search

OWASP / OFFAT

The OWASP OFFAT tool autonomously assesses your API for prevalent vulnerabilities, though full compatibility with OAS v3 is pending. The project remains a work in progress, continuously evolving towards completion.
http://owasp.org/OFFAT/
MIT License
453 stars 64 forks source link

[feature] capability to set Host and port , and even basePath #70

Closed LasneF closed 6 months ago

LasneF commented 6 months ago

Hello

given than an OAS spec can be used in various implementation ( dev , uat, prod) the server section is not always accurate

it would be great to be able to override the setting with a command like this

offat -f .\openapi.yml http://myHost:myPort/myPath

notice it is not as same as setting a proxy

this use case it taken into consideration for tooling such as prism or vaccum

dmdhrumilmistry commented 6 months ago

Hello

given than an OAS spec can be used in various implementation ( dev , uat, prod) the server section is not always accurate

it would be great to be able to override the setting with a command like this

offat -f .\openapi.yml http://myHost:myPort/myPath

notice it is not as same as setting a proxy

this use case it taken into consideration for tooling such as prism or vaccum

Hi @LasneF,

would below option work for you?

offat -f openapi.yml --server http://host:port/path

if server flag is not provided then it'll expect value to be present in the OAS file.

Let me know if I'm interpreting this incorrectly along with few reference links.

LasneF commented 6 months ago

this would make the deal yes , then is it by default , is it --host , or server , you are the boss :)

dmdhrumilmistry commented 6 months ago

this would make the deal yes , then is it by default , is it --host , or server , you are the boss :)

It'll be server flag

dmdhrumilmistry commented 6 months ago

this feature has been released in latest version of offat 0.17.0.

you can bump to latest version using

python -m pip install -U offat

replace python with python3 if required

LasneF commented 5 months ago

Tested and validated , it works like a charm