fix: sanitization of relative OpenAPI JSON paths (#10528)

heto-soptim · web-flow · commit 60dee8b66b33 · 2025-07-16T13:28:06.000+02:00
diff --git a/src/core/utils/url.js b/src/core/utils/url.js
@@ -58,11 +58,19 @@ export function sanitizeUrl(url) {
 
     // return sanitized URI reference
     if (urlObject.origin === base) {
-      return urlTrimmed.startsWith("/")
-        ? `${urlObject.pathname}${urlObject.search}${urlObject.hash}`
-        : urlTrimmed.startsWith(".")
-        ? `.${urlObject.pathname}${urlObject.search}${urlObject.hash}`
-        : `${urlObject.pathname.substring(1)}${urlObject.search}${urlObject.hash}`
+      if (urlTrimmed.startsWith("/")) {
+        return `${urlObject.pathname}${urlObject.search}${urlObject.hash}`
+      }
+    
+      if (urlTrimmed.startsWith("./")) {
+        return `.${urlObject.pathname}${urlObject.search}${urlObject.hash}`
+      }
+    
+      if (urlTrimmed.startsWith("../")) {
+        return `..${urlObject.pathname}${urlObject.search}${urlObject.hash}`
+      }
+    
+      return `${urlObject.pathname.substring(1)}${urlObject.search}${urlObject.hash}`
     }
 
     return String(urlObject)
diff --git a/test/unit/core/utils.js b/test/unit/core/utils.js
@@ -1449,6 +1449,13 @@ describe("utils", () => {
       expect(sanitizeUrl(url)).toEqual("https://swagger.io/")
     })
 
+    it("should gracefully handle relative paths", () => {
+      expect(sanitizeUrl(".openapi.json")).toEqual(".openapi.json")
+      expect(sanitizeUrl("./openapi.json")).toEqual("./openapi.json")
+      expect(sanitizeUrl("..openapi.json")).toEqual("..openapi.json")
+      expect(sanitizeUrl("../openapi.json")).toEqual("../openapi.json")
+    })
+
     it("should gracefully handle empty strings", () => {
       expect(sanitizeUrl("")).toEqual("")
     })
