Accept OpenAPI v3.1.x as input specification for DAST API fuzzing
Problem
DAST API fuzzing does not allow the usage of OpenAPI documents version 3.1 as input.
Proposal
Update DAST API Fuzzing (Automation and Worker-Entry components) to accept OpenAPI documents based on new features
-
Worker-Entry -
Allow using Version 3.1.x -
Prevent validation error when using version 3.1.x -
Add JSON Schema validation for OpenAPI 3.1.x schema-v3.1
-
-
Add Integration tests using OpenAPI 3.1.x
-
-
Automation-Runner -
Allow using Version 3.1.x -
Prevent validation error when using version 3.1.x -
Feature Update: -
JSON Schema Array of Types
Make sure newnull
syntax and type listing are loaded properly. -
JSON Schema Examples
Make sureexamples
property is also checked when producing sample data. -
Webhooks
show a warning indicatingwebhooks
are not supported. -
OpenAPI Top-Level Elements
Thepaths
element is optional. Double-check that is still validating that property is required and has at least 1 element. -
Request Bodies for Any Method
Check request body is generated forHEAD
andGET
requests.
-
-
-
-
Add tests -
JSON Schema Array of Types
(Worker-Entry: Integration) [X] (Automation: Unit) [X] -
JSON Schema Examples
(Worker-Entry: Integration) [X] (Automation: Unit) [X] -
Request Bodies for Any Method
(Worker-Entry: Integration) [X] (Automation: Integration) [X]
-
-
Update DAST API/ API Fuzzing documentation -
Publish new container
Notes:
- NSwag uses JsonSchema library, which seems to be loading the relevant new features properly.
- Python
Draft4Validator
supports up to JsonSchemaDraft4
, but OpenAPI v3.1 uses2020-12
. Hence, from Python listing in json-schema.org only jschon supports JsonSchema 2020-12.
Links
Edited by Herber Madrigal