test: mark password fields as having the password OpenApi format by Mattias-Sehlstedt · Pull Request #25383 · OpenAPITools/openapi-generator

Mattias-Sehlstedt · 2026-10-23T19:14:30Z

I saw that the AI-review comments on issues that are outside of scope but still relevant in general, so I thought they could be fixed so that they will not occur in the future.

(Image taken from #22726)

What I have done is that I have marked the password fields with format: password, so that the generated code will properly use the generator functionality to censor the field when any explicit logging is invoked (e.g., .toString() in Java).

PR checklist

Read the contribution guidelines.
Run the following to build the project and update samples:
```
./mvnw clean package || exit
./bin/generate-samples.sh ./bin/configs/*.yaml || exit
./bin/utils/export_docs_generators.sh || exit
```
(For Windows users, please run the script in WSL)
Commit all changed files.
This is important, as CI jobs will verify all generator outputs of your HEAD commit as it would merge with master.
These must match the expectations made by your contribution.
You may regenerate an individual generator by passing the relevant config(s) as an argument to the script, for example ./bin/generate-samples.sh bin/configs/java*.
IMPORTANT: Do NOT purge/delete any folders/files (e.g. tests) when regenerating the samples as manually written tests may be removed.
If your PR is targeting a particular programming language, @mention the technical committee members, so they are more likely to review the pull request.

Summary by cubic

Adds format: password to password fields in test OpenAPI specs so generated code can mask password values in explicit logging such as Java's toString().

Updates ~100 petstore test resources across Swagger 1.2, 2.0, and 3.0 specs.
Removes wordnik.json and wordnik.yaml test resources, which appears unrelated to the format change.

^{Written for commit 7377980. Summary will update on new commits.}

cubic-dev-ai

9 issues found across 565 files

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="samples/client/petstore/spring-http-interface-reactive-bean-validation/src/main/java/org/openapitools/model/User.java">

<violation number="1" location="samples/client/petstore/spring-http-interface-reactive-bean-validation/src/main/java/org/openapitools/model/User.java:242">
P3: This unconditional mask hides whether `password` is null, changing the model’s diagnostic output and making an unset password appear populated. Preserve the null state while masking only non-null values, for example by appending `password == null ? "null" : "*"`.</violation>
</file>

<file name="samples/server/petstore/java-micronaut-server/src/main/java/org/openapitools/model/User.java">

<violation number="1" location="samples/server/petstore/java-micronaut-server/src/main/java/org/openapitools/model/User.java:287">
P2: This masks unset passwords as if they were present: `toString()` now prints `password: *` for every new `User`, even when `password` is null. Preserve the null representation while masking only non-null values.</violation>
</file>

<file name="samples/openapi3/client/petstore/python-pydantic-v1/petstore_api/models/user.py">

<violation number="1" location="samples/openapi3/client/petstore/python-pydantic-v1/petstore_api/models/user.py:33">
P1: This changes `password` to a `SecretStr`, but this generated model's `to_dict()`/`to_json()` path does not unwrap secret values. Calling `to_json()` (and client serialization paths that consume `to_dict()`) with a password now raises `TypeError: Object of type SecretStr is not JSON serializable`; preserve a string in serialized output while masking only explicit representations.</violation>
</file>

<file name="samples/client/petstore/java/resttemplate-withXml/src/main/java/org/openapitools/client/model/User.java">

<violation number="1" location="samples/client/petstore/java/resttemplate-withXml/src/main/java/org/openapitools/client/model/User.java:342">
P2: This masks `null` as `*`, so logs can no longer distinguish an unset password from a supplied one. Preserve the existing null representation while masking only non-null values.</violation>
</file>

<file name="samples/client/petstore/java/restclient-swagger2/src/main/java/org/openapitools/client/model/User.java">

<violation number="1" location="samples/client/petstore/java/restclient-swagger2/src/main/java/org/openapitools/client/model/User.java:320">
P3: This masks unset passwords as if they had a value. Preserve the nullable representation while masking only non-null passwords, so logs remain accurate without exposing the secret.</violation>
</file>

<file name="samples/openapi3/client/petstore/python-pydantic-v1-aiohttp/petstore_api/models/user.py">

<violation number="1" location="samples/openapi3/client/petstore/python-pydantic-v1-aiohttp/petstore_api/models/user.py:33">
P1: This change makes `User.to_json()` fail with `TypeError` whenever `password` is set, because `to_dict()` returns a `SecretStr` object and `to_json()` uses stdlib `json.dumps()`. Update the model/API serialization path to use Pydantic's JSON encoder while preserving the intended masking behavior.</violation>
</file>

<file name="samples/openapi3/client/petstore/python-aiohttp/petstore_api/models/user.py">

<violation number="1" location="samples/openapi3/client/petstore/python-aiohttp/petstore_api/models/user.py:35">
P1: This changes password serialization, not just its display: `to_dict()` and `to_json()` now emit Pydantic’s masked `SecretStr` value (`**********`), so create/update requests and JSON round-trips lose the actual password. Keep the field’s wire serialization as the real string and apply masking only in the explicit string/log representation (or explicitly unwrap `SecretStr` in the request serialization path).</violation>
</file>

<file name="samples/openapi3/client/petstore/python-httpx2/petstore_api/models/user.py">

<violation number="1" location="samples/openapi3/client/petstore/python-httpx2/petstore_api/models/user.py:35">
P1: This `SecretStr` annotation also affects payload serialization: `to_json()` now emits `**********` instead of the actual password, so requests or round-trips using the generated JSON send an invalid password. Preserve masking in `to_str()` but explicitly unwrap the secret for request/JSON serialization (and the API client's equivalent path).</violation>
</file>

<file name="samples/openapi3/client/petstore/python-lazyImports/petstore_api/models/user.py">

<violation number="1" location="samples/openapi3/client/petstore/python-lazyImports/petstore_api/models/user.py:35">
P1: Changing `password` to `SecretStr` also changes the generated model's request serialization: `to_dict()` no longer returns a normal password string, and `to_json()` masks (or cannot serialize) it. Ensure the API request path explicitly unwraps `SecretStr.get_secret_value()` while keeping logging masked, or update the generated serialization contract accordingly.</violation>
</file>

_{Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.

View guided diff | Re-trigger cubic}

cubic-dev-ai · 2026-10-23T19:22:12Z

    last_name: Optional[StrictStr] = Field(default=None, alias="lastName")
    email: Optional[StrictStr] = None
-    password: Optional[StrictStr] = None
+    password: Optional[SecretStr] = None


P1: This changes password to a SecretStr, but this generated model's to_dict()/to_json() path does not unwrap secret values. Calling to_json() (and client serialization paths that consume to_dict()) with a password now raises TypeError: Object of type SecretStr is not JSON serializable; preserve a string in serialized output while masking only explicit representations.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At samples/openapi3/client/petstore/python-pydantic-v1/petstore_api/models/user.py, line 33: <comment>This changes `password` to a `SecretStr`, but this generated model's `to_dict()`/`to_json()` path does not unwrap secret values. Calling `to_json()` (and client serialization paths that consume `to_dict()`) with a password now raises `TypeError: Object of type SecretStr is not JSON serializable`; preserve a string in serialized output while masking only explicit representations.</comment> <file context> @@ -30,7 +30,7 @@ class User(BaseModel): last_name: Optional[StrictStr] = Field(default=None, alias="lastName") email: Optional[StrictStr] = None - password: Optional[StrictStr] = None + password: Optional[SecretStr] = None phone: Optional[StrictStr] = None user_status: Optional[StrictInt] = Field(default=None, alias="userStatus", description="User Status") </file context>

cubic-dev-ai · 2026-10-23T19:22:12Z

    last_name: Optional[StrictStr] = Field(default=None, alias="lastName")
    email: Optional[StrictStr] = None
-    password: Optional[StrictStr] = None
+    password: Optional[SecretStr] = None


P1: This change makes User.to_json() fail with TypeError whenever password is set, because to_dict() returns a SecretStr object and to_json() uses stdlib json.dumps(). Update the model/API serialization path to use Pydantic's JSON encoder while preserving the intended masking behavior.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At samples/openapi3/client/petstore/python-pydantic-v1-aiohttp/petstore_api/models/user.py, line 33: <comment>This change makes `User.to_json()` fail with `TypeError` whenever `password` is set, because `to_dict()` returns a `SecretStr` object and `to_json()` uses stdlib `json.dumps()`. Update the model/API serialization path to use Pydantic's JSON encoder while preserving the intended masking behavior.</comment> <file context> @@ -30,7 +30,7 @@ class User(BaseModel): last_name: Optional[StrictStr] = Field(default=None, alias="lastName") email: Optional[StrictStr] = None - password: Optional[StrictStr] = None + password: Optional[SecretStr] = None phone: Optional[StrictStr] = None user_status: Optional[StrictInt] = Field(default=None, alias="userStatus", description="User Status") </file context>

cubic-dev-ai · 2026-10-23T19:22:12Z

    last_name: Optional[StrictStr] = Field(default=None, alias="lastName")
    email: Optional[StrictStr] = None
-    password: Optional[StrictStr] = None
+    password: Optional[SecretStr] = None


P1: This changes password serialization, not just its display: to_dict() and to_json() now emit Pydantic’s masked SecretStr value (**********), so create/update requests and JSON round-trips lose the actual password. Keep the field’s wire serialization as the real string and apply masking only in the explicit string/log representation (or explicitly unwrap SecretStr in the request serialization path).

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At samples/openapi3/client/petstore/python-aiohttp/petstore_api/models/user.py, line 35: <comment>This changes password serialization, not just its display: `to_dict()` and `to_json()` now emit Pydantic’s masked `SecretStr` value (`**********`), so create/update requests and JSON round-trips lose the actual password. Keep the field’s wire serialization as the real string and apply masking only in the explicit string/log representation (or explicitly unwrap `SecretStr` in the request serialization path).</comment> <file context> @@ -32,7 +32,7 @@ class User(BaseModel): last_name: Optional[StrictStr] = Field(default=None, alias="lastName") email: Optional[StrictStr] = None - password: Optional[StrictStr] = None + password: Optional[SecretStr] = None phone: Optional[StrictStr] = None user_status: Optional[StrictInt] = Field(default=None, description="User Status", alias="userStatus") </file context>

cubic-dev-ai · 2026-10-23T19:22:12Z

    last_name: Optional[StrictStr] = Field(default=None, alias="lastName")
    email: Optional[StrictStr] = None
-    password: Optional[StrictStr] = None
+    password: Optional[SecretStr] = None


P1: This SecretStr annotation also affects payload serialization: to_json() now emits ********** instead of the actual password, so requests or round-trips using the generated JSON send an invalid password. Preserve masking in to_str() but explicitly unwrap the secret for request/JSON serialization (and the API client's equivalent path).

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At samples/openapi3/client/petstore/python-httpx2/petstore_api/models/user.py, line 35: <comment>This `SecretStr` annotation also affects payload serialization: `to_json()` now emits `**********` instead of the actual password, so requests or round-trips using the generated JSON send an invalid password. Preserve masking in `to_str()` but explicitly unwrap the secret for request/JSON serialization (and the API client's equivalent path).</comment> <file context> @@ -32,7 +32,7 @@ class User(BaseModel): last_name: Optional[StrictStr] = Field(default=None, alias="lastName") email: Optional[StrictStr] = None - password: Optional[StrictStr] = None + password: Optional[SecretStr] = None phone: Optional[StrictStr] = None user_status: Optional[StrictInt] = Field(default=None, description="User Status", alias="userStatus") </file context>

cubic-dev-ai · 2026-10-23T19:22:12Z

    last_name: Optional[StrictStr] = Field(default=None, alias="lastName")
    email: Optional[StrictStr] = None
-    password: Optional[StrictStr] = None
+    password: Optional[SecretStr] = None


P1: Changing password to SecretStr also changes the generated model's request serialization: to_dict() no longer returns a normal password string, and to_json() masks (or cannot serialize) it. Ensure the API request path explicitly unwraps SecretStr.get_secret_value() while keeping logging masked, or update the generated serialization contract accordingly.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At samples/openapi3/client/petstore/python-lazyImports/petstore_api/models/user.py, line 35: <comment>Changing `password` to `SecretStr` also changes the generated model's request serialization: `to_dict()` no longer returns a normal password string, and `to_json()` masks (or cannot serialize) it. Ensure the API request path explicitly unwraps `SecretStr.get_secret_value()` while keeping logging masked, or update the generated serialization contract accordingly.</comment> <file context> @@ -32,7 +32,7 @@ class User(BaseModel): last_name: Optional[StrictStr] = Field(default=None, alias="lastName") email: Optional[StrictStr] = None - password: Optional[StrictStr] = None + password: Optional[SecretStr] = None phone: Optional[StrictStr] = None user_status: Optional[StrictInt] = Field(default=None, description="User Status", alias="userStatus") </file context>

cubic-dev-ai · 2026-10-23T19:22:12Z

@@ -284,7 +284,7 @@ public String toString() {
        sb.append("    firstName: ").append(toIndentedString(firstName)).append("\n");
        sb.append("    lastName: ").append(toIndentedString(lastName)).append("\n");
        sb.append("    email: ").append(toIndentedString(email)).append("\n");
-        sb.append("    password: ").append(toIndentedString(password)).append("\n");
+        sb.append("    password: ").append("*").append("\n");


P2: This masks unset passwords as if they were present: toString() now prints password: * for every new User, even when password is null. Preserve the null representation while masking only non-null values.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At samples/server/petstore/java-micronaut-server/src/main/java/org/openapitools/model/User.java, line 287: <comment>This masks unset passwords as if they were present: `toString()` now prints `password: *` for every new `User`, even when `password` is null. Preserve the null representation while masking only non-null values.</comment> <file context> @@ -284,7 +284,7 @@ public String toString() { sb.append(" lastName: ").append(toIndentedString(lastName)).append("\n"); sb.append(" email: ").append(toIndentedString(email)).append("\n"); - sb.append(" password: ").append(toIndentedString(password)).append("\n"); + sb.append(" password: ").append("*").append("\n"); sb.append(" phone: ").append(toIndentedString(phone)).append("\n"); sb.append(" userStatus: ").append(toIndentedString(userStatus)).append("\n"); </file context>

Suggested change

sb.append(" password: ").append("*").append("\n");

sb.append(" password: ").append(password == null ? "null" : "*").append("\n");

cubic-dev-ai · 2026-10-23T19:22:12Z

    sb.append("    lastName: ").append(toIndentedString(lastName)).append("\n");
    sb.append("    email: ").append(toIndentedString(email)).append("\n");
-    sb.append("    password: ").append(toIndentedString(password)).append("\n");
+    sb.append("    password: ").append("*").append("\n");


P2: This masks null as *, so logs can no longer distinguish an unset password from a supplied one. Preserve the existing null representation while masking only non-null values.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At samples/client/petstore/java/resttemplate-withXml/src/main/java/org/openapitools/client/model/User.java, line 342: <comment>This masks `null` as `*`, so logs can no longer distinguish an unset password from a supplied one. Preserve the existing null representation while masking only non-null values.</comment> <file context> @@ -339,7 +339,7 @@ public String toString() { sb.append(" lastName: ").append(toIndentedString(lastName)).append("\n"); sb.append(" email: ").append(toIndentedString(email)).append("\n"); - sb.append(" password: ").append(toIndentedString(password)).append("\n"); + sb.append(" password: ").append("*").append("\n"); sb.append(" phone: ").append(toIndentedString(phone)).append("\n"); sb.append(" userStatus: ").append(toIndentedString(userStatus)).append("\n"); </file context>

Suggested change

sb.append(" password: ").append("*").append("\n");

sb.append(" password: ").append(password == null ? "null" : "*").append("\n");

cubic-dev-ai · 2026-10-23T19:22:12Z

    sb.append("    lastName: ").append(toIndentedString(lastName)).append("\n");
    sb.append("    email: ").append(toIndentedString(email)).append("\n");
-    sb.append("    password: ").append(toIndentedString(password)).append("\n");
+    sb.append("    password: ").append("*").append("\n");


P3: This unconditional mask hides whether password is null, changing the model’s diagnostic output and making an unset password appear populated. Preserve the null state while masking only non-null values, for example by appending password == null ? "null" : "*".

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At samples/client/petstore/spring-http-interface-reactive-bean-validation/src/main/java/org/openapitools/model/User.java, line 242: <comment>This unconditional mask hides whether `password` is null, changing the model’s diagnostic output and making an unset password appear populated. Preserve the null state while masking only non-null values, for example by appending `password == null ? "null" : "*"`.</comment> <file context> @@ -239,7 +239,7 @@ public String toString() { sb.append(" lastName: ").append(toIndentedString(lastName)).append("\n"); sb.append(" email: ").append(toIndentedString(email)).append("\n"); - sb.append(" password: ").append(toIndentedString(password)).append("\n"); + sb.append(" password: ").append("*").append("\n"); sb.append(" phone: ").append(toIndentedString(phone)).append("\n"); sb.append(" userStatus: ").append(toIndentedString(userStatus)).append("\n"); </file context>

Suggested change

sb.append(" password: ").append("*").append("\n");

sb.append(" password: ").append(password == null ? "null" : "*").append("\n");

cubic-dev-ai · 2026-10-23T19:22:12Z

    sb.append("    lastName: ").append(toIndentedString(lastName)).append("\n");
    sb.append("    email: ").append(toIndentedString(email)).append("\n");
-    sb.append("    password: ").append(toIndentedString(password)).append("\n");
+    sb.append("    password: ").append("*").append("\n");


P3: This masks unset passwords as if they had a value. Preserve the nullable representation while masking only non-null passwords, so logs remain accurate without exposing the secret.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At samples/client/petstore/java/restclient-swagger2/src/main/java/org/openapitools/client/model/User.java, line 320: <comment>This masks unset passwords as if they had a value. Preserve the nullable representation while masking only non-null passwords, so logs remain accurate without exposing the secret.</comment> <file context> @@ -317,7 +317,7 @@ public String toString() { sb.append(" lastName: ").append(toIndentedString(lastName)).append("\n"); sb.append(" email: ").append(toIndentedString(email)).append("\n"); - sb.append(" password: ").append(toIndentedString(password)).append("\n"); + sb.append(" password: ").append("*").append("\n"); sb.append(" phone: ").append(toIndentedString(phone)).append("\n"); sb.append(" userStatus: ").append(toIndentedString(userStatus)).append("\n"); </file context>

Suggested change

sb.append(" password: ").append("*").append("\n");

sb.append(" password: ").append(password == null ? "null" : "*").append("\n");

cubic-dev-ai Bot reviewed Oct 23, 2026

View reviewed changes

Mattias-Sehlstedt mentioned this pull request Oct 23, 2026

ci: update Haskell setup action and add stack version check #25384

Merged

3 tasks done

Mattias-Sehlstedt force-pushed the mark-password-fields-as-passwords branch from 7377980 to c6ca7c7 Compare October 24, 2026 13:13

Mattias-Sehlstedt mentioned this pull request Oct 24, 2026

ci: set SBT version to 1.10.11 for scala pekko #25390

Merged

3 tasks done

test: mark password fields as having the password OpenApi format

0f668b9

Mattias-Sehlstedt force-pushed the mark-password-fields-as-passwords branch from c6ca7c7 to 0f668b9 Compare October 24, 2026 14:25

Mattias-Sehlstedt mentioned this pull request Oct 24, 2026

ci: update Julia sample workflow to use the exact OpenAPI release-0.2 checkout #25391

Open

3 tasks done

Navigation Menu

Repository navigation

test: mark password fields as having the password OpenApi format - #25383

test: mark password fields as having the password OpenApi format#25383
Mattias-Sehlstedt wants to merge 1 commit into
OpenAPITools:masterfrom
Mattias-Sehlstedt:mark-password-fields-as-passwords

Mattias-Sehlstedt commented Oct 23, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

cubic-dev-ai Bot Oct 23, 2026

Uh oh!

cubic-dev-ai Bot Oct 23, 2026

Uh oh!

cubic-dev-ai Bot Oct 23, 2026

Uh oh!

cubic-dev-ai Bot Oct 23, 2026

Uh oh!

cubic-dev-ai Bot Oct 23, 2026

Uh oh!

cubic-dev-ai Bot Oct 23, 2026

Uh oh!

cubic-dev-ai Bot Oct 23, 2026

Uh oh!

cubic-dev-ai Bot Oct 23, 2026

Uh oh!

cubic-dev-ai Bot Oct 23, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

	sb.append(" password: ").append("*").append("\n");
	sb.append(" password: ").append(password == null ? "null" : "*").append("\n");

Conversation

Mattias-Sehlstedt commented Oct 23, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR checklist

Summary by cubic

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Mattias-Sehlstedt commented Oct 23, 2026 •

edited by cubic-dev-ai Bot

Loading