Refuse to cast str or bytes to array

Although str and bytes act as sequences in Python, they do not count
as arrays according to OpenAPI, so we should not allow them to
validate as arrays.

Signed-off-by: Anders Kaseorg <[email protected]>

Author: andersk

openapi_core/casting/schemas/casters.py

@@ -54,6 +54,10 @@ def items_caster(self) -> BaseSchemaCaster:
         return self.casters_factory.create(self.schema / "items")
 
     def cast(self, value: Any) -> List[Any]:
+        # str and bytes are not arrays according to the OpenAPI spec
+        if isinstance(value, (str, bytes)):
+            raise CastError(value, self.schema["type"])
+
         try:
             return list(map(self.items_caster, value))
         except (ValueError, TypeError):

openapi_core/casting/schemas/exceptions.py

@@ -7,7 +7,7 @@
 class CastError(OpenAPIError):
     """Schema cast operation error"""
 
-    value: str
+    value: object
     type: str
 
     def __str__(self) -> str:

tests/unit/casting/test_schema_casters.py

@@ -26,15 +26,15 @@ def test_array_invalid_type(self, caster_factory):
         with pytest.raises(CastError):
             caster_factory(schema)(value)
 
-    def test_array_invalid_value(self, caster_factory):
+    @pytest.mark.parametrize("value", [3.14, "foo", b"foo"])
+    def test_array_invalid_value(self, value, caster_factory):
         spec = {
             "type": "array",
             "items": {
-                "type": "number",
+                "oneOf": [{"type": "number"}, {"type": "string"}],
             },
         }
         schema = Spec.from_dict(spec)
-        value = 3.14
 
         with pytest.raises(CastError):
             caster_factory(schema)(value)