kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content

Summary

ValidateResponse panics on a nil pointer when a spec declares a response header with content instead of schema. doc.Validate() accepts that document, so the crash comes from a spec the library just called valid.

Same class as GHSA-jpcw-4wr7-c3vq, which covered the request-parameter case in v0.144.0; this is the response-header path.

Affects github.com/getkin/kin-openapi <= v0.145.0. Reproduced on master 947498e5a6bd, Go 1.26.

Details

A content-typed response header has headerRef.Value.Schema == nil.

validate_response.go:181 passes it straight through:

if decodedValue, found, err = decodeValue(dec, headerName, sm, headerRef.Value.Schema, headerRef.Value.Required); err != nil {

and req_resp_decoder.go:273 is where it lands:

if len(schema.Value.AllOf) > 0 {

Two things I checked rather than assumed. The response does not need to carry the header; declaring it is enough, and then every call for that operation panics. And the body path is fine, :114 returns early on a nil schema, so this is headers only. The PoC keeps the body case as a control.

PoC

Drop into openapi3filter/ and run:

go test ./openapi3filter/ -run NilSchema -v

package openapi3filter_test

import (
	"context"
	"io"
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"

	"github.com/getkin/kin-openapi/openapi3"
	"github.com/getkin/kin-openapi/openapi3filter"
	"github.com/getkin/kin-openapi/routers"
)

const specBody = `
openapi: 3.0.3
info: {title: poc, version: "1.0.0"}
paths:
  /x:
    get:
      responses:
        "200":
          description: ok
          content:
            application/json: {}
`

const specHeader = `
openapi: 3.0.3
info: {title: poc, version: "1.0.0"}
paths:
  /x:
    get:
      responses:
        "200":
          description: ok
          headers:
            X-Thing:
              content:
                application/json: {}
`

func validatedInput(t *testing.T, spec string, hdr http.Header) *openapi3filter.ResponseValidationInput {
	t.Helper()
	doc, err := openapi3.NewLoader().LoadFromData([]byte(spec))
	if err != nil {
		t.Fatalf("load: %v", err)
	}
	if err := doc.Validate(context.Background()); err != nil {
		t.Fatalf("doc.Validate rejected the spec, so this repro proves nothing: %v", err)
	}
	op := doc.Paths.Find("/x").Get
	req := httptest.NewRequest(http.MethodGet, "/x", nil)
	return &openapi3filter.ResponseValidationInput{
		RequestValidationInput: &openapi3filter.RequestValidationInput{
			Request: req,
			Route:   &routers.Route{Spec: doc, Operation: op, Method: http.MethodGet, Path: "/x"},
		},
		Status: 200,
		Header: hdr,
		Body:   io.NopCloser(strings.NewReader(`{}`)),
	}
}

// Control: body path returns early on a nil schema.
func TestControl_ResponseBodyNilSchema(t *testing.T) {
	in := validatedInput(t, specBody, http.Header{"Content-Type": {"application/json"}})
	defer func() {
		if r := recover(); r != nil {
			t.Errorf("body path panicked, expected clean return: %v", r)
		}
	}()
	if err := openapi3filter.ValidateResponse(context.Background(), in); err != nil {
		t.Errorf("body path returned %v, expected nil", err)
	}
}

// The response does not carry X-Thing. Declaring the header is enough.
func TestResponseHeaderNilSchema(t *testing.T) {
	in := validatedInput(t, specHeader, http.Header{"Content-Type": {"application/json"}})
	if err := openapi3filter.ValidateResponse(context.Background(), in); err != nil {
		t.Fatalf("no panic; got err = %v (already fixed?)", err)
	}
}