fix: added encoding on absolutePointer before decodeURIComponent

Author: DmitryAnansky

.changeset/solid-lands-repair.md

@@ -0,0 +1,5 @@
+---
+"@redocly/openapi-core": patch
+---
+
+Fixed an issue where JSON Pointers containing special characters (like `%`) were not properly URI-encoded when used as URI identifiers, causing validation errors with properties containing percent signs or other special characters.

packages/core/src/__tests__/ref-utils.test.ts

@@ -1,6 +1,6 @@
 import outdent from 'outdent';
 import { parseYamlToDocument } from '../../__tests__/utils.js';
-import { parseRef, refBaseName } from '../ref-utils.js';
+import { escapePointer, parseRef, refBaseName, unescapePointerFromURI } from '../ref-utils.js';
 import { lintDocument } from '../lint.js';
 import { createConfig } from '../config/index.js';
 import { BaseResolver } from '../resolve.js';
@@ -139,4 +139,37 @@ describe('ref-utils', () => {
       expect(refBaseName('abcdefg')).toStrictEqual('abcdefg');
     });
   });
+
+  describe('escapePointer', () => {
+    it('should escape a pointer correctly', () => {
+      expect(escapePointer('scope/complex~name')).toStrictEqual('scope~1complex~0name');
+    });
+
+    it('should escape a pointer with a number correctly', () => {
+      expect(escapePointer(123)).toStrictEqual(123);
+    });
+
+    it('should escape a pointer with a string correctly', () => {
+      expect(escapePointer('scope/complex~name')).toStrictEqual('scope~1complex~0name');
+    });
+
+    it('should not URI-encode special characters when escaping pointers', () => {
+      // escapePointer should only handle JSON Pointer escaping, not URI encoding
+      expect(escapePointer('activity_level_%')).toStrictEqual('activity_level_%');
+    });
+  });
+
+  describe('unescapePointerFromURI', () => {
+    it('should unescape a pointer with a percent sign correctly', () => {
+      expect(unescapePointerFromURI('activity_level_%25')).toStrictEqual('activity_level_%');
+    });
+
+    it('should unescape a pointer with a number correctly', () => {
+      expect(unescapePointerFromURI('123')).toStrictEqual('123');
+    });
+
+    it('should unescape a pointer correctly', () => {
+      expect(unescapePointerFromURI('scope~1complex~0name')).toStrictEqual('scope/complex~name');
+    });
+  });
 });

packages/core/src/ref-utils.ts

@@ -36,12 +36,16 @@ export class Location {
   }
 
   get absolutePointer() {
-    return this.source.absoluteRef + (this.pointer === '#/' ? '' : this.pointer);
+    return this.source.absoluteRef + (this.pointer === '#/' ? '' : encodeURI(this.pointer));
   }
 }
 
 export function unescapePointer(fragment: string): string {
-  return decodeURIComponent(fragment.replace(/~1/g, '/').replace(/~0/g, '~'));
+  return fragment.replace(/~1/g, '/').replace(/~0/g, '~');
+}
+
+export function unescapePointerFromURI(fragment: string): string {
+  return unescapePointer(decodeURIComponent(fragment));
 }
 
 export function escapePointer<T extends string | number>(fragment: T): T {
@@ -58,7 +62,7 @@ export function parseRef(ref: string): { uri: string | null; pointer: string[] }
 }
 
 export function parsePointer(pointer: string) {
-  return pointer.split('/').map(unescapePointer).filter(isTruthy);
+  return pointer.split('/').map(unescapePointerFromURI).filter(isTruthy);
 }
 
 export function pointerBaseName(pointer: string) {