Link Object With Both 'operationId' And 'operationRef'
- Query id: 60fb6621-9f02-473b-9424-ba9a825747d3
- Query name: Link Object With Both 'operationId' And 'operationRef'
- Platform: OpenAPI
- Severity: Info
- Category: Structure and Semantics
- CWE: 20
- URL: Github
Description¶
Link object 'OperationId' should not have both 'operationId' and 'operationRef' defined since they are mutually exclusive.
Documentation
Code samples¶
Code samples with security vulnerabilities¶
Positive test num. 1 - json file
{
"openapi": "3.0.0",
"info": {
"title": "Simple API overview",
"version": "1.0.0"
},
"paths": {
"/": {
"get": {
"responses": {
"200": {
"description": "the user being returned",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"uuid": {
"type": "string",
"format": "uuid"
}
}
}
}
}
}
}
}
},
"/users/{userid}/address": {
"parameters": [
{
"name": "userid",
"in": "path",
"required": true,
"description": "the user identifier, as userId",
"schema": {
"type": "string"
}
}
],
"get": {
"operationId": "getUserAddress",
"responses": {
"200": {
"description": "the user's address"
}
}
}
}
},
"components": {
"responses": {
"200": {
"description": "the user being returned",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"uuid": {
"type": "string",
"format": "uuid"
}
}
}
}
},
"links": {
"address": {
"operationId": "getUserAddress",
"operationRef": "/",
"parameters": {
"userId": "$request.path.id"
}
}
}
}
},
"schemas": {
"Pet": {
"$ref": "../models/pet.yaml"
},
"User": {
"$ref": "https://api.example.com/v2/openapi.yaml#/components/schemas/User"
}
}
}
}
Positive test num. 2 - json file
{
"openapi": "3.0.0",
"info": {
"title": "Simple API overview",
"version": "1.0.0"
},
"paths": {
"/": {
"get": {
"responses": {
"200": {
"description": "the user being returned",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"uuid": {
"format": "uuid",
"type": "string"
}
}
}
}
},
"links": {
"address": {
"operationId": "getUserAddress",
"operationRef": "/",
"parameters": {
"userId": "$request.path.id"
}
}
}
}
}
}
},
"/users/{userid}/address": {
"parameters": [
{
"name": "userid",
"in": "path",
"required": true,
"description": "the user identifier, as userId",
"schema": {
"type": "string"
}
}
],
"get": {
"operationId": "getUserAddress",
"responses": {
"200": {
"description": "the user's address"
}
}
}
}
}
}
Positive test num. 3 - json file
{
"openapi": "3.0.0",
"info": {
"title": "Simple API overview",
"version": "1.0.0"
},
"paths": {
"/": {
"get": {
"responses": {
"200": {
"description": "the user being returned",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"uuid": {
"type": "string",
"format": "uuid"
}
}
}
}
}
}
}
}
},
"/users/{userid}/address": {
"parameters": [
{
"name": "userid",
"in": "path",
"required": true,
"description": "the user identifier, as userId",
"schema": {
"type": "string"
}
}
],
"get": {
"operationId": "getUserAddress",
"responses": {
"200": {
"description": "the user's address"
}
}
}
}
},
"components": {
"schemas": {
"Pet": {
"$ref": "../models/pet.yaml"
},
"User": {
"$ref": "https://api.example.com/v2/openapi.yaml#/components/schemas/User"
}
},
"responses": {
"GenericError": {
"$ref": "../template-api.yaml#/components/responses/GenericError"
}
},
"links": {
"address": {
"operationId": "getUserAddress",
"operationRef": "/",
"parameters": {
"userId": "$request.path.id"
}
}
}
}
}
Positive test num. 4 - yaml file
openapi: 3.0.0
info:
title: Simple API overview
version: 1.0.0
paths:
"/":
get:
responses:
"200":
description: the user being returned
content:
application/json:
schema:
type: object
properties:
uuid:
type: string
format: uuid
"/users/{userid}/address":
parameters:
- name: userid
in: path
required: true
description: the user identifier, as userId
schema:
type: string
get:
operationId: getUserAddress
responses:
"200":
description: the user's address
components:
schemas:
Pet:
$ref: "../models/pet.yaml"
User:
$ref: "https://api.example.com/v2/openapi.yaml#/components/schemas/User"
responses:
"200":
description: the user being returned
content:
application/json:
schema:
type: object
properties:
uuid:
type: string
format: uuid
links:
address:
operationId: getUserAddress
operationRef: /
parameters:
userId: $request.path.id
Positive test num. 5 - yaml file
openapi: 3.0.0
info:
title: Simple API overview
version: 1.0.0
paths:
"/":
get:
responses:
"200":
description: the user being returned
content:
application/json:
schema:
type: object
properties:
uuid:
type: string
format: uuid
links:
address:
operationId: getUserAddress
operationRef: /
parameters:
userId: $request.path.id
"/users/{userid}/address":
parameters:
- name: userid
in: path
required: true
description: the user identifier, as userId
schema:
type: string
get:
operationId: getUserAddress
responses:
"200":
description: the user's address
Positive test num. 6 - yaml file
openapi: 3.0.0
info:
title: Simple API overview
version: 1.0.0
paths:
"/":
get:
responses:
"200":
description: the user being returned
content:
application/json:
schema:
type: object
properties:
uuid:
type: string
format: uuid
"/users/{userid}/address":
parameters:
- name: userid
in: path
required: true
description: the user identifier, as userId
schema:
type: string
get:
operationId: getUserAddress
responses:
"200":
description: the user's address
components:
schemas:
Pet:
$ref: "../models/pet.yaml"
User:
$ref: "https://api.example.com/v2/openapi.yaml#/components/schemas/User"
responses:
GenericError:
$ref: "../template-api.yaml#/components/responses/GenericError"
links:
address:
operationId: getUserAddress
operationRef: /
parameters:
userId: $request.path.id
Code samples without security vulnerabilities¶
Negative test num. 1 - json file
{
"openapi": "3.0.0",
"info": {
"title": "Simple API overview",
"version": "1.0.0"
},
"paths": {
"/": {
"get": {
"responses": {
"200": {
"description": "the user being returned",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"uuid": {
"type": "string",
"format": "uuid"
}
}
}
}
}
}
}
}
},
"/users/{userid}/address": {
"parameters": [
{
"name": "userid",
"in": "path",
"required": true,
"description": "the user identifier, as userId",
"schema": {
"type": "string"
}
}
],
"get": {
"operationId": "getUserAddress",
"responses": {
"200": {
"description": "the user's address"
}
}
}
}
},
"components": {
"responses": {
"200": {
"description": "the user being returned",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"uuid": {
"type": "string",
"format": "uuid"
}
}
}
}
},
"links": {
"address": {
"operationId": "getUserAddress",
"parameters": {
"userId": "$request.path.id"
}
}
}
}
},
"schemas": {
"Pet": {
"$ref": "../models/pet.yaml"
},
"User": {
"$ref": "https://api.example.com/v2/openapi.yaml#/components/schemas/User"
}
}
}
}
Negative test num. 2 - json file
{
"openapi": "3.0.0",
"info": {
"title": "Simple API overview",
"version": "1.0.0"
},
"paths": {
"/": {
"get": {
"responses": {
"200": {
"description": "the user being returned",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"uuid": {
"format": "uuid",
"type": "string"
}
}
}
}
},
"links": {
"address": {
"operationId": "getUserAddress",
"parameters": {
"userId": "$request.path.id"
}
}
}
}
}
}
},
"/users/{userid}/address": {
"parameters": [
{
"name": "userid",
"in": "path",
"required": true,
"description": "the user identifier, as userId",
"schema": {
"type": "string"
}
}
],
"get": {
"operationId": "getUserAddress",
"responses": {
"200": {
"description": "the user's address"
}
}
}
}
}
}
Negative test num. 3 - json file
{
"openapi": "3.0.0",
"info": {
"title": "Simple API overview",
"version": "1.0.0"
},
"paths": {
"/": {
"get": {
"responses": {
"200": {
"description": "the user being returned",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"uuid": {
"type": "string",
"format": "uuid"
}
}
}
}
}
}
}
}
},
"/users/{userid}/address": {
"parameters": [
{
"name": "userid",
"in": "path",
"required": true,
"description": "the user identifier, as userId",
"schema": {
"type": "string"
}
}
],
"get": {
"operationId": "getUserAddress",
"responses": {
"200": {
"description": "the user's address"
}
}
}
}
},
"components": {
"schemas": {
"Pet": {
"$ref": "../models/pet.yaml"
},
"User": {
"$ref": "https://api.example.com/v2/openapi.yaml#/components/schemas/User"
}
},
"responses": {
"GenericError": {
"$ref": "../template-api.yaml#/components/responses/GenericError"
}
},
"links": {
"address": {
"operationId": "getUserAddress",
"parameters": {
"userId": "$request.path.id"
}
}
}
}
}
Negative test num. 4 - yaml file
openapi: 3.0.0
info:
title: Simple API overview
version: 1.0.0
paths:
"/":
get:
responses:
"200":
description: the user being returned
content:
application/json:
schema:
type: object
properties:
uuid:
type: string
format: uuid
"/users/{userid}/address":
parameters:
- name: userid
in: path
required: true
description: the user identifier, as userId
schema:
type: string
get:
operationId: getUserAddress
responses:
"200":
description: the user's address
components:
schemas:
Pet:
$ref: "../models/pet.yaml"
User:
$ref: "https://api.example.com/v2/openapi.yaml#/components/schemas/User"
responses:
"200":
description: the user being returned
content:
application/json:
schema:
type: object
properties:
uuid:
type: string
format: uuid
links:
address:
operationId: getUserAddress
parameters:
userId: $request.path.id
Negative test num. 5 - yaml file
openapi: 3.0.0
info:
title: Simple API overview
version: 1.0.0
paths:
"/":
get:
responses:
"200":
description: the user being returned
content:
application/json:
schema:
type: object
properties:
uuid:
type: string
format: uuid
links:
address:
operationId: getUserAddress
parameters:
userId: $request.path.id
"/users/{userid}/address":
parameters:
- name: userid
in: path
required: true
description: the user identifier, as userId
schema:
type: string
get:
operationId: getUserAddress
responses:
"200":
description: the user's address
Negative test num. 6 - yaml file
openapi: 3.0.0
info:
title: Simple API overview
version: 1.0.0
paths:
"/":
get:
responses:
"200":
description: the user being returned
content:
application/json:
schema:
type: object
properties:
uuid:
type: string
format: uuid
"/users/{userid}/address":
parameters:
- name: userid
in: path
required: true
description: the user identifier, as userId
schema:
type: string
get:
operationId: getUserAddress
responses:
"200":
description: the user's address
components:
schemas:
Pet:
$ref: "../models/pet.yaml"
User:
$ref: "https://api.example.com/v2/openapi.yaml#/components/schemas/User"
responses:
GenericError:
$ref: "../template-api.yaml#/components/responses/GenericError"
links:
address:
operationId: getUserAddress
parameters:
userId: $request.path.id