nikitastupin / clairvoyance

Obtain GraphQL API schema even if the introspection is disabled
Apache License 2.0
960 stars 87 forks source link

Wrong relative file open #56

Closed noraj closed 1 year ago

noraj commented 1 year ago

Description

It seems clairvoyance is unable to detect its install dir and load the wordlist from here, instead it tries to load it from the working/current directory.

$ clairvoyance -o /tmp/dvga-schema.json http://noraj.test:5013/graphql
Traceback (most recent call last):
  File "/usr/bin/clairvoyance", line 8, in <module>
    sys.exit(cli())
  File "/usr/lib/python3.10/site-packages/clairvoyance/cli.py", line 109, in cli
    asyncio.run(
  File "/usr/lib/python3.10/asyncio/runners.py", line 44, in run
    return loop.run_until_complete(main)
  File "/usr/lib/python3.10/asyncio/base_events.py", line 649, in run_until_complete
    return future.result()
  File "/usr/lib/python3.10/site-packages/clairvoyance/cli.py", line 47, in blind_introspection
    wordlist = wordlist or load_default_wordlist()
  File "/usr/lib/python3.10/site-packages/clairvoyance/cli.py", line 33, in load_default_wordlist
    with open('clairvoyance/wordlist.txt', 'r', encoding='utf-8') as f:
FileNotFoundError: [Errno 2] No such file or directory: 'clairvoyance/wordlist.txt'

So one has to use the -w option even to run the default wordlist.

$ clairvoyance -o /tmp/dvga-schema.json http://noraj.test:5013/graphql -w /usr/lib/python3.10/site-packages/clairvoyance/wordlist.txt 
2022-11-23 15:30:18     INFO    | Starting blind introspection on http://noraj.test:5013/graphql...

Troubleshooting

https://github.com/nikitastupin/clairvoyance/blob/137450e4a216d2bfc589ee243937649d3d63411d/clairvoyance/cli.py#L32-L34

I think is could be replaced by something like:

import os
os.path.join(os.path.dirname(__file__), 'wordlist.txt')

I'll PR.