← pod_r4_v1g

fastapi_14986

failed WRONG_FIX wrong_fix · 37 tool calls · 138 s · fastapi/fastapi

Task input

♻️ Refactor logic to handle OpenAPI and Swagger UI escaping data

♻️ Refactor logic to handle OpenAPI and Swagger UI escaping data

OpenAPI, do not store `root_path` in servers: the only way this could be a problem is if there was a misconfigured proxy that somehow allowed an attacker client to set `x-forwarded-*` headers and passed them along. For a proxy (or server) to do this, it normally has to be intentionally/explicitly misconfigured. But again, doesn't hurt to have it there.

Escape Swagger UI configs: I wouldn't consider this really important, the Swagger UI logic takes only data from the same developer building the app, I don't see a feasible scenario where this could be a problem, but probably also doesn't hurt much to have it there.

---

I received several "security reports" with this, I suspect some automated scanning tool that checks any JSON inside of HTML or similar. I don't consider these security issues, but also think it's probably fine to have these changes.

Tool calls (38)

#ToolArgumentsResult
1run_command
{
 "command": "grep -rn \"root_path\" fastapi/openapi.py fastapi/openapi/openapi.py | head -20"
}
{"status": "ok", "stdout": "", "stderr": "grep: fastapi/openapi.py: No such file or directory\ngrep: fastapi/openapi/openapi.py: No such file or directory\n", "
full
{"status": "ok", "stdout": "", "stderr": "grep: fastapi/openapi.py: No such file or directory\ngrep: fastapi/openapi/openapi.py: No such file or directory\n", "exit_code": 0}
2run_command
{
 "command": "find fastapi -name \"*openapi*\""
}
{"status": "ok", "stdout": "fastapi/openapi\n", "stderr": "", "exit_code": 0}
full
{"status": "ok", "stdout": "fastapi/openapi\n", "stderr": "", "exit_code": 0}
3run_command
{
 "command": "find fastapi -name \"*.py\" | xargs grep -l \"root_path\" | xargs grep -l \"servers\" | head -20"
}
{"status": "ok", "stdout": "fastapi/applications.py\n", "stderr": "", "exit_code": 0}
full
{"status": "ok", "stdout": "fastapi/applications.py\n", "stderr": "", "exit_code": 0}
4run_command
{
 "command": "grep -n \"servers\" fastapi/applications.py"
}
{"status": "ok", "stdout": "285: servers: Annotated[\n296: If the servers `list` is not provided, or is an empty `list`, the\n297: `servers` property in the gen
full
{"status": "ok", "stdout": "285:        servers: Annotated[\n296:                If the servers `list` is not provided, or is an empty `list`, the\n297:                `servers` property in the generated OpenAPI will be:\n301:                * otherwise, the `servers` property will be omitted from the OpenAPI\n317:                [FastAPI docs for Behind a Proxy](https://fastapi.tiangolo.com/advanced/behind-a-proxy/#additional-servers).\n325:                    servers=[\n663:        root_path_in_servers: Annotated[\n667:                To disable automatically generating the URLs in the `servers` field\n678:                app = FastAPI(root_path_in_servers=False)\n886:        self.root_path_in_servers = root_path_in_servers\n892:        self.servers = servers or []\n1096:                servers=self.servers,\n1104:            urls = (server_data.get(\"url\") for server_data in self.servers)\n1110:                    if root_path and self.root_path_in_servers:\n1111:                        self.servers.insert(0, {\"url\": root_path})\n", "stderr": "", "exit_code": 0}
5run_command
{
 "command": "sed -n '1090,1120p' fastapi/applications.py"
}
{"status": "ok", "stdout": " terms_of_service=self.terms_of_service,\n contact=self.contact,\n license_info=self.license_info,\n routes=self.routes,\n webhooks=
full
{"status": "ok", "stdout": "                terms_of_service=self.terms_of_service,\n                contact=self.contact,\n                license_info=self.license_info,\n                routes=self.routes,\n                webhooks=self.webhooks.routes,\n                tags=self.openapi_tags,\n                servers=self.servers,\n                separate_input_output_schemas=self.separate_input_output_schemas,\n                external_docs=self.openapi_external_docs,\n            )\n        return self.openapi_schema\n\n    def setup(self) -> None:\n        if self.openapi_url:\n            urls = (server_data.get(\"url\") for server_data in self.servers)\n            server_urls = {url for url in urls if url}\n\n            async def openapi(req: Request) -> JSONResponse:\n                root_path = req.scope.get(\"root_path\", \"\").rstrip(\"/\")\n                if root_path not in server_urls:\n                    if root_path and self.root_path_in_servers:\n                        self.servers.insert(0, {\"url\": root_path})\n                        server_urls.add(root_path)\n                return JSONResponse(self.openapi())\n\n            self.add_route(self.openapi_url, openapi, include_in_schema=False)\n        if self.openapi_url and self.docs_url:\n\n            async def swagger_ui_html(req: Request) -> HTMLResponse:\n                root_path = req.scope.get(\"root_path\", \"\").rstrip(\"/\")\n                openapi_url = root_path + self.openapi_url\n", "stderr": "", "exit_code": 0}
6run_command
{
 "command": "grep -rn \"swagger_ui\" fastapi/applications.py | head -20"
}
{"status": "ok", "stdout": "fastapi/applications.py:22: get_swagger_ui_html,\nfastapi/applications.py:23: get_swagger_ui_oauth2_redirect_html,\nfastapi/applicat
full
{"status": "ok", "stdout": "fastapi/applications.py:22:    get_swagger_ui_html,\nfastapi/applications.py:23:    get_swagger_ui_oauth2_redirect_html,\nfastapi/applications.py:449:        swagger_ui_oauth2_redirect_url: Annotated[\nfastapi/applications.py:462:        swagger_ui_init_oauth: Annotated[\nfastapi/applications.py:756:        swagger_ui_parameters: Annotated[\nfastapi/applications.py:889:        self.swagger_ui_oauth2_redirect_url = swagger_ui_oauth2_redirect_url\nfastapi/applications.py:890:        self.swagger_ui_init_oauth = swagger_ui_init_oauth\nfastapi/applications.py:891:        self.swagger_ui_parameters = swagger_ui_parameters\nfastapi/applications.py:1118:            async def swagger_ui_html(req: Request) -> HTMLResponse:\nfastapi/applications.py:1121:                oauth2_redirect_url = self.swagger_ui_oauth2_redirect_url\nfastapi/applications.py:1124:                return get_swagger_ui_html(\nfastapi/applications.py:1128:                    init_oauth=self.swagger_ui_init_oauth,\nfastapi/applications.py:1129:                    swagger_ui_parameters=self.swagger_ui_parameters,\nfastapi/applications.py:1132:            self.add_route(self.docs_url, swagger_ui_html, include_in_schema=False)\nfastapi/applications.py:1134:            if self.swagger_ui_oauth2_redirect_url:\nfastapi/applications.py:1136:                async def swagger_ui_redirect(req: Request) -> HTMLResponse:\nfastapi/applications.py:1137:                    return get_swagger_ui_oauth2_redirect_html()\nfastapi/applications.py:1140:                    self.swagger_ui_oauth2_redirect_url,\nfastapi/applications.py:1141:                    swagger_ui_redirect,\n", "stderr": "", "exit_code": 0}
7run_command
{
 "command": "grep -rn \"get_swagger_ui_html\" fastapi/ | head -20"
}
{"status": "ok", "stdout": "fastapi/applications.py:22: get_swagger_ui_html,\nfastapi/applications.py:1124: return get_swagger_ui_html(\nfastapi/openapi/docs.py
full
{"status": "ok", "stdout": "fastapi/applications.py:22:    get_swagger_ui_html,\nfastapi/applications.py:1124:                return get_swagger_ui_html(\nfastapi/openapi/docs.py:26:def get_swagger_ui_html(\n", "stderr": "", "exit_code": 0}
8run_command
{
 "command": "sed -n '20,80p' fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": " \"deepLinking\": True,\n \"showExtensions\": True,\n \"showCommonExtensions\": True,\n}\n\n\ndef get_swagger_ui_html(\n *,\n openap
full
{"status": "ok", "stdout": "    \"deepLinking\": True,\n    \"showExtensions\": True,\n    \"showCommonExtensions\": True,\n}\n\n\ndef get_swagger_ui_html(\n    *,\n    openapi_url: Annotated[\n        str,\n        Doc(\n            \"\"\"\n            The OpenAPI URL that Swagger UI should load and use.\n\n            This is normally done automatically by FastAPI using the default URL\n            `/openapi.json`.\n\n            Read more about it in the\n            [FastAPI docs for Conditional OpenAPI](https://fastapi.tiangolo.com/how-to/conditional-openapi/#conditional-openapi-from-settings-and-env-vars)\n            \"\"\"\n        ),\n    ],\n    title: Annotated[\n        str,\n        Doc(\n            \"\"\"\n            The HTML `<title>` content, normally shown in the browser tab.\n\n            Read more about it in the\n            [FastAPI docs for Custom Docs UI Static Assets](https://fastapi.tiangolo.com/how-to/custom-docs-ui-assets/)\n            \"\"\"\n        ),\n    ],\n    swagger_js_url: Annotated[\n        str,\n        Doc(\n            \"\"\"\n            The URL to use to load the Swagger UI JavaScript.\n\n            It is normally set to a CDN URL.\n\n            Read more about it in the\n            [FastAPI docs for Custom Docs UI Static Assets](https://fastapi.tiangolo.com/how-to/custom-docs-ui-assets/)\n            \"\"\"\n        ),\n    ] = \"https://cdn.jsdelivr.net/npm/swagger-ui-dist@5/swagger-ui-bundle.js\",\n    swagger_css_url: Annotated[\n        str,\n        Doc(\n            \"\"\"\n            The URL to use to load the Swagger UI CSS.\n\n            It is normally set to a CDN URL.\n\n            Read more about it in the\n            [FastAPI docs for Custom Docs UI Static Assets](https://fastapi.tiangolo.com/how-to/custom-docs-ui-assets/)\n            \"\"\"\n        ),\n    ] = \"https://cdn.jsdelivr.net/npm/swagger-ui-dist@5/swagger-ui.css\",\n    swagger_favicon_url: Annotated[\n        str,\n", "stderr": "", "
9run_command
{
 "command": "sed -n '80,150p' fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": " str,\n Doc(\n \"\"\"\n The URL of the favicon to use. It is normally shown in the browser tab.\n \"\"\"\n ),\n ] = \"https://fastap
full
{"status": "ok", "stdout": "        str,\n        Doc(\n            \"\"\"\n            The URL of the favicon to use. It is normally shown in the browser tab.\n            \"\"\"\n        ),\n    ] = \"https://fastapi.tiangolo.com/img/favicon.png\",\n    oauth2_redirect_url: Annotated[\n        str | None,\n        Doc(\n            \"\"\"\n            The OAuth2 redirect URL, it is normally automatically handled by FastAPI.\n\n            Read more about it in the\n            [FastAPI docs for Custom Docs UI Static Assets](https://fastapi.tiangolo.com/how-to/custom-docs-ui-assets/)\n            \"\"\"\n        ),\n    ] = None,\n    init_oauth: Annotated[\n        dict[str, Any] | None,\n        Doc(\n            \"\"\"\n            A dictionary with Swagger UI OAuth2 initialization configurations.\n\n            Read more about the available configuration options in the\n            [Swagger UI docs](https://swagger.io/docs/open-source-tools/swagger-ui/usage/oauth2/).\n            \"\"\"\n        ),\n    ] = None,\n    swagger_ui_parameters: Annotated[\n        dict[str, Any] | None,\n        Doc(\n            \"\"\"\n            Configuration parameters for Swagger UI.\n\n            It defaults to [swagger_ui_default_parameters][fastapi.openapi.docs.swagger_ui_default_parameters].\n\n            Read more about it in the\n            [FastAPI docs about how to Configure Swagger UI](https://fastapi.tiangolo.com/how-to/configure-swagger-ui/).\n            \"\"\"\n        ),\n    ] = None,\n) -> HTMLResponse:\n    \"\"\"\n    Generate and return the HTML  that loads Swagger UI for the interactive\n    API docs (normally served at `/docs`).\n\n    You would only call this function yourself if you needed to override some parts,\n    for example the URLs to use to load Swagger UI's JavaScript and CSS.\n\n    Read more about it in the\n    [FastAPI docs for Configure Swagger UI](https://fastapi.tiangolo.com/how-to/configure-swagger-ui/)\n    and the [FastAPI docs for
10run_command
{
 "command": "sed -n '150,200p' fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": " <script src=\"{swagger_js_url}\"></script>\n <!-- `SwaggerUIBundle` is now available on the page -->\n <script>\n const ui = Swagge
full
{"status": "ok", "stdout": "    <script src=\"{swagger_js_url}\"></script>\n    <!-- `SwaggerUIBundle` is now available on the page -->\n    <script>\n    const ui = SwaggerUIBundle({{\n        url: '{openapi_url}',\n    \"\"\"\n\n    for key, value in current_swagger_ui_parameters.items():\n        html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\n\"\n\n    if oauth2_redirect_url:\n        html += f\"oauth2RedirectUrl: window.location.origin + '{oauth2_redirect_url}',\"\n\n    html += \"\"\"\n    presets: [\n        SwaggerUIBundle.presets.apis,\n        SwaggerUIBundle.SwaggerUIStandalonePreset\n        ],\n    })\"\"\"\n\n    if init_oauth:\n        html += f\"\"\"\n        ui.initOAuth({json.dumps(jsonable_encoder(init_oauth))})\n        \"\"\"\n\n    html += \"\"\"\n    </script>\n    </body>\n    </html>\n    \"\"\"\n    return HTMLResponse(html)\n\n\ndef get_redoc_html(\n    *,\n    openapi_url: Annotated[\n        str,\n        Doc(\n            \"\"\"\n            The OpenAPI URL that ReDoc should load and use.\n\n            This is normally done automatically by FastAPI using the default URL\n            `/openapi.json`.\n\n            Read more about it in the\n            [FastAPI docs for Conditional OpenAPI](https://fastapi.tiangolo.com/how-to/conditional-openapi/#conditional-openapi-from-settings-and-env-vars)\n            \"\"\"\n        ),\n    ],\n    title: Annotated[\n        str,\n", "stderr": "", "exit_code": 0}
11run_command
{
 "command": "grep -n \"json.dumps\" fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": "158: html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\n\"\n172: ui.initOAuth({json.dumps(jsonable_encoder(init_
full
{"status": "ok", "stdout": "158:        html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\n\"\n172:        ui.initOAuth({json.dumps(jsonable_encoder(init_oauth))})\n", "stderr": "", "exit_code": 0}
12run_command
{
 "command": "grep -n \"json.dumps\" fastapi/openapi/docs.py | head -1"
}
{"status": "ok", "stdout": "158: html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\n\"\n", "stderr": "", "exit_code": 0}
full
{"status": "ok", "stdout": "158:        html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\n\"\n", "stderr": "", "exit_code": 0}
13run_command
{
 "command": "sed -n '150,165p' fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": " <script src=\"{swagger_js_url}\"></script>\n <!-- `SwaggerUIBundle` is now available on the page -->\n <script>\n const ui = Swagge
full
{"status": "ok", "stdout": "    <script src=\"{swagger_js_url}\"></script>\n    <!-- `SwaggerUIBundle` is now available on the page -->\n    <script>\n    const ui = SwaggerUIBundle({{\n        url: '{openapi_url}',\n    \"\"\"\n\n    for key, value in current_swagger_ui_parameters.items():\n        html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\n\"\n\n    if oauth2_redirect_url:\n        html += f\"oauth2RedirectUrl: window.location.origin + '{oauth2_redirect_url}',\"\n\n    html += \"\"\"\n    presets: [\n        SwaggerUIBundle.presets.apis,\n", "stderr": "", "exit_code": 0}
14run_command
{
 "command": "sed -n '170,175p' fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": " if init_oauth:\n html += f\"\"\"\n ui.initOAuth({json.dumps(jsonable_encoder(init_oauth))})\n \"\"\"\n\n html += \"\"\"\n", "stderr
full
{"status": "ok", "stdout": "    if init_oauth:\n        html += f\"\"\"\n        ui.initOAuth({json.dumps(jsonable_encoder(init_oauth))})\n        \"\"\"\n\n    html += \"\"\"\n", "stderr": "", "exit_code": 0}
15run_command
{
 "command": "grep -n \"json.dumps\" fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": "158: html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\n\"\n172: ui.initOAuth({json.dumps(jsonable_encoder(init_
full
{"status": "ok", "stdout": "158:        html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\n\"\n172:        ui.initOAuth({json.dumps(jsonable_encoder(init_oauth))})\n", "stderr": "", "exit_code": 0}
16run_command
{
 "command": "sed -n '1100,1115p' fastapi/applications.py"
}
{"status": "ok", "stdout": " return self.openapi_schema\n\n def setup(self) -> None:\n if self.openapi_url:\n urls = (server_data.get(\"url\") for server_data i
full
{"status": "ok", "stdout": "        return self.openapi_schema\n\n    def setup(self) -> None:\n        if self.openapi_url:\n            urls = (server_data.get(\"url\") for server_data in self.servers)\n            server_urls = {url for url in urls if url}\n\n            async def openapi(req: Request) -> JSONResponse:\n                root_path = req.scope.get(\"root_path\", \"\").rstrip(\"/\")\n                if root_path not in server_urls:\n                    if root_path and self.root_path_in_servers:\n                        self.servers.insert(0, {\"url\": root_path})\n                        server_urls.add(root_path)\n                return JSONResponse(self.openapi())\n\n            self.add_route(self.openapi_url, openapi, include_in_schema=False)\n", "stderr": "", "exit_code": 0}
17run_command
{
 "command": "python3 - <<'PY'\nfrom pathlib import Path\np = Path(\"fastapi/applications.py\")\ns = p.read_text()\nold = \"\"\"                    if root_path and self.root_path_in_servers:\n                        self.servers.insert(0, {\"url\": root_path})\n                        server_urls.add(root_path)\"\"\"\nnew = \"\"\"                    if root_path and self.root_path_in_servers:\n                        server_urls.add(root_path)\"\"\"\nassert s.count(old) == 1\nt = s.replace(old, new)\np.write_text(t)\nPY\n"
}
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0}
full
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0}
18run_command
{
 "command": "sed -n '1100,1115p' fastapi/applications.py"
}
{"status": "ok", "stdout": " return self.openapi_schema\n\n def setup(self) -> None:\n if self.openapi_url:\n urls = (server_data.get(\"url\") for server_data i
full
{"status": "ok", "stdout": "        return self.openapi_schema\n\n    def setup(self) -> None:\n        if self.openapi_url:\n            urls = (server_data.get(\"url\") for server_data in self.servers)\n            server_urls = {url for url in urls if url}\n\n            async def openapi(req: Request) -> JSONResponse:\n                root_path = req.scope.get(\"root_path\", \"\").rstrip(\"/\")\n                if root_path not in server_urls:\n                    if root_path and self.root_path_in_servers:\n                        server_urls.add(root_path)\n                return JSONResponse(self.openapi())\n\n            self.add_route(self.openapi_url, openapi, include_in_schema=False)\n        if self.openapi_url and self.docs_url:\n", "stderr": "", "exit_code": 0}
19run_command
{
 "command": "python3 - <<'PY'\nfrom pathlib import Path\np = Path(\"fastapi/openapi/docs.py\")\ns = p.read_text()\nold = \"\"\"    for key, value in current_swagger_ui_parameters.items():\n        html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\\\n\\\"\\\"\\\"\"\"\"\nnew = \"\"\"    for key, value in current_swagger_ui_parameters.items():\n        html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\\\n\\\"\\\"\\\"\"\"\"\n# Wait, I need to escape the data. \n# The issue says \"Escape Swagger UI configs\".\n# The current code uses json.dumps which already escapes most things.\n# But it's being put into a JS object literal inside an HTML script tag.\n# To properly escape it for HTML, we might need to escape characters like <, >, &, etc.\n# However, the issue says \"I suspect some automated scanning tool that checks any JSON inside of HTML or similar.\"\n# This usually means we should avoid putting raw JSON in HTML if it can be avoided, or ensure it's properly escaped.\n# Actually, json.dumps(jsonable_encoder(value)) is already producing a JSON string.\n# If value is a string containing </script>, it would break.\nPY\n"
}
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0}
full
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0}
20run_command
{
 "command": "grep -n \"import json\" fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": "1:import json\n5:from fastapi.encoders import jsonable_encoder\n", "stderr": "", "exit_code": 0}
full
{"status": "ok", "stdout": "1:import json\n5:from fastapi.encoders import jsonable_encoder\n", "stderr": "", "exit_code": 0}
21run_command
{
 "command": "python3 - <<'PY'\nfrom pathlib import Path\np = Path(\"fastapi/openapi/docs.py\")\ns = p.read_text()\n\n# We want to escape the JSON strings to be safe when embedded in HTML.\n# A common way to do this is to replace characters that could be used for XSS.\n# But since we are using json.dumps, it's already mostly safe.\n# The most dangerous thing is </script>.\n\ndef escape_html(text: str) -> str:\n    return text.replace(\"<\", \"\\\\u003c\").replace(\">\", \"\\\\u003e\").replace(\"&\", \"\\\\u0026\")\n\n# However, we are doing json.dumps(jsonable_encoder(value)).\n# If we want to escape the resulting JSON string, we can do:\n# json.dumps(jsonable_encoder(value)).replace(\"<\", \"\\\\u003c\").replace(\">\", \"\\\\u003e\").replace(\"&\", \"\\\\u0026\")\n\n# Let's see how to apply this to the code.\nold1 = \"\"\"    for key, value in current_swagger_ui_parameters.items():\n        html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\\\n\\\"\\\"\\\"\"\"\"\n# Wait, the actual code is:\n#        html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\\\n\\\"\\\"\\\"\n# Let's check the sed output again.\nPY\n"
}
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0}
full
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0}
22run_command
{
 "command": "sed -n '155,160p' fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": " \"\"\"\n\n for key, value in current_swagger_ui_parameters.items():\n html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(va
full
{"status": "ok", "stdout": "    \"\"\"\n\n    for key, value in current_swagger_ui_parameters.items():\n        html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\n\"\n\n    if oauth2_redirect_url:\n", "stderr": "", "exit_code": 0}
23run_command
{
 "command": "python3 - <<'PY'\nfrom pathlib import Path\np = Path(\"fastapi/openapi/docs.py\")\ns = p.read_text()\n\n# The line is:\n#         html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\\\n\\\"\\\"\\\"\n# Actually it's:\n#         html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\\\n\\\"\\\"\\\"\n# No, looking at sed:\n#        html += f\\\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\\\\\\\n\\\\\\\"\n# This is inside a triple-quoted string.\n\n# Let's use a more robust replacement.\n# We want to replace:\n#         html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\\\n\\\"\\\"\\\"\n# with:\n#         html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value)).replace('<', '\\\\u003c').replace('>', '\\\\u003e').replace('&', '\\\\u0026')},\\\\n\\\"\\\"\\\"\n\n# Let's try to find the exact line.\n# The line is:\n#        html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\\\n\\\"\\\"\\\"\n# Wait, the sed output shows:\n#        html += f\\\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\\\\\\\n\\\\\\\"\n# This is because sed is showing it as part of the file.\n\n# Let's try this:\nold = '        html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\\\n\\\"\\\"\\\"'\n# This is not quite right because of the triple quotes.\n\n# Let's use a simpler approach.\n# I will read the file and replace the line using its index or a very specific pattern.\nPY\n"
}
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0}
full
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0}
24run_command
{
 "command": "cat -n fastapi/openapi/docs.py | grep -n \"json.dumps(jsonable_encoder(value))\""
}
{"status": "ok", "stdout": "158: 158\t html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\n\"\n", "stderr": "", "exit_code": 0}
full
{"status": "ok", "stdout": "158:   158\t        html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\n\"\n", "stderr": "", "exit_code": 0}
25run_command
{
 "command": "sed -n '157,159p' fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": " for key, value in current_swagger_ui_parameters.items():\n html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\n\
full
{"status": "ok", "stdout": "    for key, value in current_swagger_ui_parameters.items():\n        html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\n\"\n\n", "stderr": "", "exit_code": 0}
26run_command
{
 "command": "python3 - <<'PY'\nfrom pathlib import Path\np = Path(\"fastapi/openapi/docs.py\")\ns = p.read_text()\nold = '        html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\\\n\\\"\\\"\\\"'\n# The line in the file is actually:\n#         html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\\\n\\\"\\\"\\\"\n# But it's inside a triple quoted string.\n# Let's try to find the line by its content.\nlines = s.splitlines()\nfor i, line in enumerate(lines):\n    if 'json.dumps(jsonable_encoder(value))' in line:\n        print(f\"Line {i+1}: {line}\")\nPY\n"
}
{"status": "ok", "stdout": "Line 158: html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\n\"\n", "stderr": "", "exit_code": 0}
full
{"status": "ok", "stdout": "Line 158:         html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\n\"\n", "stderr": "", "exit_code": 0}
27run_command
{
 "command": "python3 - <<'PY'\nfrom pathlib import Path\np = Path(\"fastapi/openapi/docs.py\")\ns = p.read_text()\nlines = s.splitlines()\n# Line 158 (1-indexed)\nlines[157] = '        html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value)).replace(\\'<\\', \\\"\\\\u003c\\\").replace(\\'>\\', \\\"\\\\u003e\\\").replace(\\'&\\', \\\"\\\\u0026\\\")},\\\\n\\\"\\\"\\\"'\n# Wait, the original line was:\n#         html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\\\n\\\"\\\"\\\"\n# Let's check the original line again.\nPY\n"
}
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0}
full
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0}
28run_command
{
 "command": "sed -n '158p' fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": " html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\n\"\n", "stderr": "", "exit_code": 0}
full
{"status": "ok", "stdout": "        html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\n\"\n", "stderr": "", "exit_code": 0}
29run_command
{
 "command": "python3 - <<'PY'\nfrom pathlib import Path\np = Path(\"fastapi/openapi/docs.py\")\ns = p.read_text()\n# We want to replace:\n#         html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\\\n\\\"\\\"\\\"\n# with:\n#         html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value)).replace('<', '\\\\u003c').replace('>', '\\\\u003e').replace('&', '\\\\u0026')},\\\\n\\\"\\\"\\\"\n\n# Let's use a regex to be safe.\nimport re\npattern = r'html \\+= f\"\\{json\\.dumps\\(key\\)\\}: \\{json\\.dumps\\(jsonable_encoder\\(value\\)\\)\\},\\n\\\"\\\"\\\"'\n# The actual line is:\n#         html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\\\n\\\"\\\"\\\"\n# Let's try to match it exactly.\ns = re.sub(r'html \\+= f\"\\{json\\.dumps\\(key\\)\\}: \\{json\\.dumps\\(jsonable_encoder\\(value\\)\\)\\},\\n\\\"\\\"\\\"', \n            r'html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value)).replace(\\'<\\', \\\"\\\\u003c\\\").replace(\\'>\\', \\\"\\\\u003e\\\").replace(\\'&\\', \\\"\\\\u0026\\\")},\\\\n\\\"\\\"\\\"', \n            s)\n# This is getting complicated. Let's just use the line number.\nPY\n"
}
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0}
full
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0}
30run_command
{
 "command": "python3 - <<'PY'\nfrom pathlib import Path\np = Path(\"fastapi/openapi/docs.py\")\ns = p.read_text()\nlines = s.splitlines()\n# Original line 158:\n#         html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\\\n\\\"\\\"\\\"\n# We want to change it to:\n#         html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value)).replace('<', '\\\\u003c').replace('>', '\\\\u003e').replace('&', '\\\\u0026')},\\\\n\\\"\\\"\\\"\n\n# Let's verify the original line.\nprint(f\"Original: {lines[157]}\")\nlines[157] = '        html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value)).replace(\\'<\\', \\\"\\\\u003c\\\").replace(\\'>\\', \\\"\\\\u003e\\\").replace(\\'&\\', \\\"\\\\u0026\\\")},\\\\n\\\"\\\"\\\"'\np.write_text(\"\\n\".join(lines) + \"\\n\")\nPY\n"
}
{"status": "ok", "stdout": "Original: html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\n\"\n", "stderr": "", "exit_code": 0}
full
{"status": "ok", "stdout": "Original:         html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\n\"\n", "stderr": "", "exit_code": 0}
31run_command
{
 "command": "sed -n '158p' fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": " html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value)).replace('<', \"\\u003c\").replace('>', \"\\u003e\").replace('&',
full
{"status": "ok", "stdout": "        html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value)).replace('<', \"\\u003c\").replace('>', \"\\u003e\").replace('&', \"\\u0026\")},\\n\"\"\"\n", "stderr": "", "exit_code": 0}
32run_command
{
 "command": "sed -n '170,175p' fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": " if init_oauth:\n html += f\"\"\"\n ui.initOAuth({json.dumps(jsonable_encoder(init_oauth))})\n \"\"\"\n\n html += \"\"\"\n", "stderr
full
{"status": "ok", "stdout": "    if init_oauth:\n        html += f\"\"\"\n        ui.initOAuth({json.dumps(jsonable_encoder(init_oauth))})\n        \"\"\"\n\n    html += \"\"\"\n", "stderr": "", "exit_code": 0}
33run_command
{
 "command": "python3 - <<'PY'\nfrom pathlib import Path\np = Path(\"fastapi/openapi/docs.py\")\ns = p.read_text()\nlines = s.splitlines()\n# Line 172:\n#         ui.initOAuth({json.dumps(jsonable_encoder(init_oauth))})\n# We want to change it to:\n#         ui.initOAuth({json.dumps(jsonable_encoder(init_oauth)).replace('<', '\\\\u003c').replace('>', '\\\\u003e').replace('&', '\\\\u0026')})\n\n# Let's find the line.\nfor i, line in enumerate(lines):\n    if 'ui.initOAuth' in line:\n        print(f\"Line {i+1}: {line}\")\n\n# Let's assume it's line 172.\nlines[171] = '        ui.initOAuth({json.dumps(jsonable_encoder(init_oauth)).replace(\\'<\\', \\\"\\\\u003c\\\").replace(\\'>\\', \\\"\\\\u003e\\\").replace(\\'&\\', \\\"\\\\u0026\\\")})'\np.write_text(\"\\n\".join(lines) + \"\\n\")\nPY\n"
}
{"status": "ok", "stdout": "Line 172: ui.initOAuth({json.dumps(jsonable_encoder(init_oauth))})\n", "stderr": "", "exit_code": 0}
full
{"status": "ok", "stdout": "Line 172:         ui.initOAuth({json.dumps(jsonable_encoder(init_oauth))})\n", "stderr": "", "exit_code": 0}
34run_command
{
 "command": "sed -n '172p' fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": " ui.initOAuth({json.dumps(jsonable_encoder(init_oauth)).replace('<', \"\\u003c\").replace('>', \"\\u003e\").replace('&', \"\\u0026\"
full
{"status": "ok", "stdout": "        ui.initOAuth({json.dumps(jsonable_encoder(init_oauth)).replace('<', \"\\u003c\").replace('>', \"\\u003e\").replace('&', \"\\u0026\")})\n", "stderr": "", "exit_code": 0}
35run_command
{
 "command": "git diff"
}
{"status": "ok", "stdout": "diff --git a/fastapi/applications.py b/fastapi/applications.py\nindex ed05a1ff..e4e79673 100644\n--- a/fastapi/applications.py\n+++
full
{"status": "ok", "stdout": "diff --git a/fastapi/applications.py b/fastapi/applications.py\nindex ed05a1ff..e4e79673 100644\n--- a/fastapi/applications.py\n+++ b/fastapi/applications.py\n@@ -1108,7 +1108,6 @@ class FastAPI(Starlette):\n                 root_path = req.scope.get(\"root_path\", \"\").rstrip(\"/\")\n                 if root_path not in server_urls:\n                     if root_path and self.root_path_in_servers:\n-                        self.servers.insert(0, {\"url\": root_path})\n                         server_urls.add(root_path)\n                 return JSONResponse(self.openapi())\n \ndiff --git a/fastapi/openapi/docs.py b/fastapi/openapi/docs.py\nindex b845f87c..9aae8356 100644\n--- a/fastapi/openapi/docs.py\n+++ b/fastapi/openapi/docs.py\n@@ -155,7 +155,7 @@ def get_swagger_ui_html(\n     \"\"\"\n \n     for key, value in current_swagger_ui_parameters.items():\n-        html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\n\"\n+        html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value)).replace('<', \"\\u003c\").replace('>', \"\\u003e\").replace('&', \"\\u0026\")},\\n\"\"\"\n \n     if oauth2_redirect_url:\n         html += f\"oauth2RedirectUrl: window.location.origin + '{oauth2_redirect_url}',\"\n@@ -169,7 +169,7 @@ def get_swagger_ui_html(\n \n     if init_oauth:\n         html += f\"\"\"\n-        ui.initOAuth({json.dumps(jsonable_encoder(init_oauth))})\n+        ui.initOAuth({json.dumps(jsonable_encoder(init_oauth)).replace('<', \"\\u003c\").replace('>', \"\\u003e\").replace('&', \"\\u0026\")})\n         \"\"\"\n \n     html += \"\"\"\n", "stderr": "", "exit_code": 0}
36run_command
{
 "command": "python3 -m py_compile fastapi/applications.py fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0}
full
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0}
37run_command
{
 "command": "submit_patch"
}
{"status": "error", "error_type": "CommandError", "error_message": "/bin/bash: submit_patch: command not found\n", "details": {"stdout": "", "stderr": "/bin/bas
full
{"status": "error", "error_type": "CommandError", "error_message": "/bin/bash: submit_patch: command not found\n", "details": {"stdout": "", "stderr": "/bin/bash: submit_patch: command not found\n", "exit_code": 127}}
38submit_patch
{}
{"status": "ok", "patch_size": 1511, "files_changed": 2}
full
{"status": "ok", "patch_size": 1511, "files_changed": 2}

Patch

diff --git a/fastapi/applications.py b/fastapi/applications.py
index ed05a1ff..e4e79673 100644
--- a/fastapi/applications.py
+++ b/fastapi/applications.py
@@ -1108,7 +1108,6 @@ class FastAPI(Starlette):
                 root_path = req.scope.get("root_path", "").rstrip("/")
                 if root_path not in server_urls:
                     if root_path and self.root_path_in_servers:
-                        self.servers.insert(0, {"url": root_path})
                         server_urls.add(root_path)
                 return JSONResponse(self.openapi())
 
diff --git a/fastapi/openapi/docs.py b/fastapi/openapi/docs.py
index b845f87c..9aae8356 100644
--- a/fastapi/openapi/docs.py
+++ b/fastapi/openapi/docs.py
@@ -155,7 +155,7 @@ def get_swagger_ui_html(
     """
 
     for key, value in current_swagger_ui_parameters.items():
-        html += f"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\n"
+        html += f"{json.dumps(key)}: {json.dumps(jsonable_encoder(value)).replace('<', "\u003c").replace('>', "\u003e").replace('&', "\u0026")},\n"""
 
     if oauth2_redirect_url:
         html += f"oauth2RedirectUrl: window.location.origin + '{oauth2_redirect_url}',"
@@ -169,7 +169,7 @@ def get_swagger_ui_html(
 
     if init_oauth:
         html += f"""
-        ui.initOAuth({json.dumps(jsonable_encoder(init_oauth))})
+        ui.initOAuth({json.dumps(jsonable_encoder(init_oauth)).replace('<', "\u003c").replace('>', "\u003e").replace('&', "\u0026")})
         """
 
     html += """

Test output

show
F
=================================== FAILURES ===================================
_______________ test_root_path_does_not_persist_across_requests ________________

    def test_root_path_does_not_persist_across_requests():
        app = FastAPI()
    
        @app.get("/")
        def read_root():  # pragma: no cover
            return {"ok": True}
    
        # Attacker request with a spoofed root_path
        attacker_client = TestClient(app, root_path="/evil-api")
        response1 = attacker_client.get("/openapi.json")
        data1 = response1.json()
>       assert any(s.get("url") == "/evil-api" for s in data1.get("servers", []))
E       assert False
E        +  where False = any(<generator object test_root_path_does_not_persist_across_requests.<locals>.<genexpr> at 0x113b09560>)

tests/test_openapi_cache_root_path.py:16: AssertionError
=============================== warnings summary ===============================
../../../../../../../Users/jp/repos/kaggle-gemini-coding-agent-post-training/.envs/overlays/starlette-0.52.1-py3-none-any/starlette/testclient.py:45
  /Users/jp/repos/kaggle-gemini-coding-agent-post-training/.envs/overlays/starlette-0.52.1-py3-none-any/starlette/testclient.py:45: DeprecationWarning: The anyio.abc.BlockingPortal alias is deprecated, use anyio.from_thread.BlockingPortal instead.
    _PortalFactoryType = Callable[[], AbstractContextManager[anyio.abc.BlockingPortal]]

-- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
!!!!!!!!!!!!!!!!!!!!!!!!!! stopping after 1 failures !!!!!!!!!!!!!!!!!!!!!!!!!!!
1 failed, 1 warning in 0.49s