Summary
A code injection vulnerability in oapi-codegen allows attacker-controlled OpenAPI documents to place non-literal enum values into generated Go source code. If the generated package is later built and imported, the injected code may execute during package initialization.
A code injection vulnerability in oapi-codegen allows attacker-controlled OpenAPI documents to place non-literal enum values into generated Go source code. If the generated package is later built and imported, the injected code may execute during package initialization.
Affected context
The issue affects workflows that use oapi-codegen to generate Go code from OpenAPI documents containing integer, number, or boolean schemas with enum entries. Risk is present when an attacker can create or modify the OpenAPI document and the resulting source is generated, built, and imported without adequate review or isolation.
The issue affects workflows that use oapi-codegen to generate Go code from OpenAPI documents containing integer, number, or boolean schemas with enum entries. Risk is present when an attacker can create or modify the OpenAPI document and the resulting source is generated, built, and imported without adequate review or isolation.
Exploit preconditions
- Attack surface: OpenAPI document processing and Go source-code generation
- Required access: Ability to supply or modify an OpenAPI document consumed by the generator
- Trigger point: Generation of constants followed by compilation and import of the generated package
- Why exploitation is possible: Non-literal enum values can escape the intended constants block and become executable Go source
- Attack surface: OpenAPI document processing and Go source-code generation
- Required access: Ability to supply or modify an OpenAPI document consumed by the generator
- Trigger point: Generation of constants followed by compilation and import of the generated package
- Why exploitation is possible: Non-literal enum values can escape the intended constants block and become executable Go source
Why this happens
The vulnerability results from treating schema-derived enum values as trusted source-code literals during template rendering. When generated source is assembled through insufficiently constrained textual interpolation, a crafted value can alter the structure of the output rather than remain data. This behavior maps to CWE-94: Improper Control of Generation of Code, because untrusted input influences executable code generated by the application.
The vulnerability results from treating schema-derived enum values as trusted source-code literals during template rendering. When generated source is assembled through insufficiently constrained textual interpolation, a crafted value can alter the structure of the output rather than remain data. This behavior maps to CWE-94: Improper Control of Generation of Code, because untrusted input influences executable code generated by the application.
Potential impact
- Arbitrary code execution in build or development environments
- Compromise of systems that import the generated package
- Theft or modification of build-time credentials and source code
- Supply-chain propagation through distributed generated artifacts
- Tampering with applications or services that consume the generated code
- Arbitrary code execution in build or development environments
- Compromise of systems that import the generated package
- Theft or modification of build-time credentials and source code
- Supply-chain propagation through distributed generated artifacts
- Tampering with applications or services that consume the generated code
General mitigation guidance
Mitigation generally focuses on ensuring that schema values remain data throughout code generation.
Common defensive patterns include:
- Generate Go syntax through structured AST or strongly constrained rendering mechanisms
- Validate enum values against the expected primitive type before template expansion
- Escape or reject values that are not representable as literal constants
- Treat OpenAPI documents as untrusted input unless their provenance is verified
- Review generated source code before compilation and publication
- Run generation and builds in isolated, least-privileged environments
- Keep generated artifacts separate from sensitive credentials and production deployment permissions
Mitigation generally focuses on ensuring that schema values remain data throughout code generation.
Common defensive patterns include:
- Generate Go syntax through structured AST or strongly constrained rendering mechanisms
- Validate enum values against the expected primitive type before template expansion
- Escape or reject values that are not representable as literal constants
- Treat OpenAPI documents as untrusted input unless their provenance is verified
- Review generated source code before compilation and publication
- Run generation and builds in isolated, least-privileged environments
- Keep generated artifacts separate from sensitive credentials and production deployment permissions
How teams detect issues like this
Organizations can detect this class of issue through:
- Static analysis for direct interpolation of schema values into source-code templates
- Tests using malformed and non-literal enum values to verify that generated output remains syntactically and semantically constrained
- Code review checks for templates that emit language keywords, delimiters, or executable blocks from external input
- Build policies that inspect generated diffs before compilation or publication
- Validation rules requiring OpenAPI specifications to come from approved, integrity-checked sources
- Automated security review tools that flag code-generation paths where untrusted input reaches executable output
Organizations can detect this class of issue through:
- Static analysis for direct interpolation of schema values into source-code templates
- Tests using malformed and non-literal enum values to verify that generated output remains syntactically and semantically constrained
- Code review checks for templates that emit language keywords, delimiters, or executable blocks from external input
- Build policies that inspect generated diffs before compilation or publication
- Validation rules requiring OpenAPI specifications to come from approved, integrity-checked sources
- Automated security review tools that flag code-generation paths where untrusted input reaches executable output
