blst-security / cherrybomb

Stop half-done APIs! Cherrybomb is a CLI tool that helps you avoid undefined user behaviour by auditing your API specifications, validating them and running API security tests.
https://www.blstsecurity.com/cherrybomb
Apache License 2.0
1.11k stars 78 forks source link

OpenAPI v3.1 Support #19

Closed philsturgeon closed 2 years ago

philsturgeon commented 2 years ago

Hello! As the maintainer of openapi.tools, and as somebody works with Linux Foundation helping out in OpenAPI-land, I'm reaching out to tooling vendors to track the progress towards supporting OpenAPI v3.1, to see what roadblocks there are beyond folks just generally being busy at this ridiculous time.

OpenAPI v3.1 has a bunch of great little changes, solving problems like the the JSON Schema <!=> OpenAPI Schema Object divergence. It also fixes some other inconsistencies and duplicate ways of doing things. It's the best version and everyone should be using it, but we need tooling to catch up. Just in case folks didn't notice, or don't have resources to simplify the process, I'm here to give a friendly prod and send over some handy links.

Here are a few articles showing off the differences between OpenAPI v3.0 and v3.1.

Here are some example files which can make for handy pass/fail test cases:

https://github.com/Mermade/openapi3-examples/tree/master/3.1

If you're looking for the JSON Schema that defines a valid OpenAPI document, that'll be right over here:

https://github.com/OAI/OpenAPI-Specification/tree/main/schemas/v3.1

When you're starting work on it, please update this issue so I can update openapi.tools to reflect that, and folks will have a way to subscribe for updates.

LMK if you have any questions!

GuyL99 commented 2 years ago

@H31S3nb3rg-0x00 H31S3nb3rg-0x00 This may be some good testing additions for you to explore

DeliciousBounty commented 2 years ago

Hi @philsturgeon, First of all Thank you for reaching out to us, we already support OpenAPI v3.1. So I did not understand your recommendations, please be more precise :) Thank you !

philsturgeon commented 2 years ago

@H31S3nb3rg-0x00 thanks for the fast reply!

I had a go with cherrybomb on the mermade examples I posted a link to, and it doesn't seem to be too happy.

$ cherrybomb oas --file 3.1/pass/mega.yaml
no token?
Error: Failed at parsing swagger json file:"3.1/pass/mega.yaml"

That said I should have dug a little deeper, because I'm also getting errors on 3.0 examples:

$ cherrybomb oas --file 3.0/pass/openapi.yaml
Error: Failed at parsing swagger json file:"3.0/pass/openapi.yaml"

P.S Id really not expect to see the word swagger showing up... anywhere really. It;s retroactive renamed so if you support a command alias thats one thing, but I'd try and hide it away from users to avoid confusion as its just OpenAPI / OAS for short now.

DeliciousBounty commented 2 years ago

@philsturgeon Oh I understand, we actually support only JSON file. The next release 0.6 (in few weeks) will support YAML file.

GuyL99 commented 2 years ago

We've released YAML support in our recent version, now we support 3.1 fully.