[POWERSHELL] fix: single-quote DTO property names to prevent $-variable interpolation (fixes #23535)#23622
Closed
gaurav0107 wants to merge 2 commits intoOpenAPITools:masterfrom
Closed
Conversation
…le interpolation
PowerShell treats `$` inside double-quoted strings as the sigil for variable
interpolation, so `"$foo" = ${Foo}` inside a hash literal becomes `<value-of-$foo> = <value-of-Foo>`.
When an OpenAPI property name starts with (or contains) `$` — e.g. `$type` from
C# polymorphic payloads or `$ref` / `$schema` from JSON Schema — the generated
Initialize- and ConvertFrom- commandlets emit invalid PSCustomObject hash keys
and empty regex patterns, breaking DTO (de)serialization.
Swap all user-property-name emissions in `model_simple.mustache` from
double-quoted to single-quoted literals so baseName is preserved verbatim:
- `$PSO = [PSCustomObject]@{ '<baseName>' = ${<name>} }` (3 sites)
- `$AllProperties = ('<baseName>', ...)` (1 site)
- `-match '<baseName>'` and `.Properties['<baseName>']` (4 sites)
Fixes: OpenAPITools#23535
Co-Authored-By: Claude <noreply@anthropic.com>
Extends the regression test to cover every place model_simple.mustache embeds a user-supplied property name: the Initialize- hash literal, the ConvertFrom-…JsonTo… hash literal, the $AllProperties allow-list, the .Properties[…] indexer, and the -match presence check. All five must be single-quoted so PowerShell preserves `$` literally. Co-Authored-By: Claude <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
1 issue found across 2 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="modules/openapi-generator/src/main/resources/powershell/model_simple.mustache">
<violation number="1" location="modules/openapi-generator/src/main/resources/powershell/model_simple.mustache:125">
P1: Single-quoted PowerShell literals use `baseName` without escaping apostrophes, so valid property names containing `'` can generate invalid code.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
| @@ -122,7 +122,7 @@ function Initialize-{{{apiNamePrefix}}}{{{classname}}} { | |||
| $PSO = [PSCustomObject]@{ | |||
Contributor
There was a problem hiding this comment.
P1: Single-quoted PowerShell literals use baseName without escaping apostrophes, so valid property names containing ' can generate invalid code.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At modules/openapi-generator/src/main/resources/powershell/model_simple.mustache, line 125:
<comment>Single-quoted PowerShell literals use `baseName` without escaping apostrophes, so valid property names containing `'` can generate invalid code.</comment>
<file context>
@@ -122,7 +122,7 @@ function Initialize-{{{apiNamePrefix}}}{{{classname}}} {
{{=<< >>=}}
<<#allVars>>
- "<<baseName>>" = ${<<name>>}
+ '<<baseName>>' = ${<<name>>}
<</allVars>>
<<={{ }}=>>
</file context>
wing328
reviewed
Apr 25, 2026
| @@ -0,0 +1,100 @@ | |||
| /* | |||
| * Copyright 2018 OpenAPI-Generator Contributors (https://openapi-generator.tech) | |||
| * Copyright 2018 SmartBear Software | |||
Member
|
thanks for the PR. please follow step 3 to update the samples |
6 tasks
Member
|
merged via #23624 (you as co-author) with updated samples. thanks again for the contribution. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Fix for #23535.
PowerShell treats
$inside double-quoted strings as the sigil for variable interpolation, so a generated hash literal likeis rewritten at runtime to
<value-of-$type> = <value-of-Type>, producing an invalid key. The same interpolation happens in$AllProperties = (...), in-match "<baseName>", and in.Properties["<baseName>"]— every site wheremodel_simple.mustacheemits a user-supplied property name inside a double-quoted PowerShell string literal.This is not theoretical:
$typeis the default discriminator property C# produces for polymorphic serialization, and$ref/$schemaappear routinely in JSON Schema payloads. A full reproduction repository is linked from the issue.Change summary: swap all eight
"{{{baseName}}}"/"<<baseName>>"emissions inmodel_simple.mustacheto single-quoted literals. Single-quoted strings in PowerShell are verbatim, so baseNames containing$(or any other interpolation meta-character) are preserved. For names without meta-characters the behaviour is identical — there is no functional change for the existing test suite.Maintainer sign-off from @wing328 on 2026-04-16 explicitly asked for a PR with this exact fix.
A new
PowerShellClientCodegenTestexercises the regression using the existing shared3_0/dollar-in-names-pull14359.yamlfixture (already used by the Python, PHP, and protobuf codegen tests).Note on sample regeneration. I was not able to run
./bin/generate-samples.sh bin/configs/powershell.yamlon my host (no JDK/Maven available locally). The committed template change is minimal and deterministic — every affected sample file will differ only in that its double-quoted property-name literals flip to single-quoted. Happy to regenerate once I have JDK access, or if a maintainer prefers to run the sample refresh directly I will rebase on top.PR checklist
master.fixes #23535).Summary by cubic
Single-quote emitted PowerShell DTO property names to prevent $-variable interpolation, fixing invalid keys and regex checks for names like $type, $ref, and $schema. Fixes #23535.
model_simple.mustacheto single-quoted literals: PSCustomObject keys (incl. ConvertFrom hash),$AllPropertiesarray,-matchchecks, and.Properties[...]indexers.PowerShellClientCodegenTestto assert single quotes at every emission site (Initialize hash, ConvertFrom hash,$AllProperties,.Properties['…'], and-match) and ensure no double-quoted emissions remain.Written for commit 4eba061. Summary will update on new commits.