v.route.Consumers, ct, v.context.matchOpts()...)
|
|
if !ok {
|
|
v.result = append(v.result, errors.New(http.StatusInternalServerError, "no consumer registered for %s", ct))
|
|
} else {
|
|
v.route.Consumer = cons
|
|
}
|
|
}
|
|
|
|
func (v *validation) responseFormat() {
|
|
// if the route provides values for Produces and no format could be identified then return an error.
|
|
// if the route does not specify values for Produces then treat request as valid since the API designer
|
|
// choose not to specify the format for responses.
|
|
if str, rCtx := v.context.ResponseFormat(v.request, v.route.Produces); str == "" && len(v.route.Produces) > 0 {
|
|
v.request = rCtx
|
|
v.result = append(v.result, errors.InvalidResponseFormat(v.request.Header.Get(runtime.HeaderAccept), v.route.Produces))
|
|
}
|
|
}
|