From d9c8909741d39018cf8c19fe8283afa1cd696841 Mon Sep 17 00:00:00 2001 From: kdelay Date: Mon, 7 Sep 2026 10:52:50 +0900 Subject: [PATCH] fix: ignore an injected WebSession parameter --- CHANGELOG.md | 4 ++ .../webflux/core/service/RequestService.java | 2 + .../api/v30/app204/HelloController.java | 44 ++++++++++++++++++ .../api/v30/app204/SpringDocApp204Test.java | 42 +++++++++++++++++ .../api/v31/app204/HelloController.java | 44 ++++++++++++++++++ .../api/v31/app204/SpringDocApp204Test.java | 42 +++++++++++++++++ .../test/resources/results/3.0.1/app204.json | 46 +++++++++++++++++++ .../test/resources/results/3.1.0/app204.json | 46 +++++++++++++++++++ 8 files changed, 270 insertions(+) create mode 100644 springdoc-openapi-starter-webflux-api/src/test/java/test/org/springdoc/api/v30/app204/HelloController.java create mode 100644 springdoc-openapi-starter-webflux-api/src/test/java/test/org/springdoc/api/v30/app204/SpringDocApp204Test.java create mode 100644 springdoc-openapi-starter-webflux-api/src/test/java/test/org/springdoc/api/v31/app204/HelloController.java create mode 100644 springdoc-openapi-starter-webflux-api/src/test/java/test/org/springdoc/api/v31/app204/SpringDocApp204Test.java create mode 100644 springdoc-openapi-starter-webflux-api/src/test/resources/results/3.0.1/app204.json create mode 100644 springdoc-openapi-starter-webflux-api/src/test/resources/results/3.1.0/app204.json diff --git a/CHANGELOG.md b/CHANGELOG.md index 48dffa887..aeba82909 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - The MCP dashboard no longer pre-fills the OAuth2 token endpoint, client id and client secret. The form shows hints instead, and warns when the token endpoint is not HTTPS +### Fixed + +- An injected `WebSession` parameter is described as a schema in WebFlux applications + ## [3.1.1] - 2026-09-06 ### Security diff --git a/springdoc-openapi-starter-webflux-api/src/main/java/org/springdoc/webflux/core/service/RequestService.java b/springdoc-openapi-starter-webflux-api/src/main/java/org/springdoc/webflux/core/service/RequestService.java index bb22ce759..311ba67ac 100644 --- a/springdoc-openapi-starter-webflux-api/src/main/java/org/springdoc/webflux/core/service/RequestService.java +++ b/springdoc-openapi-starter-webflux-api/src/main/java/org/springdoc/webflux/core/service/RequestService.java @@ -38,6 +38,7 @@ import org.springframework.http.server.reactive.ServerHttpResponse; import org.springframework.web.reactive.function.server.ServerRequest; import org.springframework.web.server.ServerWebExchange; +import org.springframework.web.server.WebSession; import static org.springdoc.core.utils.SpringDocUtils.getConfig; @@ -52,6 +53,7 @@ public class RequestService extends AbstractRequestService { getConfig().addRequestWrapperToIgnore(ServerWebExchange.class, ServerHttpRequest.class) .addRequestWrapperToIgnore(ServerHttpResponse.class) .addRequestWrapperToIgnore(ServerRequest.class) + .addRequestWrapperToIgnore(WebSession.class) .addFileType(FilePart.class); } diff --git a/springdoc-openapi-starter-webflux-api/src/test/java/test/org/springdoc/api/v30/app204/HelloController.java b/springdoc-openapi-starter-webflux-api/src/test/java/test/org/springdoc/api/v30/app204/HelloController.java new file mode 100644 index 000000000..101407b23 --- /dev/null +++ b/springdoc-openapi-starter-webflux-api/src/test/java/test/org/springdoc/api/v30/app204/HelloController.java @@ -0,0 +1,44 @@ +/* + * + * * + * * * + * * * * + * * * * * Copyright 2019-2026 the original author or authors. + * * * * * + * * * * * Licensed under the Apache License, Version 2.0 (the "License"); + * * * * * you may not use this file except in compliance with the License. + * * * * * You may obtain a copy of the License at + * * * * * + * * * * * https://www.apache.org/licenses/LICENSE-2.0 + * * * * * + * * * * * Unless required by applicable law or agreed to in writing, software + * * * * * distributed under the License is distributed on an "AS IS" BASIS, + * * * * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * * * * See the License for the specific language governing permissions and + * * * * * limitations under the License. + * * * * + * * * + * * + * + */ + +package test.org.springdoc.api.v30.app204; + +import org.springframework.web.bind.annotation.GetMapping; +import org.springframework.web.bind.annotation.RequestParam; +import org.springframework.web.bind.annotation.RestController; +import org.springframework.web.server.WebSession; + +/** + * A controller that asks for the injected WebSession. + * + * @author kdelay + */ +@RestController +public class HelloController { + + @GetMapping("/hello") + public String hello(WebSession session, @RequestParam String name) { + return name; + } +} diff --git a/springdoc-openapi-starter-webflux-api/src/test/java/test/org/springdoc/api/v30/app204/SpringDocApp204Test.java b/springdoc-openapi-starter-webflux-api/src/test/java/test/org/springdoc/api/v30/app204/SpringDocApp204Test.java new file mode 100644 index 000000000..318dff5c6 --- /dev/null +++ b/springdoc-openapi-starter-webflux-api/src/test/java/test/org/springdoc/api/v30/app204/SpringDocApp204Test.java @@ -0,0 +1,42 @@ +/* + * + * * + * * * + * * * * + * * * * * Copyright 2019-2026 the original author or authors. + * * * * * + * * * * * Licensed under the Apache License, Version 2.0 (the "License"); + * * * * * you may not use this file except in compliance with the License. + * * * * * You may obtain a copy of the License at + * * * * * + * * * * * https://www.apache.org/licenses/LICENSE-2.0 + * * * * * + * * * * * Unless required by applicable law or agreed to in writing, software + * * * * * distributed under the License is distributed on an "AS IS" BASIS, + * * * * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * * * * See the License for the specific language governing permissions and + * * * * * limitations under the License. + * * * * + * * * + * * + * + */ + +package test.org.springdoc.api.v30.app204; + +import test.org.springdoc.api.v30.AbstractSpringDocTest; + +import org.springframework.boot.autoconfigure.SpringBootApplication; +import org.springframework.context.annotation.ComponentScan; + +/** + * An injected WebSession is a request wrapper, not a schema. + * + * @author kdelay + */ +public class SpringDocApp204Test extends AbstractSpringDocTest { + + @SpringBootApplication + @ComponentScan(basePackages = { "org.springdoc", "test.org.springdoc.api.v30.app204" }) + static class SpringDocTestApp {} +} diff --git a/springdoc-openapi-starter-webflux-api/src/test/java/test/org/springdoc/api/v31/app204/HelloController.java b/springdoc-openapi-starter-webflux-api/src/test/java/test/org/springdoc/api/v31/app204/HelloController.java new file mode 100644 index 000000000..66c492aa7 --- /dev/null +++ b/springdoc-openapi-starter-webflux-api/src/test/java/test/org/springdoc/api/v31/app204/HelloController.java @@ -0,0 +1,44 @@ +/* + * + * * + * * * + * * * * + * * * * * Copyright 2019-2026 the original author or authors. + * * * * * + * * * * * Licensed under the Apache License, Version 2.0 (the "License"); + * * * * * you may not use this file except in compliance with the License. + * * * * * You may obtain a copy of the License at + * * * * * + * * * * * https://www.apache.org/licenses/LICENSE-2.0 + * * * * * + * * * * * Unless required by applicable law or agreed to in writing, software + * * * * * distributed under the License is distributed on an "AS IS" BASIS, + * * * * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * * * * See the License for the specific language governing permissions and + * * * * * limitations under the License. + * * * * + * * * + * * + * + */ + +package test.org.springdoc.api.v31.app204; + +import org.springframework.web.bind.annotation.GetMapping; +import org.springframework.web.bind.annotation.RequestParam; +import org.springframework.web.bind.annotation.RestController; +import org.springframework.web.server.WebSession; + +/** + * A controller that asks for the injected WebSession. + * + * @author kdelay + */ +@RestController +public class HelloController { + + @GetMapping("/hello") + public String hello(WebSession session, @RequestParam String name) { + return name; + } +} diff --git a/springdoc-openapi-starter-webflux-api/src/test/java/test/org/springdoc/api/v31/app204/SpringDocApp204Test.java b/springdoc-openapi-starter-webflux-api/src/test/java/test/org/springdoc/api/v31/app204/SpringDocApp204Test.java new file mode 100644 index 000000000..0cccd98f5 --- /dev/null +++ b/springdoc-openapi-starter-webflux-api/src/test/java/test/org/springdoc/api/v31/app204/SpringDocApp204Test.java @@ -0,0 +1,42 @@ +/* + * + * * + * * * + * * * * + * * * * * Copyright 2019-2026 the original author or authors. + * * * * * + * * * * * Licensed under the Apache License, Version 2.0 (the "License"); + * * * * * you may not use this file except in compliance with the License. + * * * * * You may obtain a copy of the License at + * * * * * + * * * * * https://www.apache.org/licenses/LICENSE-2.0 + * * * * * + * * * * * Unless required by applicable law or agreed to in writing, software + * * * * * distributed under the License is distributed on an "AS IS" BASIS, + * * * * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * * * * * See the License for the specific language governing permissions and + * * * * * limitations under the License. + * * * * + * * * + * * + * + */ + +package test.org.springdoc.api.v31.app204; + +import test.org.springdoc.api.v31.AbstractSpringDocTest; + +import org.springframework.boot.autoconfigure.SpringBootApplication; +import org.springframework.context.annotation.ComponentScan; + +/** + * An injected WebSession is a request wrapper, not a schema. + * + * @author kdelay + */ +public class SpringDocApp204Test extends AbstractSpringDocTest { + + @SpringBootApplication + @ComponentScan(basePackages = { "org.springdoc", "test.org.springdoc.api.v31.app204" }) + static class SpringDocTestApp {} +} diff --git a/springdoc-openapi-starter-webflux-api/src/test/resources/results/3.0.1/app204.json b/springdoc-openapi-starter-webflux-api/src/test/resources/results/3.0.1/app204.json new file mode 100644 index 000000000..e961de733 --- /dev/null +++ b/springdoc-openapi-starter-webflux-api/src/test/resources/results/3.0.1/app204.json @@ -0,0 +1,46 @@ +{ + "openapi": "3.0.1", + "info": { + "title": "OpenAPI definition", + "version": "v0" + }, + "servers": [ + { + "url": "", + "description": "Generated server url" + } + ], + "paths": { + "/hello": { + "get": { + "tags": [ + "hello-controller" + ], + "operationId": "hello", + "parameters": [ + { + "name": "name", + "in": "query", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "OK", + "content": { + "*/*": { + "schema": { + "type": "string" + } + } + } + } + } + } + } + }, + "components": {} +} diff --git a/springdoc-openapi-starter-webflux-api/src/test/resources/results/3.1.0/app204.json b/springdoc-openapi-starter-webflux-api/src/test/resources/results/3.1.0/app204.json new file mode 100644 index 000000000..747236b1b --- /dev/null +++ b/springdoc-openapi-starter-webflux-api/src/test/resources/results/3.1.0/app204.json @@ -0,0 +1,46 @@ +{ + "openapi": "3.1.0", + "info": { + "title": "OpenAPI definition", + "version": "v0" + }, + "servers": [ + { + "url": "", + "description": "Generated server url" + } + ], + "paths": { + "/hello": { + "get": { + "tags": [ + "hello-controller" + ], + "operationId": "hello", + "parameters": [ + { + "name": "name", + "in": "query", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "OK", + "content": { + "*/*": { + "schema": { + "type": "string" + } + } + } + } + } + } + } + }, + "components": {} +}