Summary

The link at the bottom of the docs (https://api.collegefootballdata.com/api/docs/?url=/api-docs.json#/) indicates that the schema is invalid.

The provided validator output indicates two key issues:

1. A typo -- "min u mum" should be "min i mum"
2. The type declaration of /definitions/LivePlayByPlay/properties/drives/items is incorrect

The first one is pretty straight forward. I dug into the second one, and it's actually in one of the nested objects.

I'll open a PR for these fixes.

invalid schema image/link

Error: "😱 Could not render n, see the console."

{
    "messages":
    [
        "attribute paths.'/games/media'(get).[week].minumum is unexpected",
        "attribute paths.'/games/weather'(get).[week].minumum is unexpected",
        "attribute paths.'/games/players'(get).[year].minumum is unexpected",
        "attribute paths.'/games/players'(get).[week].minumum is unexpected",
        "attribute paths.'/drives'(get).[week].minumum is unexpected",
        "attribute paths.'/plays'(get).[week].minumum is unexpected",
        "attribute paths.'/play/stats'(get).[week].minumum is unexpected",
        "attribute paths.'/roster'(get).[year].minumum is unexpected",
        "attribute paths.'/teams/matchup'(get).[minYear].minumum is unexpected",
        "attribute paths.'/coaches'(get).[year].minumum is unexpected",
        "attribute paths.'/rankings'(get).[week].minumum is unexpected",
        "attribute paths.'/lines'(get).[week].minumum is unexpected",
        "attribute paths.'/ppa/games'(get).[week].minumum is unexpected",
        "attribute paths.'/ppa/players/games'(get).[week].minumum is unexpected",
        "attribute paths.'/metrics/wp/pregame'(get).[week].minumum is unexpected",
        "attribute paths.'/stats/season'(get).[startWeek].minumum is unexpected",
        "attribute paths.'/stats/season'(get).[endWeek].minumum is unexpected",
        "attribute paths.'/stats/season/advanced'(get).[startWeek].minumum is unexpected",
        "attribute paths.'/stats/season/advanced'(get).[endWeek].minumum is unexpected",
        "attribute paths.'/stats/game/advanced'(get).[week].minumum is unexpected"
    ],
    "schemaValidationMessages":
    [
        {
            "level": "error",
            "domain": "validation",
            "keyword": "anyOf",
            "message": "instance failed to match at least one required schema among 2",
            "schema":
            {
                "loadingURI": "http://swagger.io/v2/schema.json#",
                "pointer": "/definitions/schema/properties/items"
            },
            "instance":
            {
                "pointer": "/definitions/LivePlayByPlay/properties/drives/items"
            }
        }
    ]
}

output from validator

Summary

When requesting advanced stats, the "conference" property always displays the current conference. The regular stats endpoint, however, returns the relevant conference for each stat.

Steps to reproduce

1. Make a request for advanced stats for a team that has changed conferences, for example UCF.

   • without a year parameter

     curl \
         --request GET 'https://api.collegefootballdata.com/stats/season/advanced?team=ucf' \
         --header 'Authorization: Bearer $CFBD_API_TOKEN'

   • with a year parameter

     curl \
         --request GET 'https://api.collegefootballdata.com/stats/season/advanced?team=ucf&year=2005' \
         --header 'Authorization: Bearer $CFBD_API_TOKEN'

2. Inspect a stat for a year where they were in a different conference (e.g. 2005)

   {
        "season": 2005,
        "team": "UCF",
        "conference": "American Athletic",
        ...
   }

Expected results

The "conference" property is the conference affiliated with the team at the time of the stat (e.g. "Conference USA").

Actual results

The "conference" property is always the current conference (e.g. "American Athletic").

Other notes

The StatsService.getTeamStats function builds the SQL that joins on the matching conference, which I think is desired:

INNER JOIN conference_team AS ct
  ON t.id = ct.team_id
  AND ct.start_year <= g.season
  AND (ct.end_year IS NULL OR ct.end_year >= g.season)

The StatsService.getAdvancedStats function builds the SQL using a couple different join conditions, but always on the latest conference:

INNER JOIN conference_team AS ct
  ON t.id = ct.team_id
  AND ct.end_year IS NULL

and...

INNER JOIN conference_team AS ct
  ON ct.team_id = t.id
  AND ct.end_year IS NULL
  AND ct.start_year IS NOT NULL

Thoughts @BlueSCar ?

Hello!

I hope you are doing well!

We are a security research team. Our tool automatically detected a vulnerability in this repository. We want to disclose it responsibly. GitHub has a feature called Private vulnerability reporting, which enables security research to privately disclose a vulnerability. Unfortunately, it is not enabled for this repository.

Can you enable it, so that we can report it?

Thanks in advance!

PS: you can read about how to enable private vulnerability reporting here: https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository