Orval Template Injection Vulnerability and Fix Analysis

Vulnerability Overview This vulnerability involves escaping issues with strings controlled by the specification when they are embedded in generated template literals and object keys. Specifically, there are three attack surfaces: 1. URL Template Literals: Server paths and path segments are embedded into generated template literals without escaping backticks or . A malicious OpenAPI specification can inject arbitrary code that is executed when the generated client is invoked. 2. Zod Schema Default Values: Schema defaults are emitted as backtick template literals without escaping. Malicious defaults such as are executed upon import. 3. Computed Property Key Injection: Schema property/parameter names are emitted as object keys without escaping quotes. or within names can break out and inject computed property keys, causing execution upon import. Impact Scope URL Template Literals: Affects and methods in . Zod Schema Default Values: Affects the method in . Computed Property Key Injection: Affects in and the method in . Remediation 1. URL Template Literals: - : Escape the raw OpenAPI path before parameter processing. - : Escape the server URL after variable substitution. - Also fixed , which passed a raw path prefix to , bypassing the escaping in . 2. Zod Schema Default Values: - Wrap string and array default values in using with . 3. Computed Property Key Injection: - keys: Use to escape with double quotes at five locations. - keys: Use to escape and within single-quoted keys in . Test Coverage Backtick/ injection in server URLs, path segments, string defaults, array defaults, and enum defaults. Double-quote injection in Zod object keys. Single-quote injection in keys. Safe proofs inside backticks/keys (harmless double-quoted strings). All existing tests pass (backward-compatible secure input/output). Dependencies Added (^3.0.0) as a direct dependency for and . Follow-up (Separate PR) The escaping contract for / is documented but not type-enforced. A subsequent PR will introduce a branded type to prevent accidental double-escaping or bypasses. Code Examples

Goal Reached Thanks to every supporter — we hit 100%!

Orval Template Injection Vulnerability and Fix Analysis

More from this source