EMPTY JSON PATH

[DeliciousBounty]

@RazMag Description of the bug The change_payload function in Active test fail to parse the JSON. I wrote a check for xss, during the running time I got an error "cannot access key "" in JSON array.

To Reproduce Go to swagger/src/active/additional_checks.rs Paste the following code , the code crash when the function change_payload is called. My function is the same as the min_max function check.

pub async fn check_xss_reflected(&self, auth: &Authorization) -> CheckRetVal{ let mut ret_val = CheckRetVal::default(); for oas_map in self.payloads.iter() { for (json_path, schema) in &oas_map.payload.map { for (m, _) in oas_map .path .path_item .get_ops() .iter() .filter(|(m, _)| m == &Method::POST) .filter(|(m,_)|schema.schema_type == Some("string".to_string())) { let url; if let Some(servers) = &self.oas.servers() { if let Some(s) = servers.first() { url = s.url.clone(); } else { continue; }; } else { continue; }; let test_vals= ("payload", "<script>alert()</script>") let req = AttackRequest::builder() .uri(&url, &oas_map.path.path) .method(*m) .headers(vec![]) .parameters(vec![]) .auth(auth.clone()) .payload( &change_payload(&oas_map.payload.payload, json_path, json!(test_vals.1)).to_string(), ) .build();

Expected behavior The code panicked with this error: thread 'main' panicked at 'cannot access key "firstName" in JSON array'.

Screenshots

Additional context During the debugging it appears that the json path value has an empty string (screenshot). The source's problem is difficult to detect because the problematic "key" change at each execution of the program.( see the second screenshot)

[DeliciousBounty]

Did not success to reproduce the Error.