CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-07-11 02:53:11 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Adding --openapi-tags

Browse source
This commit is contained in:
Miroslav Štampar 2026-07-09 14:13:21 +02:00
parent fc1ae6950e
commit 622cfa76c6
6 changed files with 37 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

19
tests/test_openapi.py
View file

@ -134,6 +134,25 @@ class TestOpenApi(unittest.TestCase):
self.assertEqual(headers["X-Api"], "k" + MARK)
self.assertEqual(headers["Cookie"], "sess=v" + MARK)
def test_tag_filter_restricts_operations(self):
# '--openapi-tags' keeps only operations declaring at least one requested tag; untagged
# operations are dropped when a filter is active
spec = {"openapi": "3.0.0", "servers": [{"url": "https://api.test"}], "paths": {
"/users/{id}": {"get": {"tags": ["users"], "parameters": [{"name": "id", "in": "path", "schema": {"type": "integer"}}]}},
"/admin": {"post": {"tags": ["admin"], "parameters": [{"name": "q", "in": "query", "schema": {"type": "string"}}]}},
"/ping": {"get": {"parameters": [{"name": "x", "in": "query", "schema": {"type": "string"}}]}}}}
content = json.dumps(spec)
self.assertEqual(len(openApiTargets(content)), 3) # no filter -> everything
self.assertEqual(len(openApiTargets(content, tags=["nope"])), 0) # no match -> nothing (incl. untagged)
users = openApiTargets(content, tags=["users"])
self.assertEqual(len(users), 1)
self.assertIn("/users/", users[0][0])
both = openApiTargets(content, tags=["users", "admin"]) # union of tags
self.assertEqual(sorted(_[1] for _ in both), ["GET", "POST"])
# --- graceful degradation: a broken/poorly-defined spec must never crash the parser ---
def test_malformed_raises_valueerror(self):