search

blst-security / cherrybomb

Stop half-done APIs! Cherrybomb is a CLI tool that helps you avoid undefined user behaviour by auditing your API specifications, validating them and running API security tests.
https://www.blstsecurity.com/cherrybomb
Apache License 2.0
1.12k stars 78 forks source link

External $ref #151

Open jayvdb opened 10 months ago

jayvdb commented 10 months ago

Describe the bug If a $ref refers to an external document, cherrybomb panics with "external references are not supported yet.."

To Reproduce Steps to reproduce the behavior:

  1. Create an open $ref to link to another file
  2. Run cherrybomb on the openapi file
  3. See error

Expected behavior cherrybomb reads the external doc.

jayvdb commented 10 months ago

One way to reduce the impact of this is to add pub to run_profile_info etc, so that I can load the OAS myself, and then invoking those inner functions with the loaded doc.