cloudapi: validate input

Validate incoming requests with openapi3. Remove unsupported
uuid format from the openapi spec. Similarly, change url to uri as
uri is a supported format and url is not.

Co-authored-by: Ondřej Budai <obudai@redhat.com>
Signed-off-by: Ondřej Budai <ondrej@budai.cz>

vendor/github.com/go-openapi/swag/loading.go

@@ -19,7 +19,9 @@ import (
 	"io/ioutil"
 	"log"
 	"net/http"
+	"net/url"
 	"path/filepath"
+	"runtime"
 	"strings"
 	"time"
 )
@@ -27,6 +29,15 @@ import (
 // LoadHTTPTimeout the default timeout for load requests
 var LoadHTTPTimeout = 30 * time.Second
 
+// LoadHTTPBasicAuthUsername the username to use when load requests require basic auth
+var LoadHTTPBasicAuthUsername = ""
+
+// LoadHTTPBasicAuthPassword the password to use when load requests require basic auth
+var LoadHTTPBasicAuthPassword = ""
+
+// LoadHTTPCustomHeaders an optional collection of custom HTTP headers for load requests
+var LoadHTTPCustomHeaders = map[string]string{}
+
 // LoadFromFileOrHTTP loads the bytes from a file or a remote http server based on the path passed in
 func LoadFromFileOrHTTP(path string) ([]byte, error) {
 	return LoadStrategy(path, ioutil.ReadFile, loadHTTPBytes(LoadHTTPTimeout))(path)
@@ -48,6 +59,26 @@ func LoadStrategy(path string, local, remote func(string) ([]byte, error)) func(
 		if err != nil {
 			return nil, err
 		}
+
+		if strings.HasPrefix(pth, `file://`) {
+			if runtime.GOOS == "windows" {
+				// support for canonical file URIs on windows.
+				// Zero tolerance here for dodgy URIs.
+				u, _ := url.Parse(upth)
+				if u.Host != "" {
+					// assume UNC name (volume share)
+					// file://host/share/folder\... ==> \\host\share\path\folder
+					// NOTE: UNC port not yet supported
+					upth = strings.Join([]string{`\`, u.Host, u.Path}, `\`)
+				} else {
+					// file:///c:/folder/... ==> just remove the leading slash
+					upth = strings.TrimPrefix(upth, `file:///`)
+				}
+			} else {
+				upth = strings.TrimPrefix(upth, `file://`)
+			}
+		}
+
 		return local(filepath.FromSlash(upth))
 	}
 }
@@ -55,10 +86,19 @@ func LoadStrategy(path string, local, remote func(string) ([]byte, error)) func(
 func loadHTTPBytes(timeout time.Duration) func(path string) ([]byte, error) {
 	return func(path string) ([]byte, error) {
 		client := &http.Client{Timeout: timeout}
-		req, err := http.NewRequest("GET", path, nil)
+		req, err := http.NewRequest("GET", path, nil) // nolint: noctx
 		if err != nil {
 			return nil, err
 		}
+
+		if LoadHTTPBasicAuthUsername != "" && LoadHTTPBasicAuthPassword != "" {
+			req.SetBasicAuth(LoadHTTPBasicAuthUsername, LoadHTTPBasicAuthPassword)
+		}
+
+		for key, val := range LoadHTTPCustomHeaders {
+			req.Header.Set(key, val)
+		}
+
 		resp, err := client.Do(req)
 		defer func() {
 			if resp != nil {