-
Notifications
You must be signed in to change notification settings - Fork 2.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Incorrect inclusion of javax/jakarta validation annotations with groups
property set
#4804
Comments
mc1arke
added a commit
to mc1arke/swagger-core
that referenced
this issue
Dec 7, 2024
…by default The current process for adding constraints into the schema presumes that all javax or jakarta validation annotations enforce a constraint, and doesn't take into account the 'groups' property of the annotation. This results in constrains being added to the schema that would only be applied for certain request, so incorrectly marks fields as required in the resulting schema where they may only be mandatory on a subset of requests. To overcome this, a new `ValidationAnnotationFilter` is being introduced which only treats a validation annotation as constraining the schema where the conditions on the filter are met be the annotation. The default implementation of this filter only treats constraints from annotations with no groups as being enforced to bring it inline with how the default Java Beans validation operates.
mc1arke
added a commit
to mc1arke/swagger-core
that referenced
this issue
Dec 7, 2024
…by default The current process for adding constraints into the schema presumes that all javax or jakarta validation annotations enforce a constraint, and doesn't take into account the 'groups' property of the annotation. This results in constrains being added to the schema that would only be applied for certain request, so incorrectly marks fields as required in the resulting schema where they may only be mandatory on a subset of requests. To overcome this, a new `ValidationAnnotationFilter` is being introduced which only treats a validation annotation as constraining the schema where the conditions on the filter are met be the annotation. The default implementation of this filter only treats constraints from annotations with no groups as being enforced to bring it inline with how the default Java Beans validation operates.
There is already a PR for this issue: #4797 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
The javax/jakarta annotations contain a
groups
property that can be used to enable different combinations of validation on a model depending on which group is currently active - https://jakarta.ee/learn/docs/jakartaee-tutorial/current/beanvalidation/bean-validation-advanced/bean-validation-advanced.html#_grouping_constraints.When executed against a model, swagger-core currently treats any of the supported javax/jakarta annotations as applying a constraint to the schema, even where the annotated field/attribute specifies groups and is therefore is not mandatory on all requests. By default, swagger-core should only set fields as mandatory/constrained based on annotations where no groups are specified, but provide a way of the end-user adding other validation groups into the constraints where they want to treat certain groups as always being enabled.
Replication Steps
The above replicate a validator being run in default mode, e.g.
Validation.buildDefaultValidatorFactory().getValidator().validate(new CustomClass());
, which is the default way that frameworks such as Spring invoke validators. Users using something similar toValidation.buildDefaultValidatorFactory().getValidator().validate(new CustomClass(), ValidationGroup.class);
would add the annotations withValidationGroup
in thegroups
property into the enforced validation.The text was updated successfully, but these errors were encountered: