CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-08-04 14:55:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Minor bug fix for --openapi

Browse source
This commit is contained in:
Miroslav Štampar 2026-07-28 14:39:44 +02:00
parent 84f0ef8232
commit f992e44fb5
3 changed files with 14 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
lib/core/settings.py
View file

@ -20,7 +20,7 @@ from lib.core.enums import OS
from thirdparty import six
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
VERSION = "1.10.7.219"
VERSION = "1.10.7.220"
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

6
lib/parse/openapi.py
View file

@ -193,7 +193,11 @@ def _baseUrl(spec, origin=None, servers=None):
variables = servers[0].get("variables")
if isinstance(variables, dict):
for name, meta in variables.items():
default = meta.get("default", "1") if isinstance(meta, dict) else "1"
meta = meta if isinstance(meta, dict) else {}
default = meta.get("default")
if default is None: # 'default' is spec-required; when omitted, a declared enum value beats a placeholder host ('1')
enum = meta.get("enum")
default = enum[0] if isinstance(enum, list) and enum else "1"
url = url.replace("{%s}" % name, str(default))
if re.match(r"(?i)[a-z][a-z0-9+.-]*://", url): # absolute server URL -> used as declared (the host is NOT rewritten to the spec's own origin)
return url.rstrip('/')

8
tests/test_openapi.py
View file

@ -116,6 +116,14 @@ class TestOpenApi(unittest.TestCase):
"paths": {"/p": {"get": {}}}}
self.assertEqual(_targets(spec, None)[0][0], "https://prod.x.io/v3/p")
def test_server_variable_enum_without_default(self):
# a server variable that declares an 'enum' but omits the (spec-required) 'default' must use a
# declared enum value, not a placeholder host - else the target is https://1/... (unscannable)
spec = {"openapi": "3.0.0", "servers": [{"url": "https://{h}/v1",
"variables": {"h": {"enum": ["real.com"]}}}],
"paths": {"/x": {"get": {}}}}
self.assertEqual(_targets(spec, None)[0][0], "https://real.com/v1/x")
def test_headers_are_hashable_tuples(self):
# kb.targets is an OrderedSet, so the emitted headers must be hashable (tuple, not list)
spec = {"openapi": "3.0.0", "paths": {"/x": {"get": {"parameters": [