matusf / openapi-fuzzer

Black-box fuzzer that fuzzes APIs based on OpenAPI specification. Find bugs for free!
GNU Affero General Public License v3.0
526 stars 22 forks source link

Fails to parse openapi schema #11

Open alexspurling opened 2 years ago

alexspurling commented 2 years ago

I have the following dummy openapi schema adapted from a json schema generated by a real API. This schema cannot be parsed by openapi-fuzzer 0.1.3 (built from master commit 7da1471)

Schema:

{
  "openapi": "3.0.2",
  "info": {
    "title": "Example",
    "description": "Example",
    "version": "0.0.1"
  },
  "paths": {
    "/foo": {
      "get": {
        "operationId": "getFoo",
        "summary": "Get list of foo",
        "description": "Returns all the foo",
        "produces": [
          "application/json"
        ]
      }
    }
  }
}

Error:

$ openapi-fuzzer -s ~/code/openapi.json -u http://localhost
Error: Failed to parse schema

Caused by:
    paths: data did not match any variant of untagged enum ReferenceOr at line 8 column 12
matusf commented 2 years ago

Hi, I checked the schema with https://editor.swagger.io/ and according to it, the schema is not valid. image

alexspurling commented 2 years ago

Thanks. I stripped out the responses field because I got the same error with or without it. It appears that the produces field was the actual cause of the parse failure. Unfortunately, the error message does not give any hints as to the reason for the parse failure.

This modified example does work:

{
  "openapi": "3.0.2",
  "info": {
    "title": "Example",
    "description": "Example",
    "version": "0.0.1"
  },
  "paths": {
    "/foo": {
      "get": {
        "operationId": "getFoo",
        "summary": "Get list of foo",
        "description": "Returns all the foo",
        "responses": {
          "200": {
            "description": "foo",
            "headers": {},
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          }
        }
      }
    }
  }
}
LeoFVO commented 1 year ago

Hey, as shown in the code the openApi file should be in yaml...

We should improve the error handling and maybe support json format.

matusf commented 1 year ago

JSON format is not the issue. YAML is a superset of JSON.

LeoFVO commented 1 year ago

JSON format is not the issue. YAML is a superset of JSON.

Damn, didn't know about that. Thanks for this tips :)

qarmin commented 1 year ago

Can this error be ignored by using less restrictive openapi parser?

According to https://editor.swagger.io/ looks that fastapi produces invalid openapi.json, but still usable locally on my pc(swagger-ui not shows any errors).

Fixing errors manually would take too much time.