Merge pull request #50 from aringo-bf/fix/httpbasic-segfault-and-quiet-flag

Fix HTTPBasic segfault and --quiet flag issues

cmd/auth.go

@@ -45,20 +45,25 @@ func CheckSecuritySchemes(spec map[string]interface{}) {
 						if schemeType := scheme["scheme"]; schemeType != nil {
 							switch schemeType {
 							case "basic":
-								fmt.Println("Basic Authentication is accepted. Supply a username and password? (y/N)")
-								fmt.Scanln(&autoApplyBasicAuth)
-								autoApplyBasicAuth = strings.ToLower(autoApplyBasicAuth)
-								if autoApplyBasicAuth == "y" {
-									fmt.Printf("Enter a username.")
-									fmt.Scanln(&basicAuthUser)
-									fmt.Printf("Enter a password.")
-									fmt.Scanln(&basicAuthPass)
-									basicAuth = []byte(basicAuthUser + ":" + basicAuthPass)
-									basicAuthString = base64.StdEncoding.EncodeToString(basicAuth)
-									log.Infof("Using %s as the Basic Auth value.", basicAuthString)
-									Headers = append(Headers, "Authorization: Basic "+basicAuthString)
-								} else {
+								if quiet {
+									autoApplyBasicAuth = "n"
 									log.Warn("A basic authentication header is accepted. Review the spec and craft a header manually using the -H flag.")
+								} else {
+									fmt.Println("Basic Authentication is accepted. Supply a username and password? (y/N)")
+									fmt.Scanln(&autoApplyBasicAuth)
+									autoApplyBasicAuth = strings.ToLower(autoApplyBasicAuth)
+									if autoApplyBasicAuth == "y" {
+										fmt.Printf("Enter a username.")
+										fmt.Scanln(&basicAuthUser)
+										fmt.Printf("Enter a password.")
+										fmt.Scanln(&basicAuthPass)
+										basicAuth = []byte(basicAuthUser + ":" + basicAuthPass)
+										basicAuthString = base64.StdEncoding.EncodeToString(basicAuth)
+										log.Infof("Using %s as the Basic Auth value.", basicAuthString)
+										Headers = append(Headers, "Authorization: Basic "+basicAuthString)
+									} else {
+										log.Warn("A basic authentication header is accepted. Review the spec and craft a header manually using the -H flag.")
+									}
 								}
 							case "bearer":
 								log.Warn("A bearer token is accepted. Review the spec and craft a token manually using the -H flag.")

cmd/automate.go

@@ -5,6 +5,7 @@ import (
 	"io"
 	"os"
 	"strings"
+	"time"
 
 	"github.com/spf13/cobra"
 
@@ -44,6 +45,12 @@ responds in an abnormal way, manual testing should be conducted (prepare manual
 			}
 		}
 
+		_, err := time.Parse("2006-01-02", customDate)
+		if err != nil {
+			fmt.Println("An invalid date was supplied. Please supply a date in '2006-01-02' format.")
+			os.Exit(1)
+		}
+
 		var bodyBytes []byte
 
 		client := CheckAndConfigureProxy()

cmd/prepare.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"time"
 
 	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
@@ -22,6 +23,12 @@ This enables you to test specific API functions for common vulnerabilities or mi
 			}
 		}
 
+		_, err := time.Parse("2006-01-02", customDate)
+		if err != nil {
+			fmt.Println("An invalid date was supplied. Please supply a date in '2006-01-02' format.")
+			os.Exit(1)
+		}
+
 		client := CheckAndConfigureProxy()
 
 		fmt.Printf("\n")

cmd/requests.go

@@ -59,7 +59,11 @@ func MakeRequest(client http.Client, method, target string, timeout int64, reqDa
 	}
 
 	// Handling of dangerous keywords
-	u, _ := url.Parse(target)
+	u, err := url.Parse(target)
+	if err != nil || u == nil {
+		log.Printf("Error parsing URL '%s': %v - skipping request.", target, err)
+		return nil, "", 0
+	}
 	endpoint := u.RawPath + "?" + u.RawQuery
 	for _, v := range dangerousStrings {
 		if os.Args[1] == "automate" && strings.Contains(endpoint, v) && !strings.Contains(strings.Join(safeWords, ","), v) {
@@ -87,8 +91,11 @@ func MakeRequest(client http.Client, method, target string, timeout int64, reqDa
 	defer cancel()
 
 	req, err := http.NewRequest(method, target, reqData)
-	if err != nil && err != context.Canceled && err != io.EOF {
-		log.Fatal("Error: could not create HTTP request - ", err)
+	if err != nil {
+		if err != context.Canceled && err != io.EOF {
+			log.Fatal("Error: could not create HTTP request - ", err)
+		}
+		return nil, "", 0
 	}
 
 	for i := range Headers {
@@ -168,14 +175,21 @@ func MakeRequest(client http.Client, method, target string, timeout int64, reqDa
 }
 
 func CheckContentType(client http.Client, target string) string {
-	u, _ := url.Parse(target)
+	u, err := url.Parse(target)
+	if err != nil || u == nil {
+		log.Printf("Error parsing URL '%s': %v - skipping request.", target, err)
+		return ""
+	}
 
 	ctx, cancel := context.WithTimeout(context.Background(), time.Duration(timeout)*time.Second)
 	defer cancel()
 
 	req, err := http.NewRequest("GET", target, nil)
-	if err != nil && err != context.Canceled && err != io.EOF {
-		log.Fatal("Error: could not create HTTP request - ", err)
+	if err != nil {
+		if err != context.Canceled && err != io.EOF {
+			log.Fatal("Error: could not create HTTP request - ", err)
+		}
+		return ""
 	}
 
 	// User-Agent handling

cmd/root.go

@@ -7,6 +7,9 @@ import (
 
 var apiTarget string
 var basePath string
+var customDate string
+var customEmail string
+var customURL string
 var format string
 var insecure bool
 var localFile string
@@ -49,7 +52,7 @@ $ sj convert -u https://petstore.swagger.io/v2/swagger.json -o openapi.json`,
 			log.Error("Command not specified. See the --help flag for usage.")
 		}
 	},
-	Version: "2.2.1",
+	Version: "2.3.1",
 }
 
 func Execute() {
@@ -64,6 +67,9 @@ func init() {
 	rootCmd.AddCommand(convertCmd)
 	rootCmd.PersistentFlags().StringVarP(&UserAgent, "agent", "A", "Swagger Jacker (github.com/BishopFox/sj)", "Set the User-Agent string.")
 	rootCmd.PersistentFlags().StringVarP(&basePath, "base-path", "b", "", "Set the API base path if not defined in the definition file (i.e. /V2/).")
+	rootCmd.PersistentFlags().StringVarP(&customURL, "custom-url", "c", "https://bishopfox.com", "Set a custom URL to test discovered URL parameters.")
+	rootCmd.PersistentFlags().StringVarP(&customDate, "custom-date", "d", "1990-01-01", "A custom date to test discovered date parameters.")
+	rootCmd.PersistentFlags().StringVar(&customEmail, "custom-email", "[email protected]", "A custom email address to test discovered email parameters.")
 	rootCmd.PersistentFlags().StringVarP(&format, "format", "f", "json", "Declare the format of the definition file (json/yaml/yml/js).")
 	rootCmd.PersistentFlags().StringArrayVarP(&Headers, "headers", "H", nil, "Add custom headers, separated by a colon (\"Name: Value\"). Multiple flags are accepted.")
 	rootCmd.PersistentFlags().BoolVarP(&insecure, "insecure", "i", false, "Ignores server certificate validation.")

cmd/utils.go

@@ -31,183 +31,6 @@ type SchemaNode struct {
 	Ref        string
 }
 
-func EnforceSingleContentType(newContentType string) {
-	newContentType = strings.TrimSpace(newContentType)
-
-	// Remove old 'Content-Type' header
-	Headers = slices.DeleteFunc(Headers, func(h string) bool {
-		return strings.HasPrefix(strings.ToLower(h), "content-type:")
-	})
-
-	Headers = append(Headers, "Content-Type: "+newContentType)
-
-	// Remove empty elements to avoid repetitions of "-H ''"
-	Headers = slices.DeleteFunc(Headers, func(h string) bool {
-		return strings.TrimSpace(h) == ""
-	})
-}
-
-func ExpandSchema(
-	spec map[string]interface{},
-	schema map[string]interface{},
-	visited map[string]bool,
-) *SchemaNode {
-	if schema == nil {
-		return &SchemaNode{Type: "object"}
-	}
-
-	if ref, ok := schema["$ref"].(string); ok {
-		if visited[ref] {
-			return &SchemaNode{Type: "object"} // break cycle
-		}
-		visited[ref] = true
-
-		resolved := ResolveRef(spec, ref)
-		if resolved == nil {
-			return &SchemaNode{Type: "object"}
-		}
-		return ExpandSchema(spec, resolved, visited)
-	}
-
-	node := &SchemaNode{
-		Properties: map[string]*SchemaNode{},
-		Required:   map[string]bool{},
-	}
-
-	if t, ok := schema["type"].(string); ok {
-		node.Type = t
-	}
-
-	if props, ok := schema["properties"].(map[string]interface{}); ok {
-		for name, raw := range props {
-			if m, ok := raw.(map[string]interface{}); ok {
-				node.Properties[name] = ExpandSchema(spec, m, visited)
-			}
-		}
-	}
-
-	if items, ok := schema["items"].(map[string]interface{}); ok {
-		node.Items = ExpandSchema(spec, items, visited)
-	}
-
-	if allOf, ok := schema["allOf"].([]interface{}); ok {
-		merged := &SchemaNode{Type: "object", Properties: map[string]*SchemaNode{}}
-		for _, entry := range allOf {
-			if m, ok := entry.(map[string]interface{}); ok {
-				sub := ExpandSchema(spec, m, visited)
-				for k, v := range sub.Properties {
-					merged.Properties[k] = v
-				}
-			}
-		}
-		return merged
-	}
-
-	return node
-}
-
-func GenerateExample(node *SchemaNode) interface{} {
-	switch node.Type {
-	case "object", "":
-		obj := map[string]interface{}{}
-		for k, v := range node.Properties {
-			obj[k] = GenerateExample(v)
-		}
-		return obj
-	case "array":
-		if node.Items != nil {
-			return []interface{}{GenerateExample(node.Items)}
-		}
-		return []interface{}{}
-	case "string":
-		return testString
-	case "integer", "number":
-		return 1
-	case "boolean":
-		return true
-	default:
-		return nil
-	}
-}
-
-func GenerateRequests(bodyBytes []byte, client http.Client) {
-	// Ingests the specification file
-	spec := SafelyUnmarshalSpec(bodyBytes)
-
-	// Checks defined security schemes and prompts for authentication
-	CheckSecuritySchemes(spec)
-
-	u, _ := url.Parse(swaggerURL)
-
-	// Gets the target server and base path from the specification file
-	if apiTarget == "" {
-		if v, ok := spec["swagger"].(string); ok && strings.HasPrefix(v, "2") {
-			// Swagger (v2)
-			host, _ := spec["host"].(string)
-			bp, _ := spec["basePath"].(string)
-			if bp == "/" {
-				basePath = ""
-			} else if bp != "" {
-				basePath = bp
-			}
-
-			if host != "" && strings.Contains(host, "://") {
-				apiTarget = host
-			} else {
-				if host != "" {
-					apiTarget = u.Scheme + "://" + host
-				}
-			}
-		} else if v, ok := spec["openapi"].(string); ok && strings.HasPrefix(v, "3") {
-			// OpenAPI (v3)
-			if servers, ok := spec["servers"].([]interface{}); ok && len(servers) > 0 {
-				if len(servers) > 1 {
-					if !quiet && (os.Args[1] != "endpoints") && apiTarget == "" {
-						log.Warn("Multiple servers detected in documentation. You can manually set a server to test with the -T flag.\nThe detected servers are as follows:")
-						for i := range servers {
-							if srv, ok := servers[i].(map[string]interface{}); ok {
-								if serverURL, ok := srv["url"].(string); ok {
-									if strings.Contains(serverURL, "://") {
-										fmt.Println(serverURL)
-									} else {
-										fmt.Println(apiTarget + serverURL)
-									}
-								}
-							}
-						}
-					}
-				} else {
-					if srv, ok := servers[0].(map[string]interface{}); ok {
-						if serverURL, ok := srv["url"].(string); ok {
-							if strings.Contains(serverURL, "://") {
-								apiTarget = serverURL
-							} else if serverURL == "/" {
-								basePath = ""
-							} else {
-								basePath = serverURL
-								apiTarget = u.Scheme + "://" + u.Host
-							}
-						}
-					}
-				}
-			}
-		}
-	}
-
-	// Use the original host at the target if no server found from specification.
-	if apiTarget == "" {
-		apiTarget = u.Scheme + "://" + u.Host
-	}
-
-	if os.Args[1] != "endpoints" {
-		// Prints Title/Description/Version values if they exist
-		PrintSpecInfo(spec)
-	}
-
-	// Reviews all defined API routes and builds requests as defined
-	BuildRequestsFromPaths(spec, client)
-}
-
 func BuildRequestsFromPaths(spec map[string]interface{}, client http.Client) {
 	paths, ok := spec["paths"].(map[string]interface{})
 	if !ok || paths == nil {
@@ -375,7 +198,11 @@ func BuildRequestsFromPaths(spec map[string]interface{}, client http.Client) {
 							}
 						}
 
-						logURL, _ := url.Parse(targetURL)
+						logURL, parseErr := url.Parse(targetURL)
+						if parseErr != nil || logURL == nil {
+							log.Printf("Error parsing URL '%s': %v - skipping endpoint.", targetURL, parseErr)
+							continue
+						}
 						switch os.Args[1] {
 						case "automate":
 							var postBodyData string
@@ -466,6 +293,194 @@ func BuildRequestsFromPaths(spec map[string]interface{}, client http.Client) {
 	}
 }
 
+func EnforceSingleContentType(newContentType string) {
+	newContentType = strings.TrimSpace(newContentType)
+
+	// Remove old 'Content-Type' header
+	Headers = slices.DeleteFunc(Headers, func(h string) bool {
+		return strings.HasPrefix(strings.ToLower(h), "content-type:")
+	})
+
+	Headers = append(Headers, "Content-Type: "+newContentType)
+
+	// Remove empty elements to avoid repetitions of "-H ''"
+	Headers = slices.DeleteFunc(Headers, func(h string) bool {
+		return strings.TrimSpace(h) == ""
+	})
+}
+
+func ExpandSchema(
+	spec map[string]interface{},
+	schema map[string]interface{},
+	visited map[string]bool,
+) *SchemaNode {
+	if schema == nil {
+		return &SchemaNode{Type: "object"}
+	}
+
+	if ref, ok := schema["$ref"].(string); ok {
+		if visited[ref] {
+			return &SchemaNode{Type: "object"} // break cycle
+		}
+		visited[ref] = true
+
+		resolved := ResolveRef(spec, ref)
+		if resolved == nil {
+			return &SchemaNode{Type: "object"}
+		}
+		return ExpandSchema(spec, resolved, visited)
+	}
+
+	node := &SchemaNode{
+		Properties: map[string]*SchemaNode{},
+		Required:   map[string]bool{},
+	}
+
+	if t, ok := schema["type"].(string); ok {
+		node.Type = t
+	}
+
+	if props, ok := schema["properties"].(map[string]interface{}); ok {
+		for name, raw := range props {
+			if m, ok := raw.(map[string]interface{}); ok {
+				node.Properties[name] = ExpandSchema(spec, m, visited)
+			}
+		}
+	}
+
+	if items, ok := schema["items"].(map[string]interface{}); ok {
+		node.Items = ExpandSchema(spec, items, visited)
+	}
+
+	if allOf, ok := schema["allOf"].([]interface{}); ok {
+		merged := &SchemaNode{Type: "object", Properties: map[string]*SchemaNode{}}
+		for _, entry := range allOf {
+			if m, ok := entry.(map[string]interface{}); ok {
+				sub := ExpandSchema(spec, m, visited)
+				for k, v := range sub.Properties {
+					merged.Properties[k] = v
+				}
+			}
+		}
+		return merged
+	}
+
+	return node
+}
+
+func GenerateExample(node *SchemaNode) interface{} {
+	switch node.Type {
+	case "object", "":
+		obj := map[string]interface{}{}
+		for k, v := range node.Properties {
+			if strings.Contains(strings.ToLower(k), "date") {
+				obj[k] = customDate
+			} else if strings.Contains(strings.ToLower(k), "url") {
+				obj[k] = customURL
+			} else if strings.Contains(strings.ToLower(k), "email") {
+				obj[k] = customEmail
+			} else {
+				obj[k] = GenerateExample(v)
+			}
+		}
+		return obj
+	case "array":
+		if node.Items != nil {
+			return []interface{}{GenerateExample(node.Items)}
+		}
+		return []interface{}{}
+	case "string":
+		return testString
+	case "integer", "number":
+		return 1
+	case "boolean":
+		return true
+	default:
+		return nil
+	}
+}
+
+func GenerateRequests(bodyBytes []byte, client http.Client) {
+	// Ingests the specification file
+	spec := SafelyUnmarshalSpec(bodyBytes)
+
+	// Checks defined security schemes and prompts for authentication
+	CheckSecuritySchemes(spec)
+
+	u, parseErr := url.Parse(swaggerURL)
+	if parseErr != nil {
+		u = &url.URL{}
+	}
+
+	// Gets the target server and base path from the specification file
+	if apiTarget == "" {
+		if v, ok := spec["swagger"].(string); ok && strings.HasPrefix(v, "2") {
+			// Swagger (v2)
+			host, _ := spec["host"].(string)
+			bp, _ := spec["basePath"].(string)
+			if bp == "/" {
+				basePath = ""
+			} else if bp != "" {
+				basePath = bp
+			}
+
+			if host != "" && strings.Contains(host, "://") {
+				apiTarget = host
+			} else {
+				if host != "" {
+					apiTarget = u.Scheme + "://" + host
+				}
+			}
+		} else if v, ok := spec["openapi"].(string); ok && strings.HasPrefix(v, "3") {
+			// OpenAPI (v3)
+			if servers, ok := spec["servers"].([]interface{}); ok && len(servers) > 0 {
+				if len(servers) > 1 {
+					if !quiet && (os.Args[1] != "endpoints") && apiTarget == "" {
+						log.Warn("Multiple servers detected in documentation. You can manually set a server to test with the -T flag.\nThe detected servers are as follows:")
+						for i := range servers {
+							if srv, ok := servers[i].(map[string]interface{}); ok {
+								if serverURL, ok := srv["url"].(string); ok {
+									if strings.Contains(serverURL, "://") {
+										fmt.Println(serverURL)
+									} else {
+										fmt.Println(apiTarget + serverURL)
+									}
+								}
+							}
+						}
+					}
+				} else {
+					if srv, ok := servers[0].(map[string]interface{}); ok {
+						if serverURL, ok := srv["url"].(string); ok {
+							if strings.Contains(serverURL, "://") {
+								apiTarget = serverURL
+							} else if serverURL == "/" {
+								basePath = ""
+							} else {
+								basePath = serverURL
+								apiTarget = u.Scheme + "://" + u.Host
+							}
+						}
+					}
+				}
+			}
+		}
+	}
+
+	// Use the original host at the target if no server found from specification.
+	if apiTarget == "" {
+		apiTarget = u.Scheme + "://" + u.Host
+	}
+
+	if os.Args[1] != "endpoints" {
+		// Prints Title/Description/Version values if they exist
+		PrintSpecInfo(spec)
+	}
+
+	// Reviews all defined API routes and builds requests as defined
+	BuildRequestsFromPaths(spec, client)
+}
+
 func ResolveRef(spec map[string]interface{}, ref string) map[string]interface{} {
 	if !strings.HasPrefix(ref, "#") {
 		return nil