kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content

影響: go:github.com/getkin/kin-openapi <= 0.145.0 → 0.146.0 Summary ValidateResponse panics on a nil pointer when a spec declares a response header with content instead of schema. doc.Validate() accepts that document, so the crash comes from a spec the library just called valid. Same class as GHSA-jpcw-4wr7-c3vq, which covered the request-parameter case in v0.144.0; this is the response-header path. Affects github.com/getkin/kin-openapi 0 { Two things I checked rather than assumed. The response does not need to carry the header; declaring it is enough,…

GitHub Advisory Databaseで読む