-
Notifications
You must be signed in to change notification settings - Fork 81
Open
Description
Describe the bug
cherrybomb/cherrybomb-engine/src/scan/passive/additions_checks.rs
Lines 168 to 193 in c37520a
| pub fn check_valid_responses(&self) -> Vec<Alert> { | |
| let mut alerts: Vec<Alert> = vec![]; | |
| for (path, item) in &self.swagger.get_paths() { | |
| for (m, op) in item.get_ops() { | |
| let statuses = op.responses().keys().cloned().collect::<Vec<String>>(); | |
| for status in statuses { | |
| if let Ok(res_code) = status.parse::<u16>() { | |
| if !(100..600).contains(&res_code) { | |
| alerts.push(Alert::new( | |
| Level::Low, | |
| "Responses have an invalid or unrecognized status code", | |
| format!("swagger path:{path} operation:{m} status:{status}"), | |
| )); | |
| } | |
| } else if status != "default" { | |
| alerts.push(Alert::new( | |
| Level::Low, | |
| "Responses have an invalid or unrecognized status code", | |
| format!("swagger path:{path} operation:{m} status:{status}"), | |
| )); | |
| } | |
| } | |
| } | |
| } | |
| alerts | |
| } |
https://swagger.io/docs/specification/v3_0/describing-responses/ allows ranges like "4XX"
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels