Merge pull request #779 from postmanlabs/fix/OAS-3.0-yaml-spec-bundling-error

[FIX] OAS 3.0 yaml spec bundling error

Author: VShingala

assets/json-schema-faker.js

@@ -10919,7 +10919,7 @@ module.exports = {
  */
 parse: function yamlParse (text, reviver) {
   try {
-    return yaml.safeLoad(text);
+    return yaml.load(text);
   }
   catch (e) {
     if (e instanceof Error) {

examples/sampleswagger.yaml

@@ -14,20 +14,20 @@ info:
     email: apiteam@wordnik.com
   license:
     name: Apache 2.0
-    url: 'http://www.apache.org/licenses/LICENSE-2.0.html'
+    url: http://www.apache.org/licenses/LICENSE-2.0.html
 tags:
   - name: pet
     description: Everything about your Pets
     externalDocs:
       description: Find out more
-      url: 'http://swagger.io'
+      url: http://swagger.io
   - name: store
     description: Operations about user
   - name: user
     description: Access to Petstore orders
     externalDocs:
       description: Find out more about our store
-      url: 'http://swagger.io'
+      url: http://swagger.io
 paths:
   /pet:
     post:
@@ -542,7 +542,7 @@ paths:
           description: User not found
 externalDocs:
   description: Find out more about Swagger
-  url: 'http://swagger.io'
+  url: http://swagger.io
 components:
   requestBodies:
     UserArray:
@@ -688,4 +688,4 @@ components:
         message:
           type: string
       xml:
-        name: '##default'
+        name: '##default'

lib/bundle.js

@@ -701,12 +701,12 @@ function generateComponentsObject(documentContext, rootContent,
     circularRefsSet = new Set();
   const { COMPONENTS_KEYS } = getBundleRulesDataByVersion(version);
   notInLine.forEach(([key, value]) => {
-    let [, partial] = key.split(localPointer);
+    let [nodeRef, partial] = key.split(localPointer);
     if (documentContext.globalReferences[key].refHasContent) {
       setValueInComponents(
         value.keyInComponents,
         components,
-        getContentFromTrace(documentContext.nodeContents[key], partial),
+        getContentFromTrace(documentContext.nodeContents[nodeRef], partial),
         COMPONENTS_KEYS
       );
     }

lib/parse.js

@@ -33,10 +33,11 @@ module.exports = {
 
   asYaml: function (spec) {
     try {
-      let obj = yaml.safeLoad(spec, {
+      let obj = yaml.load(spec, {
         schema: yaml.JSON_SCHEMA
       });
       // yaml.safeLoad does not throw errors for most of the cases in invalid yaml
+      // yaml.safeLoad is removed in js-yaml 4. Hence Using yaml.load instead, which is now safe by default.
       // hence check if it returned an object
       if (typeof obj !== 'object') {
         throw new Error('');

package-lock.json

@@ -121,7 +121,7 @@
     "ajv-formats": "2.1.1",
     "async": "3.2.4",
     "commander": "2.20.3",
-    "js-yaml": "3.14.1",
+    "js-yaml": "4.1.0",
     "json-schema-merge-allof": "0.8.1",
     "lodash": "4.17.21",
     "oas-resolver-browser": "2.5.6",