fix(security): replace regular expressions in path builders

.eslintrc

@@ -44,7 +44,8 @@
           "^@swagger-api/apidom-reference/dereference/strategies/openapi-3-1/selectors/uri$",
           "^@swagger-api/apidom-reference/resolve/resolvers/file$",
           "^@swagger-api/apidom-reference/resolve/strategies/openapi-3-1$",
-          "^@swagger-api/apidom-reference/parse/parsers/binary$"
+          "^@swagger-api/apidom-reference/parse/parsers/binary$",
+          "openapi-path-templating"
         ]
       }
     ],

config/webpack/browser.config.babel.js

@@ -63,7 +63,7 @@ const browserMin = {
   devtool: 'source-map',
   performance: {
     hints: 'error',
-    maxEntrypointSize: 440000,
+    maxEntrypointSize: 460000,
     maxAssetSize: 50000000,
   },
   output: {

package.json

@@ -122,6 +122,7 @@
     "js-yaml": "^4.1.0",
     "node-abort-controller": "^3.1.1",
     "node-fetch-commonjs": "^3.3.2",
+    "openapi-path-templating": "^1.5.0",
     "qs": "^6.10.2",
     "traverse": "=0.6.8"
   },

src/execute/oas3/parameter-builders.js

@@ -1,3 +1,6 @@
+import { resolve } from 'openapi-path-templating';
+
+import { DEFAULT_BASE_URL } from '../../constants.js';
 import stylize, { encodeCharacters } from './style-serializer.js';
 import serialize from './content-serializer.js';
 
@@ -6,22 +9,36 @@ export function path({ req, value, parameter }) {
 
   if (value === undefined) return;
 
+  const url = new URL(req.url, DEFAULT_BASE_URL);
+  const pathname = decodeURIComponent(url.pathname);
+
   if (content) {
     const effectiveMediaType = Object.keys(content)[0];
 
-    req.url = req.url
-      .split(`{${name}}`)
-      .join(encodeCharacters(serialize(value, effectiveMediaType)));
-  } else {
-    const styledValue = stylize({
-      key: parameter.name,
-      value,
-      style: style || 'simple',
-      explode: explode || false,
-      escape: 'reserved',
-    });
+    const resolvedPathname = resolve(
+      pathname,
+      { [name]: value },
+      { encoder: (val) => encodeCharacters(serialize(val, effectiveMediaType)) }
+    );
 
-    req.url = req.url.replace(new RegExp(`{${name}}`, 'g'), styledValue);
+    req.url = req.url.replace(pathname, resolvedPathname);
+  } else {
+    const resolvedPathname = resolve(
+      pathname,
+      { [name]: value },
+      {
+        encoder: (val) =>
+          stylize({
+            key: parameter.name,
+            value: val,
+            style: style || 'simple',
+            explode: explode || false,
+            escape: 'reserved',
+          }),
+      }
+    );
+
+    req.url = req.url.replace(pathname, resolvedPathname);
   }
 }
 

src/execute/swagger2/parameter-builders.js

@@ -1,3 +1,7 @@
+import { resolve } from 'openapi-path-templating';
+
+import { DEFAULT_BASE_URL } from '../../constants.js';
+
 // These functions will update the request.
 // They'll be given {req, value, paramter, spec, operation}.
 
@@ -51,7 +55,12 @@ function headerBuilder({ req, parameter, value }) {
 // Replace path paramters, with values ( ie: the URL )
 function pathBuilder({ req, value, parameter }) {
   if (value !== undefined) {
-    req.url = req.url.replace(new RegExp(`{${parameter.name}}`, 'g'), encodeURIComponent(value));
+    const url = new URL(req.url, DEFAULT_BASE_URL);
+    const pathname = decodeURIComponent(url.pathname);
+
+    const resolvedPathname = resolve(pathname, { [parameter.name]: value });
+
+    req.url = req.url.replace(pathname, resolvedPathname);
   }
 }