mirror of
https://github.com/projectdiscovery/nuclei.git
synced 2026-11-11 17:38:41 -10:00
bazsec
266593d7a0
A null value in an OpenAPI or Swagger document (an empty list item, or a map key with no value) decodes to a nil pointer. Several of these were dereferenced without a check, so loading such a spec with -im openapi or -im swagger crashed nuclei with SIGSEGV. openapi (generator.go): - a null entry under `servers:` -> nil *Server - a null media type under `content:` -> nil *MediaType swagger (dereferenced inside kin-openapi's openapi2conv.ToV3): - a null path item under `paths:` -> nil *PathItem - a null item under path/operation `parameters:` or a null top-level parameter -> nil *Parameter - a null operation or top-level response -> nil *Response Skip the nil entries in the generator, and drop them from the decoded Swagger document before converting it. Other null entries are already rejected by kin-openapi with an error and are left alone. Also add a go-fuzz harness for the OpenAPI parser with a seed corpus, so the weekly fuzz workflow picks it up, and regression tests that panic on the pre-fix code.
21 lines
459 B
Go
21 lines
459 B
Go
//go:build gofuzz
|
|
// +build gofuzz
|
|
|
|
package openapi
|
|
|
|
// Fuzz exercises OpenAPI 3.0 schema parsing and request generation. The input
|
|
// bytes are treated as a raw schema document (YAML or JSON) and fed through the
|
|
// format's Parse, which loads the schema and generates requests from it.
|
|
func Fuzz(data []byte) int {
|
|
if len(data) == 0 {
|
|
return 0
|
|
}
|
|
if len(data) > fuzzMaxInputSize {
|
|
return -1
|
|
}
|
|
if !fuzzOpenAPIParsing(data) {
|
|
return 0
|
|
}
|
|
return 1
|
|
}
|