Openapi Scan throws exception

[premdass]

Hi,

I have tried running openapi scan against an url, and getting exception

vulnapi scan openapi https://petstore3.swagger.io/api/v3/openapi.json                                        
panic: interface conversion: interface {} is int, not float64 [recovered]
	panic: interface conversion: interface {} is int, not float64

goroutine 1 [running]:
go.opentelemetry.io/otel/sdk/trace.(*recordingSpan).End.deferwrap1()
	/home/runner/go/pkg/mod/go.opentelemetry.io/otel/[email protected]/trace/span.go:422 +0x2c
go.opentelemetry.io/otel/sdk/trace.(*recordingSpan).End(0x14000320780, {0x0, 0x0, 0x140000021c0?})
	/home/runner/go/pkg/mod/go.opentelemetry.io/otel/[email protected]/trace/span.go:461 +0xa08
panic({0x105613900?, 0x140006a2780?})
	/opt/hostedtoolcache/go/1.23.3/x64/src/runtime/panic.go:785 +0x124
github.com/cerberauth/vulnapi/openapi.mapRequestBodyFakeValueToJSON(0x1400025ad80, {0x1055b07c0, 0x105d411c8})
	/home/runner/go/pkg/mod/github.com/cerberauth/[email protected]/openapi/param.go:37 +0x4f8
github.com/cerberauth/vulnapi/openapi.mapRequestBodyFakeValueToJSON(0x1400025a780, {0x1055fd240, 0x140006a2720})
	/home/runner/go/pkg/mod/github.com/cerberauth/[email protected]/openapi/param.go:59 +0x858
github.com/cerberauth/vulnapi/openapi.getRequestBodyValue(0x14000045768?)
	/home/runner/go/pkg/mod/github.com/cerberauth/[email protected]/openapi/param.go:74 +0x118
github.com/cerberauth/vulnapi/openapi.(*OpenAPI).Operations(0x140005554b0, 0x14000708b10, 0x14000708ba0)
	/home/runner/go/pkg/mod/github.com/cerberauth/[email protected]/openapi/operation.go:87 +0x32c
github.com/cerberauth/vulnapi/scenario.NewOpenAPIScan(0x140005554b0, 0x140004471a0?, 0x0?, 0x140005ed4c0)
	/home/runner/go/pkg/mod/github.com/cerberauth/[email protected]/scenario/openapi.go:20 +0xac
github.com/cerberauth/vulnapi/cmd/scan.NewOpenAPIScanCmd.func1(0x140002e6b00?, {0x14000430dc0?, 0x4?, 0x104fe0b8e?})
	/home/runner/go/pkg/mod/github.com/cerberauth/[email protected]/cmd/scan/openapi.go:81 +0x6e4
github.com/spf13/cobra.(*Command).execute(0x14000458008, {0x14000430d90, 0x1, 0x1})
	/home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:989 +0x81c
github.com/spf13/cobra.(*Command).ExecuteC(0x1400036cc08)
	/home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1117 +0x344
github.com/spf13/cobra.(*Command).Execute(...)
	/home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1041
github.com/cerberauth/vulnapi/cmd.Execute({0x1055284f8?, 0x140000021c0?})
	/home/runner/go/pkg/mod/github.com/cerberauth/[email protected]/cmd/root.go:59 +0x24
main.main()
	/home/runner/go/pkg/mod/github.com/cerberauth/[email protected]/main.go:10 +0x2c
(base) 

i have validated the openapi spec and all looks good without any validation errors. Same error when i download the fine and run it as well

[emmanuelgautier]

Hello @premdass,

Thank you for reporting this issue!

The issue was due to two errors:

• XML body is not managed at this time. (hopefully the petstore example contains choice between json and xml)
• A type error occurred due to the parsing of the example values in OpenAPI.

The issues have been fixed now, and a new release has been made. Can you test it?

[Kazakov12]

I ran it through docker, and the same error occurred.

[emmanuelgautier]

Running this command locally, it works for me now:

docker run cerberauth/vulnapi scan openapi https://petstore3.swagger.io/api/v3/openapi.json

@Kazakov12 In order to reproduce the error, can you share your docker version (docker version) and vulnapi version (docker run cerberauth/vulnapi version)?