← eval8_submission_v1e

fastapi_14986

failed WRONG_FIX wrong_fix · 59 tool calls · 190 s · fastapi/fastapi

Task input

♻️ Refactor logic to handle OpenAPI and Swagger UI escaping data

♻️ Refactor logic to handle OpenAPI and Swagger UI escaping data

OpenAPI, do not store `root_path` in servers: the only way this could be a problem is if there was a misconfigured proxy that somehow allowed an attacker client to set `x-forwarded-*` headers and passed them along. For a proxy (or server) to do this, it normally has to be intentionally/explicitly misconfigured. But again, doesn't hurt to have it there.

Escape Swagger UI configs: I wouldn't consider this really important, the Swagger UI logic takes only data from the same developer building the app, I don't see a feasible scenario where this could be a problem, but probably also doesn't hurt much to have it there.

---

I received several "security reports" with this, I suspect some automated scanning tool that checks any JSON inside of HTML or similar. I don't consider these security issues, but also think it's probably fine to have these changes.

Tool calls (60)

#ToolArgumentsResult
1run_command
{
 "command": "grep -rn \"root_path\" --include=*.py fastapi | grep \"servers\" | head -20"
}
{"status": "ok", "stdout": "fastapi/applications.py:663: root_path_in_servers: Annotated[\nfastapi/applications.py:678: app = FastAPI(root_path_in_servers=False
full
{"status": "ok", "stdout": "fastapi/applications.py:663:        root_path_in_servers: Annotated[\nfastapi/applications.py:678:                app = FastAPI(root_path_in_servers=False)\nfastapi/applications.py:886:        self.root_path_in_servers = root_path_in_servers\nfastapi/applications.py:1110:                    if root_path and self.root_path_in_servers:\nfastapi/applications.py:1111:                        self.servers.insert(0, {\"url\": root_path})\n", "stderr": "", "exit_code": 0}
2run_command
{
 "command": "grep -rn \"swagger_ui\" --include=*.py fastapi | head -20"
}
{"status": "ok", "stdout": "fastapi/applications.py:22: get_swagger_ui_html,\nfastapi/applications.py:23: get_swagger_ui_oauth2_redirect_html,\nfastapi/applicat
full
{"status": "ok", "stdout": "fastapi/applications.py:22:    get_swagger_ui_html,\nfastapi/applications.py:23:    get_swagger_ui_oauth2_redirect_html,\nfastapi/applications.py:449:        swagger_ui_oauth2_redirect_url: Annotated[\nfastapi/applications.py:462:        swagger_ui_init_oauth: Annotated[\nfastapi/applications.py:756:        swagger_ui_parameters: Annotated[\nfastapi/applications.py:889:        self.swagger_ui_oauth2_redirect_url = swagger_ui_oauth2_redirect_url\nfastapi/applications.py:890:        self.swagger_ui_init_oauth = swagger_ui_init_oauth\nfastapi/applications.py:891:        self.swagger_ui_parameters = swagger_ui_parameters\nfastapi/applications.py:1118:            async def swagger_ui_html(req: Request) -> HTMLResponse:\nfastapi/applications.py:1121:                oauth2_redirect_url = self.swagger_ui_oauth2_redirect_url\nfastapi/applications.py:1124:                return get_swagger_ui_html(\nfastapi/applications.py:1128:                    init_oauth=self.swagger_ui_init_oauth,\nfastapi/applications.py:1129:                    swagger_ui_parameters=self.swagger_ui_parameters,\nfastapi/applications.py:1132:            self.add_route(self.docs_url, swagger_ui_html, include_in_schema=False)\nfastapi/applications.py:1134:            if self.swagger_ui_oauth2_redirect_url:\nfastapi/applications.py:1136:                async def swagger_ui_redirect(req: Request) -> HTMLResponse:\nfastapi/applications.py:1137:                    return get_swagger_ui_oauth2_redirect_html()\nfastapi/applications.py:1140:                    self.swagger_ui_oauth2_redirect_url,\nfastapi/applications.py:1141:                    swagger_ui_redirect,\nfastapi/openapi/docs.py:8:swagger_ui_default_parameters: Annotated[\n", "stderr": "", "exit_code": 0}
3run_command
{
 "command": "sed -n '660,680p;880,895p;1100,1145p' fastapi/applications.py"
}
{"status": "ok", "stdout": " \"\"\"\n ),\n ] = \"\",\n root_path_in_servers: Annotated[\n bool,\n Doc(\n \"\"\"\n To disable automatically generating the URLs i
full
{"status": "ok", "stdout": "                \"\"\"\n            ),\n        ] = \"\",\n        root_path_in_servers: Annotated[\n            bool,\n            Doc(\n                \"\"\"\n                To disable automatically generating the URLs in the `servers` field\n                in the autogenerated OpenAPI using the `root_path`.\n\n                Read more about it in the\n                [FastAPI docs for Behind a Proxy](https://fastapi.tiangolo.com/advanced/behind-a-proxy/#disable-automatic-server-from-root-path).\n\n                **Example**\n\n                ```python\n                from fastapi import FastAPI\n\n                app = FastAPI(root_path_in_servers=False)\n                ```\n                \"\"\"\n        self.version = version\n        self.terms_of_service = terms_of_service\n        self.contact = contact\n        self.license_info = license_info\n        self.openapi_url = openapi_url\n        self.openapi_tags = openapi_tags\n        self.root_path_in_servers = root_path_in_servers\n        self.docs_url = docs_url\n        self.redoc_url = redoc_url\n        self.swagger_ui_oauth2_redirect_url = swagger_ui_oauth2_redirect_url\n        self.swagger_ui_init_oauth = swagger_ui_init_oauth\n        self.swagger_ui_parameters = swagger_ui_parameters\n        self.servers = servers or []\n        self.separate_input_output_schemas = separate_input_output_schemas\n        self.openapi_external_docs = openapi_external_docs\n        self.extra = extra\n        return self.openapi_schema\n\n    def setup(self) -> None:\n        if self.openapi_url:\n            urls = (server_data.get(\"url\") for server_data in self.servers)\n            server_urls = {url for url in urls if url}\n\n            async def openapi(req: Request) -> JSONResponse:\n                root_path = req.scope.get(\"root_path\", \"\").rstrip(\"/\")\n                if root_path not in server_urls:\n                    if root_path and self.root_path_in_servers
4run_command
{
 "command": "grep -n \"def get_swagger_ui_html\" fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": "26:def get_swagger_ui_html(\n", "stderr": "", "exit_code": 0}
full
{"status": "ok", "stdout": "26:def get_swagger_ui_html(\n", "stderr": "", "exit_code": 0}
5run_command
{
 "command": "sed -n '20,60p' fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": " \"deepLinking\": True,\n \"showExtensions\": True,\n \"showCommonExtensions\": True,\n}\n\n\ndef get_swagger_ui_html(\n *,\n openap
full
{"status": "ok", "stdout": "    \"deepLinking\": True,\n    \"showExtensions\": True,\n    \"showCommonExtensions\": True,\n}\n\n\ndef get_swagger_ui_html(\n    *,\n    openapi_url: Annotated[\n        str,\n        Doc(\n            \"\"\"\n            The OpenAPI URL that Swagger UI should load and use.\n\n            This is normally done automatically by FastAPI using the default URL\n            `/openapi.json`.\n\n            Read more about it in the\n            [FastAPI docs for Conditional OpenAPI](https://fastapi.tiangolo.com/how-to/conditional-openapi/#conditional-openapi-from-settings-and-env-vars)\n            \"\"\"\n        ),\n    ],\n    title: Annotated[\n        str,\n        Doc(\n            \"\"\"\n            The HTML `<title>` content, normally shown in the browser tab.\n\n            Read more about it in the\n            [FastAPI docs for Custom Docs UI Static Assets](https://fastapi.tiangolo.com/how-to/custom-docs-ui-assets/)\n            \"\"\"\n        ),\n    ],\n    swagger_js_url: Annotated[\n        str,\n        Doc(\n            \"\"\"\n            The URL to use to load the Swagger UI JavaScript.\n\n            It is normally set to a CDN URL.\n\n", "stderr": "", "exit_code": 0}
6run_command
{
 "command": "sed -n '60,100p' fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": "\n Read more about it in the\n [FastAPI docs for Custom Docs UI Static Assets](https://fastapi.tiangolo.com/how-to/custom-docs-ui-as
full
{"status": "ok", "stdout": "\n            Read more about it in the\n            [FastAPI docs for Custom Docs UI Static Assets](https://fastapi.tiangolo.com/how-to/custom-docs-ui-assets/)\n            \"\"\"\n        ),\n    ] = \"https://cdn.jsdelivr.net/npm/swagger-ui-dist@5/swagger-ui-bundle.js\",\n    swagger_css_url: Annotated[\n        str,\n        Doc(\n            \"\"\"\n            The URL to use to load the Swagger UI CSS.\n\n            It is normally set to a CDN URL.\n\n            Read more about it in the\n            [FastAPI docs for Custom Docs UI Static Assets](https://fastapi.tiangolo.com/how-to/custom-docs-ui-assets/)\n            \"\"\"\n        ),\n    ] = \"https://cdn.jsdelivr.net/npm/swagger-ui-dist@5/swagger-ui.css\",\n    swagger_favicon_url: Annotated[\n        str,\n        Doc(\n            \"\"\"\n            The URL of the favicon to use. It is normally shown in the browser tab.\n            \"\"\"\n        ),\n    ] = \"https://fastapi.tiangolo.com/img/favicon.png\",\n    oauth2_redirect_url: Annotated[\n        str | None,\n        Doc(\n            \"\"\"\n            The OAuth2 redirect URL, it is normally automatically handled by FastAPI.\n\n            Read more about it in the\n            [FastAPI docs for Custom Docs UI Static Assets](https://fastapi.tiangolo.com/how-to/custom-docs-ui-assets/)\n            \"\"\"\n        ),\n    ] = None,\n    init_oauth: Annotated[\n        dict[str, Any] | None,\n        Doc(\n", "stderr": "", "exit_code": 0}
7run_command
{
 "command": "sed -n '100,150p' fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": " Doc(\n \"\"\"\n A dictionary with Swagger UI OAuth2 initialization configurations.\n\n Read more about the available configuration
full
{"status": "ok", "stdout": "        Doc(\n            \"\"\"\n            A dictionary with Swagger UI OAuth2 initialization configurations.\n\n            Read more about the available configuration options in the\n            [Swagger UI docs](https://swagger.io/docs/open-source-tools/swagger-ui/usage/oauth2/).\n            \"\"\"\n        ),\n    ] = None,\n    swagger_ui_parameters: Annotated[\n        dict[str, Any] | None,\n        Doc(\n            \"\"\"\n            Configuration parameters for Swagger UI.\n\n            It defaults to [swagger_ui_default_parameters][fastapi.openapi.docs.swagger_ui_default_parameters].\n\n            Read more about it in the\n            [FastAPI docs about how to Configure Swagger UI](https://fastapi.tiangolo.com/how-to/configure-swagger-ui/).\n            \"\"\"\n        ),\n    ] = None,\n) -> HTMLResponse:\n    \"\"\"\n    Generate and return the HTML  that loads Swagger UI for the interactive\n    API docs (normally served at `/docs`).\n\n    You would only call this function yourself if you needed to override some parts,\n    for example the URLs to use to load Swagger UI's JavaScript and CSS.\n\n    Read more about it in the\n    [FastAPI docs for Configure Swagger UI](https://fastapi.tiangolo.com/how-to/configure-swagger-ui/)\n    and the [FastAPI docs for Custom Docs UI Static Assets (Self-Hosting)](https://fastapi.tiangolo.com/how-to/custom-docs-ui-assets/).\n    \"\"\"\n    current_swagger_ui_parameters = swagger_ui_default_parameters.copy()\n    if swagger_ui_parameters:\n        current_swagger_ui_parameters.update(swagger_ui_parameters)\n\n    html = f\"\"\"\n    <!DOCTYPE html>\n    <html>\n    <head>\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n    <link type=\"text/css\" rel=\"stylesheet\" href=\"{swagger_css_url}\">\n    <link rel=\"shortcut icon\" href=\"{swagger_favicon_url}\">\n    <title>{title}</title>\n    </head>\n    <body>\n    <div id=\"swagger-ui\">\n    </di
8run_command
{
 "command": "sed -n '150,200p' fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": " <script src=\"{swagger_js_url}\"></script>\n <!-- `SwaggerUIBundle` is now available on the page -->\n <script>\n const ui = Swagge
full
{"status": "ok", "stdout": "    <script src=\"{swagger_js_url}\"></script>\n    <!-- `SwaggerUIBundle` is now available on the page -->\n    <script>\n    const ui = SwaggerUIBundle({{\n        url: '{openapi_url}',\n    \"\"\"\n\n    for key, value in current_swagger_ui_parameters.items():\n        html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\n\"\n\n    if oauth2_redirect_url:\n        html += f\"oauth2RedirectUrl: window.location.origin + '{oauth2_redirect_url}',\"\n\n    html += \"\"\"\n    presets: [\n        SwaggerUIBundle.presets.apis,\n        SwaggerUIBundle.SwaggerUIStandalonePreset\n        ],\n    })\"\"\"\n\n    if init_oauth:\n        html += f\"\"\"\n        ui.initOAuth({json.dumps(jsonable_encoder(init_oauth))})\n        \"\"\"\n\n    html += \"\"\"\n    </script>\n    </body>\n    </html>\n    \"\"\"\n    return HTMLResponse(html)\n\n\ndef get_redoc_html(\n    *,\n    openapi_url: Annotated[\n        str,\n        Doc(\n            \"\"\"\n            The OpenAPI URL that ReDoc should load and use.\n\n            This is normally done automatically by FastAPI using the default URL\n            `/openapi.json`.\n\n            Read more about it in the\n            [FastAPI docs for Conditional OpenAPI](https://fastapi.tiangolo.com/how-to/conditional-openapi/#conditional-openapi-from-settings-and-env-vars)\n            \"\"\"\n        ),\n    ],\n    title: Annotated[\n        str,\n", "stderr": "", "exit_code": 0}
9run_command
{
 "command": "grep -n \"self.root_path_in_servers = root_path_in_servers\" fastapi/applications.py"
}
{"status": "ok", "stdout": "886: self.root_path_in_servers = root_path_in_servers\n", "stderr": "", "exit_code": 0}
full
{"status": "ok", "stdout": "886:        self.root_path_in_servers = root_path_in_servers\n", "stderr": "", "exit_code": 0}
10run_command
{
 "command": "grep -n \"if root_path and self.root_path_in_servers:\" fastapi/applications.py"
}
{"status": "ok", "stdout": "1110: if root_path and self.root_path_in_servers:\n", "stderr": "", "exit_code": 0}
full
{"status": "ok", "stdout": "1110:                    if root_path and self.root_path_in_servers:\n", "stderr": "", "exit_code": 0}
11run_command
{
 "command": "sed -n '663,680p' fastapi/applications.py"
}
{"status": "ok", "stdout": " root_path_in_servers: Annotated[\n bool,\n Doc(\n \"\"\"\n To disable automatically generating the URLs in the `servers` field\n in
full
{"status": "ok", "stdout": "        root_path_in_servers: Annotated[\n            bool,\n            Doc(\n                \"\"\"\n                To disable automatically generating the URLs in the `servers` field\n                in the autogenerated OpenAPI using the `root_path`.\n\n                Read more about it in the\n                [FastAPI docs for Behind a Proxy](https://fastapi.tiangolo.com/advanced/behind-a-proxy/#disable-automatic-server-from-root-path).\n\n                **Example**\n\n                ```python\n                from fastapi import FastAPI\n\n                app = FastAPI(root_path_in_servers=False)\n                ```\n                \"\"\"\n", "stderr": "", "exit_code": 0}
12run_command
{
 "command": "sed -n '678,680p' fastapi/applications.py"
}
{"status": "ok", "stdout": " app = FastAPI(root_path_in_servers=False)\n ```\n \"\"\"\n", "stderr": "", "exit_code": 0}
full
{"status": "ok", "stdout": "                app = FastAPI(root_path_in_servers=False)\n                ```\n                \"\"\"\n", "stderr": "", "exit_code": 0}
13run_command
{
 "command": "sed -n '1100,1115p' fastapi/applications.py"
}
{"status": "ok", "stdout": " return self.openapi_schema\n\n def setup(self) -> None:\n if self.openapi_url:\n urls = (server_data.get(\"url\") for server_data i
full
{"status": "ok", "stdout": "        return self.openapi_schema\n\n    def setup(self) -> None:\n        if self.openapi_url:\n            urls = (server_data.get(\"url\") for server_data in self.servers)\n            server_urls = {url for url in urls if url}\n\n            async def openapi(req: Request) -> JSONResponse:\n                root_path = req.scope.get(\"root_path\", \"\").rstrip(\"/\")\n                if root_path not in server_urls:\n                    if root_path and self.root_path_in_servers:\n                        self.servers.insert(0, {\"url\": root_path})\n                        server_urls.add(root_path)\n                return JSONResponse(self.openapi())\n\n            self.add_route(self.openapi_url, openapi, include_in_schema=False)\n", "stderr": "", "exit_code": 0}
14run_command
{
 "command": "run_command: sed -i '663s/bool,/bool = False,/' fastapi/applications.py"
}
{"status": "error", "error_type": "CommandError", "error_message": "/bin/bash: line 1: run_command:: command not found\n", "details": {"stdout": "", "stderr": "
full
{"status": "error", "error_type": "CommandError", "error_message": "/bin/bash: line 1: run_command:: command not found\n", "details": {"stdout": "", "stderr": "/bin/bash: line 1: run_command:: command not found\n", "exit_code": 127}}
15run_command
{
 "command": "sed -i '663s/bool,/bool = False,/' fastapi/applications.py"
}
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0}
full
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0}
16run_command
{
 "command": "sed -n '660,670p' fastapi/applications.py"
}
{"status": "ok", "stdout": " \"\"\"\n ),\n ] = \"\",\n root_path_in_servers: Annotated[\n bool,\n Doc(\n \"\"\"\n To disable automatically generating the URLs i
full
{"status": "ok", "stdout": "                \"\"\"\n            ),\n        ] = \"\",\n        root_path_in_servers: Annotated[\n            bool,\n            Doc(\n                \"\"\"\n                To disable automatically generating the URLs in the `servers` field\n                in the autogenerated OpenAPI using the `root_path`.\n\n                Read more about it in the\n", "stderr": "", "exit_code": 0}
17run_command
{
 "command": "sed -i '663s/bool = False,/bool,/' fastapi/applications.py"
}
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0}
full
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0}
18run_command
{
 "command": "sed -n '660,670p' fastapi/applications.py"
}
{"status": "ok", "stdout": " \"\"\"\n ),\n ] = \"\",\n root_path_in_servers: Annotated[\n bool,\n Doc(\n \"\"\"\n To disable automatically generating the URLs i
full
{"status": "ok", "stdout": "                \"\"\"\n            ),\n        ] = \"\",\n        root_path_in_servers: Annotated[\n            bool,\n            Doc(\n                \"\"\"\n                To disable automatically generating the URLs in the `servers` field\n                in the autogenerated OpenAPI using the `root_path`.\n\n                Read more about it in the\n", "stderr": "", "exit_code": 0}
19run_command
{
 "command": "grep -n \"root_path_in_servers: Annotated[\" fastapi/applications.py"
}
{"status": "error", "error_type": "CommandError", "error_message": "grep: Invalid regular expression\n", "details": {"stdout": "", "stderr": "grep: Invalid regu
full
{"status": "error", "error_type": "CommandError", "error_message": "grep: Invalid regular expression\n", "details": {"stdout": "", "stderr": "grep: Invalid regular expression\n", "exit_code": 2}}
20run_command
{
 "command": "grep -n \"root_path_in_servers\" fastapi/applications.py | head -10"
}
{"status": "ok", "stdout": "663: root_path_in_servers: Annotated[\n678: app = FastAPI(root_path_in_servers=False)\n886: self.root_path_in_servers = root_path_in
full
{"status": "ok", "stdout": "663:        root_path_in_servers: Annotated[\n678:                app = FastAPI(root_path_in_servers=False)\n886:        self.root_path_in_servers = root_path_in_servers\n1110:                    if root_path and self.root_path_in_servers:\n", "stderr": "", "exit_code": 0}
21run_command
{
 "command": "sed -n '660,670p' fastapi/applications.py"
}
{"status": "ok", "stdout": " \"\"\"\n ),\n ] = \"\",\n root_path_in_servers: Annotated[\n bool,\n Doc(\n \"\"\"\n To disable automatically generating the URLs i
full
{"status": "ok", "stdout": "                \"\"\"\n            ),\n        ] = \"\",\n        root_path_in_servers: Annotated[\n            bool,\n            Doc(\n                \"\"\"\n                To disable automatically generating the URLs in the `servers` field\n                in the autogenerated OpenAPI using the `root_path`.\n\n                Read more about it in the\n", "stderr": "", "exit_code": 0}
22run_command
{
 "command": "python3 -c \"\nimport fastapi.applications\nprint(fastapi.applications.FastAPI.__init__.__code__.co_varnames)\n\""
}
{"status": "ok", "stdout": "('self', 'debug', 'routes', 'title', 'summary', 'description', 'version', 'openapi_url', 'openapi_tags', 'servers', 'dependencies',
full
{"status": "ok", "stdout": "('self', 'debug', 'routes', 'title', 'summary', 'description', 'version', 'openapi_url', 'openapi_tags', 'servers', 'dependencies', 'default_response_class', 'redirect_slashes', 'docs_url', 'redoc_url', 'swagger_ui_oauth2_redirect_url', 'swagger_ui_init_oauth', 'middleware', 'exception_handlers', 'on_startup', 'on_shutdown', 'lifespan', 'terms_of_service', 'contact', 'license_info', 'openapi_prefix', 'root_path', 'root_path_in_servers', 'responses', 'callbacks', 'webhooks', 'deprecated', 'include_in_schema', 'swagger_ui_parameters', 'generate_unique_id_function', 'separate_input_output_schemas', 'openapi_external_docs', 'strict_content_type', 'extra')\n", "stderr": "", "exit_code": 0}
23run_command
{
 "command": "sed -n '660,680p' fastapi/applications.py"
}
{"status": "ok", "stdout": " \"\"\"\n ),\n ] = \"\",\n root_path_in_servers: Annotated[\n bool,\n Doc(\n \"\"\"\n To disable automatically generating the URLs i
full
{"status": "ok", "stdout": "                \"\"\"\n            ),\n        ] = \"\",\n        root_path_in_servers: Annotated[\n            bool,\n            Doc(\n                \"\"\"\n                To disable automatically generating the URLs in the `servers` field\n                in the autogenerated OpenAPI using the `root_path`.\n\n                Read more about it in the\n                [FastAPI docs for Behind a Proxy](https://fastapi.tiangolo.com/advanced/behind-a-proxy/#disable-automatic-server-from-root-path).\n\n                **Example**\n\n                ```python\n                from fastapi import FastAPI\n\n                app = FastAPI(root_path_in_servers=False)\n                ```\n                \"\"\"\n", "stderr": "", "exit_code": 0}
24run_command
{
 "command": "sed -n '670,685p' fastapi/applications.py"
}
{"status": "ok", "stdout": " Read more about it in the\n [FastAPI docs for Behind a Proxy](https://fastapi.tiangolo.com/advanced/behind-a-proxy/#disable-automat
full
{"status": "ok", "stdout": "                Read more about it in the\n                [FastAPI docs for Behind a Proxy](https://fastapi.tiangolo.com/advanced/behind-a-proxy/#disable-automatic-server-from-root-path).\n\n                **Example**\n\n                ```python\n                from fastapi import FastAPI\n\n                app = FastAPI(root_path_in_servers=False)\n                ```\n                \"\"\"\n            ),\n        ] = True,\n        responses: Annotated[\n            dict[int | str, dict[str, Any]] | None,\n            Doc(\n", "stderr": "", "exit_code": 0}
25run_command
{
 "command": "sed -n '650,665p' fastapi/applications.py"
}
{"status": "ok", "stdout": " Read more about it at the\n [FastAPI docs for Behind a Proxy](https://fastapi.tiangolo.com/advanced/behind-a-proxy/).\n\n **Example
full
{"status": "ok", "stdout": "                Read more about it at the\n                [FastAPI docs for Behind a Proxy](https://fastapi.tiangolo.com/advanced/behind-a-proxy/).\n\n                **Example**\n\n                ```python\n                from fastapi import FastAPI\n\n                app = FastAPI(root_path=\"/api/v1\")\n                ```\n                \"\"\"\n            ),\n        ] = \"\",\n        root_path_in_servers: Annotated[\n            bool,\n            Doc(\n", "stderr": "", "exit_code": 0}
26run_command
{
 "command": "sed -n '675,685p' fastapi/applications.py"
}
{"status": "ok", "stdout": " ```python\n from fastapi import FastAPI\n\n app = FastAPI(root_path_in_servers=False)\n ```\n \"\"\"\n ),\n ] = True,\n responses:
full
{"status": "ok", "stdout": "                ```python\n                from fastapi import FastAPI\n\n                app = FastAPI(root_path_in_servers=False)\n                ```\n                \"\"\"\n            ),\n        ] = True,\n        responses: Annotated[\n            dict[int | str, dict[str, Any]] | None,\n            Doc(\n", "stderr": "", "exit_code": 0}
27run_command
{
 "command": "sed -n '678,682p' fastapi/applications.py"
}
{"status": "ok", "stdout": " app = FastAPI(root_path_in_servers=False)\n ```\n \"\"\"\n ),\n ] = True,\n", "stderr": "", "exit_code": 0}
full
{"status": "ok", "stdout": "                app = FastAPI(root_path_in_servers=False)\n                ```\n                \"\"\"\n            ),\n        ] = True,\n", "stderr": "", "exit_code": 0}
28run_command
{
 "command": "sed -i '681s/True/False/' fastapi/applications.py"
}
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0}
full
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0}
29run_command
{
 "command": "sed -n '678,682p' fastapi/applications.py"
}
{"status": "ok", "stdout": " app = FastAPI(root_path_in_servers=False)\n ```\n \"\"\"\n ),\n ] = True,\n", "stderr": "", "exit_code": 0}
full
{"status": "ok", "stdout": "                app = FastAPI(root_path_in_servers=False)\n                ```\n                \"\"\"\n            ),\n        ] = True,\n", "stderr": "", "exit_code": 0}
30run_command
{
 "command": "sed -n '675,685p' fastapi/applications.py"
}
{"status": "ok", "stdout": " ```python\n from fastapi import FastAPI\n\n app = FastAPI(root_path_in_servers=False)\n ```\n \"\"\"\n ),\n ] = True,\n responses:
full
{"status": "ok", "stdout": "                ```python\n                from fastapi import FastAPI\n\n                app = FastAPI(root_path_in_servers=False)\n                ```\n                \"\"\"\n            ),\n        ] = True,\n        responses: Annotated[\n            dict[int | str, dict[str, Any]] | None,\n            Doc(\n", "stderr": "", "exit_code": 0}
31run_command
{
 "command": "grep -n \"root_path_in_servers\" fastapi/applications.py"
}
{"status": "ok", "stdout": "663: root_path_in_servers: Annotated[\n678: app = FastAPI(root_path_in_servers=False)\n886: self.root_path_in_servers = root_path_in
full
{"status": "ok", "stdout": "663:        root_path_in_servers: Annotated[\n678:                app = FastAPI(root_path_in_servers=False)\n886:        self.root_path_in_servers = root_path_in_servers\n1110:                    if root_path and self.root_path_in_servers:\n", "stderr": "", "exit_code": 0}
32run_command
{
 "command": "sed -n '660,685p' fastapi/applications.py"
}
{"status": "ok", "stdout": " \"\"\"\n ),\n ] = \"\",\n root_path_in_servers: Annotated[\n bool,\n Doc(\n \"\"\"\n To disable automatically generating the URLs i
full
{"status": "ok", "stdout": "                \"\"\"\n            ),\n        ] = \"\",\n        root_path_in_servers: Annotated[\n            bool,\n            Doc(\n                \"\"\"\n                To disable automatically generating the URLs in the `servers` field\n                in the autogenerated OpenAPI using the `root_path`.\n\n                Read more about it in the\n                [FastAPI docs for Behind a Proxy](https://fastapi.tiangolo.com/advanced/behind-a-proxy/#disable-automatic-server-from-root-path).\n\n                **Example**\n\n                ```python\n                from fastapi import FastAPI\n\n                app = FastAPI(root_path_in_servers=False)\n                ```\n                \"\"\"\n            ),\n        ] = True,\n        responses: Annotated[\n            dict[int | str, dict[str, Any]] | None,\n            Doc(\n", "stderr": "", "exit_code": 0}
33run_command
{
 "command": "sed -n '680,682p' fastapi/applications.py"
}
{"status": "ok", "stdout": " \"\"\"\n ),\n ] = True,\n", "stderr": "", "exit_code": 0}
full
{"status": "ok", "stdout": "                \"\"\"\n            ),\n        ] = True,\n", "stderr": "", "exit_code": 0}
34run_command
{
 "command": "sed -i '681s/True/False/' fastapi/applications.py"
}
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0}
full
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0}
35run_command
{
 "command": "sed -n '680,682p' fastapi/applications.py"
}
{"status": "ok", "stdout": " \"\"\"\n ),\n ] = True,\n", "stderr": "", "exit_code": 0}
full
{"status": "ok", "stdout": "                \"\"\"\n            ),\n        ] = True,\n", "stderr": "", "exit_code": 0}
36run_command
{
 "command": "sed -n '670,690p' fastapi/applications.py"
}
{"status": "ok", "stdout": " Read more about it in the\n [FastAPI docs for Behind a Proxy](https://fastapi.tiangolo.com/advanced/behind-a-proxy/#disable-automat
full
{"status": "ok", "stdout": "                Read more about it in the\n                [FastAPI docs for Behind a Proxy](https://fastapi.tiangolo.com/advanced/behind-a-proxy/#disable-automatic-server-from-root-path).\n\n                **Example**\n\n                ```python\n                from fastapi import FastAPI\n\n                app = FastAPI(root_path_in_servers=False)\n                ```\n                \"\"\"\n            ),\n        ] = True,\n        responses: Annotated[\n            dict[int | str, dict[str, Any]] | None,\n            Doc(\n                \"\"\"\n                Additional responses to be shown in OpenAPI.\n\n                It will be added to the generated OpenAPI (e.g. visible at `/docs`).\n\n", "stderr": "", "exit_code": 0}
37run_command
{
 "command": "sed -i '681s/True/False/' fastapi/applications.py"
}
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0}
full
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0}
38run_command
{
 "command": "sed -n '680,682p' fastapi/applications.py"
}
{"status": "ok", "stdout": " \"\"\"\n ),\n ] = True,\n", "stderr": "", "exit_code": 0}
full
{"status": "ok", "stdout": "                \"\"\"\n            ),\n        ] = True,\n", "stderr": "", "exit_code": 0}
39run_command
{
 "command": "grep -n \"True\" fastapi/applications.py | head -20"
}
{"status": "ok", "stdout": "388: app = FastAPI(redirect_slashes=True) # the default\n400: ] = True,\n682: ] = True,\n755: ] = True,\n816: ] = True,\n849: When `
full
{"status": "ok", "stdout": "388:                app = FastAPI(redirect_slashes=True)  # the default\n400:        ] = True,\n682:        ] = True,\n755:        ] = True,\n816:        ] = True,\n849:                When `True` (the default), requests with a body that do not include\n865:        ] = True,\n1178:        response_model_by_alias: bool = True,\n1182:        include_in_schema: bool = True,\n1234:        response_model_by_alias: bool = True,\n1238:        include_in_schema: bool = True,\n1340:            while True:\n1439:                    deprecated=True,\n1470:        ] = True,\n1763:        ] = True,\n1775:                When `True`, default values are omitted from the response.\n1792:                When `True`, default values are omitted from the response.\n1828:        ] = True,\n2136:        ] = True,\n2148:                When `True`, default values are omitted from the response.\n", "stderr": "", "exit_code": 0}
40run_command
{
 "command": "sed -n '680,685p' fastapi/applications.py"
}
{"status": "ok", "stdout": " \"\"\"\n ),\n ] = True,\n responses: Annotated[\n dict[int | str, dict[str, Any]] | None,\n Doc(\n", "stderr": "", "exit_code": 0}
full
{"status": "ok", "stdout": "                \"\"\"\n            ),\n        ] = True,\n        responses: Annotated[\n            dict[int | str, dict[str, Any]] | None,\n            Doc(\n", "stderr": "", "exit_code": 0}
41run_command
{
 "command": "sed -i '682s/True/False/' fastapi/applications.py"
}
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0}
full
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0}
42run_command
{
 "command": "sed -n '680,685p' fastapi/applications.py"
}
{"status": "ok", "stdout": " \"\"\"\n ),\n ] = False,\n responses: Annotated[\n dict[int | str, dict[str, Any]] | None,\n Doc(\n", "stderr": "", "exit_code": 0}
full
{"status": "ok", "stdout": "                \"\"\"\n            ),\n        ] = False,\n        responses: Annotated[\n            dict[int | str, dict[str, Any]] | None,\n            Doc(\n", "stderr": "", "exit_code": 0}
43run_command
{
 "command": "sed -n '150,200p' fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": " <script src=\"{swagger_js_url}\"></script>\n <!-- `SwaggerUIBundle` is now available on the page -->\n <script>\n const ui = Swagge
full
{"status": "ok", "stdout": "    <script src=\"{swagger_js_url}\"></script>\n    <!-- `SwaggerUIBundle` is now available on the page -->\n    <script>\n    const ui = SwaggerUIBundle({{\n        url: '{openapi_url}',\n    \"\"\"\n\n    for key, value in current_swagger_ui_parameters.items():\n        html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\n\"\n\n    if oauth2_redirect_url:\n        html += f\"oauth2RedirectUrl: window.location.origin + '{oauth2_redirect_url}',\"\n\n    html += \"\"\"\n    presets: [\n        SwaggerUIBundle.presets.apis,\n        SwaggerUIBundle.SwaggerUIStandalonePreset\n        ],\n    })\"\"\"\n\n    if init_oauth:\n        html += f\"\"\"\n        ui.initOAuth({json.dumps(jsonable_encoder(init_oauth))})\n        \"\"\"\n\n    html += \"\"\"\n    </script>\n    </body>\n    </html>\n    \"\"\"\n    return HTMLResponse(html)\n\n\ndef get_redoc_html(\n    *,\n    openapi_url: Annotated[\n        str,\n        Doc(\n            \"\"\"\n            The OpenAPI URL that ReDoc should load and use.\n\n            This is normally done automatically by FastAPI using the default URL\n            `/openapi.json`.\n\n            Read more about it in the\n            [FastAPI docs for Conditional OpenAPI](https://fastapi.tiangolo.com/how-to/conditional-openapi/#conditional-openapi-from-settings-and-env-vars)\n            \"\"\"\n        ),\n    ],\n    title: Annotated[\n        str,\n", "stderr": "", "exit_code": 0}
44run_command
{
 "command": "sed -n '160,180p' fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": " if oauth2_redirect_url:\n html += f\"oauth2RedirectUrl: window.location.origin + '{oauth2_redirect_url}',\"\n\n html += \"\"\"\n pr
full
{"status": "ok", "stdout": "    if oauth2_redirect_url:\n        html += f\"oauth2RedirectUrl: window.location.origin + '{oauth2_redirect_url}',\"\n\n    html += \"\"\"\n    presets: [\n        SwaggerUIBundle.presets.apis,\n        SwaggerUIBundle.SwaggerUIStandalonePreset\n        ],\n    })\"\"\"\n\n    if init_oauth:\n        html += f\"\"\"\n        ui.initOAuth({json.dumps(jsonable_encoder(init_oauth))})\n        \"\"\"\n\n    html += \"\"\"\n    </script>\n    </body>\n    </html>\n    \"\"\"\n    return HTMLResponse(html)\n", "stderr": "", "exit_code": 0}
45run_command
{
 "command": "sed -n '150,165p' fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": " <script src=\"{swagger_js_url}\"></script>\n <!-- `SwaggerUIBundle` is now available on the page -->\n <script>\n const ui = Swagge
full
{"status": "ok", "stdout": "    <script src=\"{swagger_js_url}\"></script>\n    <!-- `SwaggerUIBundle` is now available on the page -->\n    <script>\n    const ui = SwaggerUIBundle({{\n        url: '{openapi_url}',\n    \"\"\"\n\n    for key, value in current_swagger_ui_parameters.items():\n        html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\n\"\n\n    if oauth2_redirect_url:\n        html += f\"oauth2RedirectUrl: window.location.origin + '{oauth2_redirect_url}',\"\n\n    html += \"\"\"\n    presets: [\n        SwaggerUIBundle.presets.apis,\n", "stderr": "", "exit_code": 0}
46run_command
{
 "command": "sed -n '155,160p' fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": " \"\"\"\n\n for key, value in current_swagger_ui_parameters.items():\n html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(va
full
{"status": "ok", "stdout": "    \"\"\"\n\n    for key, value in current_swagger_ui_parameters.items():\n        html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\n\"\n\n    if oauth2_redirect_url:\n", "stderr": "", "exit_code": 0}
47run_command
{
 "command": "sed -n '150,160p' fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": " <script src=\"{swagger_js_url}\"></script>\n <!-- `SwaggerUIBundle` is now available on the page -->\n <script>\n const ui = Swagge
full
{"status": "ok", "stdout": "    <script src=\"{swagger_js_url}\"></script>\n    <!-- `SwaggerUIBundle` is now available on the page -->\n    <script>\n    const ui = SwaggerUIBundle({{\n        url: '{openapi_url}',\n    \"\"\"\n\n    for key, value in current_swagger_ui_parameters.items():\n        html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\n\"\n\n    if oauth2_redirect_url:\n", "stderr": "", "exit_code": 0}
48run_command
{
 "command": "sed -n '150,155p' fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": " <script src=\"{swagger_js_url}\"></script>\n <!-- `SwaggerUIBundle` is now available on the page -->\n <script>\n const ui = Swagge
full
{"status": "ok", "stdout": "    <script src=\"{swagger_js_url}\"></script>\n    <!-- `SwaggerUIBundle` is now available on the page -->\n    <script>\n    const ui = SwaggerUIBundle({{\n        url: '{openapi_url}',\n    \"\"\"\n", "stderr": "", "exit_code": 0}
49run_command
{
 "command": "sed -n '156,160p' fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": "\n for key, value in current_swagger_ui_parameters.items():\n html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\
full
{"status": "ok", "stdout": "\n    for key, value in current_swagger_ui_parameters.items():\n        html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\n\"\n\n    if oauth2_redirect_url:\n", "stderr": "", "exit_code": 0}
50run_command
{
 "command": "sed -n '150,170p' fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": " <script src=\"{swagger_js_url}\"></script>\n <!-- `SwaggerUIBundle` is now available on the page -->\n <script>\n const ui = Swagge
full
{"status": "ok", "stdout": "    <script src=\"{swagger_js_url}\"></script>\n    <!-- `SwaggerUIBundle` is now available on the page -->\n    <script>\n    const ui = SwaggerUIBundle({{\n        url: '{openapi_url}',\n    \"\"\"\n\n    for key, value in current_swagger_ui_parameters.items():\n        html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\n\"\n\n    if oauth2_redirect_url:\n        html += f\"oauth2RedirectUrl: window.location.origin + '{oauth2_redirect_url}',\"\n\n    html += \"\"\"\n    presets: [\n        SwaggerUIBundle.presets.apis,\n        SwaggerUIBundle.SwaggerUIStandalonePreset\n        ],\n    })\"\"\"\n\n    if init_oauth:\n", "stderr": "", "exit_code": 0, "budget_warning": "Only 10 tool call(s) remaining (50/60 used). Finalize your edits and call submit_patch soon."}
51run_command
{
 "command": "sed -i '154s/{openapi_url}/{json.dumps(openapi_url)}/' fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0, "budget_warning": "Only 9 tool call(s) remaining (51/60 used). Finalize your edits and call submit_
full
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0, "budget_warning": "Only 9 tool call(s) remaining (51/60 used). Finalize your edits and call submit_patch soon."}
52run_command
{
 "command": "sed -n '150,160p' fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": " <script src=\"{swagger_js_url}\"></script>\n <!-- `SwaggerUIBundle` is now available on the page -->\n <script>\n const ui = Swagge
full
{"status": "ok", "stdout": "    <script src=\"{swagger_js_url}\"></script>\n    <!-- `SwaggerUIBundle` is now available on the page -->\n    <script>\n    const ui = SwaggerUIBundle({{\n        url: '{json.dumps(openapi_url)}',\n    \"\"\"\n\n    for key, value in current_swagger_ui_parameters.items():\n        html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\n\"\n\n    if oauth2_redirect_url:\n", "stderr": "", "exit_code": 0, "budget_warning": "Only 8 tool call(s) remaining (52/60 used). Finalize your edits and call submit_patch soon."}
53run_command
{
 "command": "sed -i '154s/{json.dumps(openapi_url)}/{json.dumps(jsonable_encoder(openapi_url))}/' fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0, "budget_warning": "Only 7 tool call(s) remaining (53/60 used). Finalize your edits and call submit_
full
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0, "budget_warning": "Only 7 tool call(s) remaining (53/60 used). Finalize your edits and call submit_patch soon."}
54run_command
{
 "command": "sed -n '150,160p' fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": " <script src=\"{swagger_js_url}\"></script>\n <!-- `SwaggerUIBundle` is now available on the page -->\n <script>\n const ui = Swagge
full
{"status": "ok", "stdout": "    <script src=\"{swagger_js_url}\"></script>\n    <!-- `SwaggerUIBundle` is now available on the page -->\n    <script>\n    const ui = SwaggerUIBundle({{\n        url: '{json.dumps(jsonable_encoder(openapi_url))}',\n    \"\"\"\n\n    for key, value in current_swagger_ui_parameters.items():\n        html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\n\"\n\n    if oauth2_redirect_url:\n", "stderr": "", "exit_code": 0, "budget_warning": "Only 6 tool call(s) remaining (54/60 used). Finalize your edits and call submit_patch soon."}
55run_command
{
 "command": "sed -i '154s/{json.dumps(jsonable_encoder(openapi_url))}/{json.dumps(jsonable_encoder(openapi_url))}/' fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0, "budget_warning": "Only 5 tool call(s) remaining (55/60 used). Finalize your edits and call submit_
full
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0, "budget_warning": "Only 5 tool call(s) remaining (55/60 used). Finalize your edits and call submit_patch soon."}
56run_command
{
 "command": "sed -i '154s/url: {json.dumps(jsonable_encoder(openapi_url))},/url: {json.dumps(jsonable_encoder(openapi_url))},/' fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0, "budget_warning": "Only 4 tool call(s) remaining (56/60 used). Finalize your edits and call submit_
full
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0, "budget_warning": "Only 4 tool call(s) remaining (56/60 used). Finalize your edits and call submit_patch soon."}
57run_command
{
 "command": "sed -n '150,160p' fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": " <script src=\"{swagger_js_url}\"></script>\n <!-- `SwaggerUIBundle` is now available on the page -->\n <script>\n const ui = Swagge
full
{"status": "ok", "stdout": "    <script src=\"{swagger_js_url}\"></script>\n    <!-- `SwaggerUIBundle` is now available on the page -->\n    <script>\n    const ui = SwaggerUIBundle({{\n        url: '{json.dumps(jsonable_encoder(openapi_url))}',\n    \"\"\"\n\n    for key, value in current_swagger_ui_parameters.items():\n        html += f\"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\\n\"\n\n    if oauth2_redirect_url:\n", "stderr": "", "exit_code": 0, "budget_warning": "Only 3 tool call(s) remaining (57/60 used). Finalize your edits and call submit_patch soon."}
58-59 ×2run_command
{
 "command": "sed -i '154s/url: {json.dumps(jsonable_encoder(openapi_url))},/url: {json.dumps(jsonable_encoder(openapi_url))},/' fastapi/openapi/docs.py"
}
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0, "budget_warning": "Only 2 tool call(s) remaining (58/60 used). Finalize your edits and call submit_
full
{"status": "ok", "stdout": "", "stderr": "", "exit_code": 0, "budget_warning": "Only 2 tool call(s) remaining (58/60 used). Finalize your edits and call submit_patch soon."}
60submit_patch
{}
{"status": "ok", "patch_size": 875, "files_changed": 2}
full
{"status": "ok", "patch_size": 875, "files_changed": 2}

Patch

diff --git a/fastapi/applications.py b/fastapi/applications.py
index ed05a1ff..2b5068de 100644
--- a/fastapi/applications.py
+++ b/fastapi/applications.py
@@ -679,7 +679,7 @@ class FastAPI(Starlette):
                 ```
                 """
             ),
-        ] = True,
+        ] = False,
         responses: Annotated[
             dict[int | str, dict[str, Any]] | None,
             Doc(
diff --git a/fastapi/openapi/docs.py b/fastapi/openapi/docs.py
index b845f87c..ef24093e 100644
--- a/fastapi/openapi/docs.py
+++ b/fastapi/openapi/docs.py
@@ -151,7 +151,7 @@ def get_swagger_ui_html(
     <!-- `SwaggerUIBundle` is now available on the page -->
     <script>
     const ui = SwaggerUIBundle({{
-        url: '{openapi_url}',
+        url: '{json.dumps(jsonable_encoder(openapi_url))}',
     """
 
     for key, value in current_swagger_ui_parameters.items():

Test output

show
F
=================================== FAILURES ===================================
_______________ test_root_path_does_not_persist_across_requests ________________

    def test_root_path_does_not_persist_across_requests():
        app = FastAPI()
    
        @app.get("/")
        def read_root():  # pragma: no cover
            return {"ok": True}
    
        # Attacker request with a spoofed root_path
        attacker_client = TestClient(app, root_path="/evil-api")
        response1 = attacker_client.get("/openapi.json")
        data1 = response1.json()
>       assert any(s.get("url") == "/evil-api" for s in data1.get("servers", []))
E       assert False
E        +  where False = any(<generator object test_root_path_does_not_persist_across_requests.<locals>.<genexpr> at 0x7d730f65db10>)

tests/test_openapi_cache_root_path.py:16: AssertionError
=============================== warnings summary ===============================
../../../../../../kaggle/tmp/envs/overlays/starlette-0.52.1-py3-none-any/starlette/testclient.py:45
  /kaggle/tmp/envs/overlays/starlette-0.52.1-py3-none-any/starlette/testclient.py:45: DeprecationWarning: The anyio.abc.BlockingPortal alias is deprecated, use anyio.from_thread.BlockingPortal instead.
    _PortalFactoryType = Callable[[], AbstractContextManager[anyio.abc.BlockingPortal]]

-- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
!!!!!!!!!!!!!!!!!!!!!!!!!! stopping after 1 failures !!!!!!!!!!!!!!!!!!!!!!!!!!!
1 failed, 1 warning in 0.73s