blst-security / cherrybomb

Stop half-done APIs! Cherrybomb is a CLI tool that helps you avoid undefined user behaviour by auditing your API specifications, validating them and running API security tests.
https://www.blstsecurity.com/cherrybomb
Apache License 2.0
1.08k stars 78 forks source link

CLI panick when server url contains `variables` that have a default #77

Closed jayvdb closed 1 year ago

jayvdb commented 1 year ago

Describe the bug

I have an OpenAPI v3 with a servers section which uses variables that all have defaults, roughly like the following

servers:
  - url: "https://some-server.com:{port}/{basePath}"
    variables:
      port:
        default: "443"
      basePath:
        default: "SomePath/v1"

This causes the CLI to panick because it tries to fetch from literal https://some-server.com:{port}/{basePath}/endpoint1

To Reproduce Steps to reproduce the behavior:

  1. Create an OAS containing servers with variables that all have a default
  2. Run RUST_BACKTRACE=full cherrybomb oas --file /path/to/openapi3.yaml
  3. See error

Expected behavior The defaults should be substituted into the url.

Screenshots

thread 'main' panicked at 'called `Result::unwrap()` on an `Err` value: reqwest::Error { kind: Builder, source: InvalidPort }', /home/jayvdb/rust/cherrybomb/swagger/src/scan/active/http_client/req.rs:133:14
stack backtrace:
   0:     0x5594e8f28ea0 - std::backtrace_rs::backtrace::libunwind::trace::h8775ca7549bd9aaf
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/../../backtrace/src/backtrace/mod.rs:66:5
   1:     0x5594e8f28ea0 - std::backtrace_rs::backtrace::trace_unsynchronized::h32943b3fb883795a
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/../../backtrace/src/backtrace/mod.rs:66:5
   2:     0x5594e8f28ea0 - std::sys_common::backtrace::_print_fmt::h0669395116b5d100
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/sys_common/backtrace.rs:66:5
   3:     0x5594e8f28ea0 - <std::sys_common::backtrace::_print::DisplayBacktrace as core::fmt::Display>::fmt::h1c1f48aaca31af10
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/sys_common/backtrace.rs:45:22
   4:     0x5594e8f4eeae - core::fmt::write::h661da9189e69e70a
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/core/src/fmt/mod.rs:1202:17
   5:     0x5594e8f228b5 - std::io::Write::write_fmt::h1d5b175244301558
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/io/mod.rs:1679:15
   6:     0x5594e8f2a6a3 - std::sys_common::backtrace::_print::h6a2a07f240de0cad
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/sys_common/backtrace.rs:48:5
   7:     0x5594e8f2a6a3 - std::sys_common::backtrace::print::h995e03192e670124
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/sys_common/backtrace.rs:35:9
   8:     0x5594e8f2a6a3 - std::panicking::default_hook::{{closure}}::h853ab346ed83a809
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/panicking.rs:295:22
   9:     0x5594e8f2a38f - std::panicking::default_hook::hb7d50a51602c487b
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/panicking.rs:314:9
  10:     0x5594e8f2ad4a - std::panicking::rust_panic_with_hook::h95dc4345a5e101a2
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/panicking.rs:698:17
  11:     0x5594e8f2ac47 - std::panicking::begin_panic_handler::{{closure}}::h595f317cb1a01c1d
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/panicking.rs:588:13
  12:     0x5594e8f2934c - std::sys_common::backtrace::__rust_end_short_backtrace::h45aa6af331d91ebb
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/sys_common/backtrace.rs:138:18
  13:     0x5594e8f2a962 - rust_begin_unwind
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/panicking.rs:584:5
  14:     0x5594e8a90f33 - core::panicking::panic_fmt::hb6ebde4b6fadbf9c
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/core/src/panicking.rs:142:14
  15:     0x5594e8a91083 - core::result::unwrap_failed::hcf42c238e586aec7
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/core/src/result.rs:1785:5
  16:     0x5594e8b2cca5 - <core::future::from_generator::GenFuture<T> as core::future::future::Future>::poll::hb73d555436dff7d7
  17:     0x5594e8b26e7b - swagger::scan::checks::<impl swagger::scan::active::ActiveScan<T>>::run_check::{{closure}}::hfeeb8115a50cf861
  18:     0x5594e8b31aa6 - cherrybomb::parse_oas::{{closure}}::h2a4f67ce8d4cc858
  19:     0x5594e8b2b1f4 - <core::future::from_generator::GenFuture<T> as core::future::future::Future>::poll::h6db253bfc37efc93
  20:     0x5594e8aeeb36 - std::thread::local::LocalKey<T>::with::h487811906382d07f
  21:     0x5594e8b3f04a - tokio::park::thread::CachedParkThread::block_on::hacb2ca323e762455
  22:     0x5594e8ae9844 - tokio::runtime::scheduler::multi_thread::MultiThread::block_on::hab6656b3d64ed084
  23:     0x5594e8b3f124 - tokio::runtime::Runtime::block_on::h76afc280c10b7e30
  24:     0x5594e8ab3c6c - cherrybomb::main::h6a89d077b12cae37
  25:     0x5594e8ad79c3 - std::sys_common::backtrace::__rust_begin_short_backtrace::hb510b9cb7680e716
  26:     0x5594e8ae2689 - std::rt::lang_start::{{closure}}::h5e41c6681c949712
  27:     0x5594e8f1dd7f - core::ops::function::impls::<impl core::ops::function::FnOnce<A> for &F>::call_once::hd5a40c5c8da4e1d6
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/core/src/ops/function.rs:280:13
  28:     0x5594e8f1dd7f - std::panicking::try::do_call::h76d99af31738b65a
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/panicking.rs:492:40
  29:     0x5594e8f1dd7f - std::panicking::try::h7b17488cb6a9e4b4
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/panicking.rs:456:19
  30:     0x5594e8f1dd7f - std::panic::catch_unwind::hbfc3c253cd2a3290
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/panic.rs:137:14
  31:     0x5594e8f1dd7f - std::rt::lang_start_internal::{{closure}}::h559f65fd2a30215e
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/rt.rs:148:48
  32:     0x5594e8f1dd7f - std::panicking::try::do_call::h46408ceeefe09863
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/panicking.rs:492:40
  33:     0x5594e8f1dd7f - std::panicking::try::h7aada49248c3fbe0
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/panicking.rs:456:19
  34:     0x5594e8f1dd7f - std::panic::catch_unwind::hbac65c9221a2910b
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/panic.rs:137:14
  35:     0x5594e8f1dd7f - std::rt::lang_start_internal::h5836e6d88ed373fc
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/rt.rs:148:20
  36:     0x5594e8ab3d48 - main
  37:     0x7f6b7c1285f0 - __libc_start_call_main
  38:     0x7f6b7c1286b9 - __libc_start_main@GLIBC_2.2.5
  39:     0x5594e8a91265 - _start
                               at /home/abuild/rpmbuild/BUILD/glibc-2.36/csu/../sysdeps/x86_64/start.S:115
  40:                0x0 - <unknown>

Desktop (please complete the following information):

Additional context

DeliciousBounty commented 1 year ago

@jayvdb Thank you for reporting this issue. We will work on the Server Variable Object soon.