Ignore reference siblings during OAS 3.0 schema checks

Author: p1c2u

openapi_schema_validator/validators.py

@@ -9,6 +9,8 @@
 from jsonschema.exceptions import SchemaError
 from jsonschema.exceptions import ValidationError
 from jsonschema.protocols import Validator
+from jsonschema.validators import Draft4Validator
+from jsonschema.validators import Draft7Validator
 from jsonschema.validators import Draft202012Validator
 from jsonschema.validators import create
 from jsonschema.validators import extend
@@ -28,6 +30,24 @@
 from openapi_schema_validator._types import oas31_type_checker
 
 _CHECK_SCHEMA_UNSET = object()
+_DRAFT4_META_SCHEMA = OPENAPI_SPECIFICATIONS.contents(
+    "http://json-schema.org/draft-04/schema#",
+)
+_OAS30_SCHEMA_CHECKER = extend(
+    Draft4Validator, {"if": Draft7Validator.VALIDATORS["if"]}
+)
+# Keep the metaschema private and anonymous so its recursive references use
+# this conditional without switching back to the registered Draft 4 validator.
+_OAS30_CHECK_SCHEMA = {
+    "definitions": _DRAFT4_META_SCHEMA["definitions"],
+    "type": _DRAFT4_META_SCHEMA["type"],
+    "if": {"required": ["$ref"]},
+    "then": {"properties": {"$ref": {"type": "string"}}},
+    "else": {
+        "properties": _DRAFT4_META_SCHEMA["properties"],
+        "dependencies": _DRAFT4_META_SCHEMA["dependencies"],
+    },
+}
 
 
 def check_openapi_schema(
@@ -46,12 +66,41 @@ def check_openapi_schema(
         registry=OPENAPI_SPECIFICATIONS,
     )
 
-    for error in validator_for_metaschema.iter_errors(schema):
+    _raise_first_schema_error(validator_for_metaschema, schema)
+
+
+def _check_oas30_schema(
+    cls: Any,
+    schema: Any,
+    format_checker: Any = _CHECK_SCHEMA_UNSET,
+) -> None:
+    if format_checker is _CHECK_SCHEMA_UNSET:
+        format_checker = cls.FORMAT_CHECKER
+
+    validator = _OAS30_SCHEMA_CHECKER(
+        _OAS30_CHECK_SCHEMA,
+        format_checker=format_checker,
+        registry=OPENAPI_SPECIFICATIONS,
+    )
+    _raise_first_schema_error(validator, schema)
+
+
+def _check_oas30_variant_schema(
+    cls: Any,
+    schema: Any,
+    format_checker: Any = Draft4Validator.FORMAT_CHECKER,
+) -> None:
+    # These variants previously inherited jsonschema's Draft 4 format checks.
+    _check_oas30_schema(cls, schema, format_checker)
+
+
+def _raise_first_schema_error(validator: Validator, schema: Any) -> None:
+    for error in validator.iter_errors(schema):
         raise SchemaError.create_from(error)
 
 
 def _oas30_id_of(schema: Any) -> str:
-    if isinstance(schema, dict):
+    if isinstance(schema, dict) and "$ref" not in schema:
         return schema.get("id", "")  # type: ignore[no-any-return]
     return ""
 
@@ -101,9 +150,7 @@ def _oas30_id_of(schema: Any) -> str:
 
 def _build_oas30_validator() -> Any:
     return create(
-        meta_schema=OPENAPI_SPECIFICATIONS.contents(
-            "http://json-schema.org/draft-04/schema#",
-        ),
+        meta_schema=_DRAFT4_META_SCHEMA,
         validators=OAS30_VALIDATORS,
         type_checker=oas_types.oas30_type_checker,
         format_checker=oas_format.oas30_format_checker,
@@ -181,15 +228,40 @@ def _build_oas32_validator() -> Any:
     },
 )
 
+_jsonschema_evolve = OAS30Validator.evolve
+
+
+def _evolve_oas30(validator: Any, **changes: Any) -> Any:
+    schema = changes.get("schema", validator.schema)
+    # jsonschema selects a validator from $schema before filtering keywords.
+    if (
+        isinstance(schema, Mapping)
+        and "$ref" in schema
+        and "$schema" in schema
+    ):
+        schema = dict(schema)
+        del schema["$schema"]
+        changes["schema"] = schema
+    return _jsonschema_evolve(validator, **changes)
+
+
+for _oas30_validator in (
+    OAS30Validator,
+    OAS30StrictValidator,
+    OAS30ReadValidator,
+    OAS30WriteValidator,
+):
+    _oas30_validator.evolve = _evolve_oas30
+
 OAS31Validator = _build_oas31_validator()
 OAS32Validator = _build_oas32_validator()
 
-# These validator classes are generated via jsonschema create/extend, so there
-# is no simpler hook to inject registry-aware schema checking while preserving
-# each class's FORMAT_CHECKER. Override check_schema on each class to keep
-# OpenAPI metaschema resolution local and to apply optional ecma-regex
-# behavior consistently across OAS 3.0/3.1/3.2.
-OAS30Validator.check_schema = classmethod(check_openapi_schema)
+# Override the generated methods to use the dialect-specific schema checks
+# and keep metaschema resolution local.
+OAS30Validator.check_schema = classmethod(_check_oas30_schema)
+OAS30StrictValidator.check_schema = classmethod(_check_oas30_variant_schema)
+OAS30ReadValidator.check_schema = classmethod(_check_oas30_variant_schema)
+OAS30WriteValidator.check_schema = classmethod(_check_oas30_variant_schema)
 OAS31Validator.check_schema = classmethod(check_openapi_schema)
 OAS32Validator.check_schema = classmethod(check_openapi_schema)
 
@@ -235,4 +307,6 @@ def enforce_properties(
         extended_validator.check_schema = classmethod(
             validator_class.check_schema.__func__
         )
+    if validator_class.evolve is _evolve_oas30:
+        extended_validator.evolve = _evolve_oas30
     return cast(type[Validator], extended_validator)

tests/unit/test_shortcut.py

@@ -14,6 +14,7 @@
 from openapi_schema_validator.settings import reset_settings_cache
 from openapi_schema_validator.shortcuts import clear_validate_cache
 from openapi_schema_validator.validators import OAS30ReadValidator
+from openapi_schema_validator.validators import OAS30StrictValidator
 from openapi_schema_validator.validators import OAS30Validator
 from openapi_schema_validator.validators import OAS30WriteValidator
 from openapi_schema_validator.validators import OAS31Validator
@@ -433,3 +434,124 @@ def test_validate_oas30_ignores_ref_siblings_while_oas31_oas32_apply_them():
                 cls=validator_cls,
                 enforce_properties_required=True,
             )
+
+
+@pytest.mark.parametrize(
+    "cls",
+    [
+        OAS30Validator,
+        OAS30StrictValidator,
+        OAS30ReadValidator,
+        OAS30WriteValidator,
+    ],
+)
+def test_oas30_schema_check_ignores_ref_siblings(cls):
+    schema = {
+        "type": "object",
+        "properties": {
+            "$ref": {
+                "$ref": "#/definitions/Name",
+                "minLength": "ignored",
+                "exclusiveMinimum": True,
+            },
+        },
+        "definitions": {"Name": {"type": "string", "minLength": 2}},
+    }
+
+    cls.check_schema(schema)
+    validate({"$ref": "abc"}, schema, cls=cls)
+    with pytest.raises(ValidationError, match="is too short"):
+        validate({"$ref": "a"}, schema, cls=cls)
+
+
+def test_oas30_schema_check_preserves_root_ref_target():
+    schema = {
+        "$ref": "#/definitions/Name",
+        "minLength": "ignored",
+        "definitions": {"Name": {"type": "string", "minLength": 2}},
+    }
+
+    validate("abc", schema, cls=OAS30Validator)
+    with pytest.raises(ValidationError, match="is too short"):
+        validate("a", schema, cls=OAS30Validator)
+
+
+def test_oas30_schema_check_rejects_non_string_ref():
+    with pytest.raises(SchemaError, match="is not of type 'string'"):
+        OAS30Validator.check_schema({"$ref": None})
+
+
+@pytest.mark.parametrize(
+    "cls", [OAS30Validator, OAS31Validator, OAS32Validator]
+)
+def test_schema_check_rejects_malformed_constraints_in_applicable_schemas(cls):
+    schema = {
+        "properties": {"name": {"$ref": "#/definitions/Name"}},
+        "definitions": {"Name": {"type": "string", "minLength": "invalid"}},
+    }
+    with pytest.raises(SchemaError, match="is not of type 'integer'"):
+        cls.check_schema(schema)
+
+
+@pytest.mark.parametrize("cls", [OAS31Validator, OAS32Validator])
+def test_schema_check_rejects_malformed_ref_siblings_in_oas31_and_oas32(cls):
+    schema = {
+        "$ref": "#/$defs/Name",
+        "minLength": "invalid",
+        "$defs": {"Name": {"type": "string"}},
+    }
+    with pytest.raises(SchemaError, match="is not of type 'integer'"):
+        validate("abc", schema, cls=cls)
+
+
+@pytest.mark.skipif(
+    not has_ecma_regex(), reason="requires optional ecma-regex"
+)
+@pytest.mark.parametrize(
+    "cls", [OAS30StrictValidator, OAS30ReadValidator, OAS30WriteValidator]
+)
+def test_oas30_variant_schema_check_keeps_draft4_format_defaults(cls):
+    schema = {"pattern": r"(?P<name>a)"}
+    cls.check_schema(schema)
+    with pytest.raises(SchemaError, match="is not a 'regex'"):
+        cls.check_schema(schema, format_checker=cls.FORMAT_CHECKER)
+
+
+@pytest.mark.parametrize(
+    "dialect", [[], "https://json-schema.org/draft/2020-12/schema"]
+)
+@pytest.mark.parametrize("enforce", [False, True])
+def test_validate_oas30_ignores_ref_sibling_dialect(dialect, enforce):
+    schema = {
+        "$ref": "#/definitions/Name",
+        "$schema": dialect,
+        "minLength": 10,
+        "definitions": {"Name": {"type": "string", "nullable": True}},
+    }
+    validate(
+        None, schema, cls=OAS30Validator, enforce_properties_required=enforce
+    )
+
+
+def test_validate_oas30_ignores_nested_ref_sibling_dialect():
+    schema = {
+        "properties": {
+            "name": {
+                "$ref": "#/definitions/Name",
+                "$schema": "https://json-schema.org/draft/2020-12/schema",
+            },
+        },
+        "definitions": {"Name": {"type": "string", "nullable": True}},
+    }
+    validate({"name": None}, schema, cls=OAS30Validator)
+
+
+def test_validate_oas30_ignores_ref_sibling_id_with_legacy_resolver():
+    schema = {
+        "$ref": "#/definitions/Name",
+        "id": [],
+        "definitions": {"Name": {"type": "string"}},
+    }
+    with pytest.deprecated_call():
+        resolver = OAS30Validator(schema).resolver
+    validate("abc", schema, cls=OAS30Validator, resolver=resolver)