swaggo / http-swagger

As per title, the Handler has a data race in assigning Prefix due to the sync.Once being function scoped and Prefix existing in the swaggo/files package.

The problematic code:

http-swagger/swagger.go

Lines 157 to 159 in c8d62bf

    
           once.Do(func() { 
        
           	handler.Prefix = matches[1] 
        
           })

This means that any reads to files.Handler.Prefix are globally unsafe across all swaggo packages.

The race can be avoided by only ever invoking one handler. This is not very likely to happen in practice, but problematic in tests. The way it's written also unfortunately means it's impossible to serve on two different endpoints (just an observed behavior, not a requirement).

This happens in practice as well. I have 2 routes defined for 2 different swaggers files. /swagger/*any and /swagger-swe/*any and I pass different handlers for them httpSwagger.Handler() and httpSwagger.Handler(httpSwagger.InstanceName("swe")). However only one of them works.

The same bug in gin-swagger package too: swaggo/gin-swagger#225 swaggo/gin-swagger#234

Data race in `Handler`, modifies global from `swaggo/files` package but `sync.Once` protection is function scoped