Skip to content

openapi3: fix validation of duplicated path templates#1189

Merged
fenollp merged 1 commit into
getkin:masterfrom
oasdiff:fix/conflicting-paths-dedup-key
May 20, 2026
Merged

openapi3: fix validation of duplicated path templates#1189
fenollp merged 1 commit into
getkin:masterfrom
oasdiff:fix/conflicting-paths-dedup-key

Conversation

@reuvenharrison
Copy link
Copy Markdown
Contributor

@reuvenharrison reuvenharrison commented May 18, 2026

Extracted from #1187 per @fenollp review.

Bug

Paths.Validate keeps a dedup map to detect two paths that template to the same canonical form (/users/{id} vs /users/{name}). The lookup keys on the normalized path, but the insertion was keyed on the literal path:

if oldPath, ok := normalizedPaths[normalizedPath]; ok {   // lookup: normalized
    return fmt.Errorf("conflicting paths %q and %q", path, oldPath)
}
normalizedPaths[path] = path                              // insert: literal  ← bug

Each conflicting path got its own literal-keyed entry, so the lookup never matched. The check was unreachable.

Fix

One line: key the insertion on the normalized path, matching the lookup. Error text and types are unchanged; the path was just never being reached.

Impact

Across testdata/APIs-guru-openapi-directory, 14 real-world specs are now correctly reported as having conflicting paths (their new __validate goldens pin the corrected behaviour). No other golden fixture moves.

The conflicting-paths validation in Paths.Validate was unreachable.
The lookup keyed on the *normalized* path (the template form with
parameter names stripped) but the dedup map insertion keyed on the
*literal* path. Two paths that conflict by template would each get
their own literal entry, so neither would ever see the other on
lookup.

Change the insertion to key by the normalized path. The conflicting-
paths emit() call now fires for the cases it was always meant to
catch.

Verified across testdata/APIs-guru-openapi-directory: 14 real-world
specs that the validator was silently accepting are now reported as
having conflicting paths (apigateway, backup, carbone, circuitsandbox,
healthcare.gov, jellyfin, magento, reverb, signl4, trello, visma, and
three vtex variants). Their __validate golden fixtures are new in
this commit and pin the corrected behaviour. No other golden fixtures
move; specs without conflicts are unaffected.

Extracted from getkin#1187 per @fenollp review.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@reuvenharrison reuvenharrison changed the title paths: fix unreachable conflicting-paths check (dedup key) openapi3: fix unreachable conflicting-paths check (dedup key) May 19, 2026
@fenollp fenollp changed the title openapi3: fix unreachable conflicting-paths check (dedup key) openapi3: fix validation of duplicated path templates May 20, 2026
@fenollp fenollp merged commit d29b5c0 into getkin:master May 20, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants