Skip to content

Accept YAML OpenAPI/Swagger spec when fetched from a URL - #159

Open
arpitjain099 wants to merge 1 commit into
OWASP:devfrom
arpitjain099:fix/accept-yaml-spec-from-url
Open

Accept YAML OpenAPI/Swagger spec when fetched from a URL#159
arpitjain099 wants to merge 1 commit into
OWASP:devfrom
arpitjain099:fix/accept-yaml-spec-from-url

Conversation

@arpitjain099

Copy link
Copy Markdown

Hi, thanks for OFFAT.

The -f flag takes a path or a URL, and a local YAML spec loads fine, but a YAML spec served over a URL gets rejected. In create_parser the fetched body is run through json.loads, so anything that isn't JSON exits with "Invalid json data spec file url". Plenty of OpenAPI specs are published as YAML (raw.githubusercontent, Swagger's own openapi.yaml), so offat -f https://.../openapi.yaml fails today even though the same file on disk works.

Switched the URL branch to yaml.safe_load. JSON is a subset of YAML so JSON URLs keep working, and YAML now loads the same way read_from_filename handles a local file. Added an isinstance check so a non-object 200 response still errors cleanly instead of failing later with an AttributeError. pyyaml is already a dependency.

Added tests for YAML and JSON specs fetched from a URL. Existing tests still pass.

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
Comment on lines +29 to +31
spec = yaml_load(res.text)
except YAMLError:
logger.error('Failed to parse spec fetched from url as JSON/YAML')

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ideally it should support both json and yaml

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It does support both. yaml.safe_load parses JSON as well, so a JSON spec served over a URL keeps working and a YAML one now works too, which matches what read_from_filename already gives local files. Both paths are covered by the tests here: test_json_spec_from_url and test_yaml_spec_from_url.

One caveat worth flagging: PyYAML implements YAML 1.1, and there JSON is not a strict subset. A literal tab used as whitespace between tokens, for example {"a":\t1}, raises a ScannerError while json.loads accepts it. It is rare in practice for a served spec, but if you want it fully covered I can try json.loads first and fall back to yaml.safe_load, and add a test for that case.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants