OWASP / OWASP/OFFAT

Error in Parsing the YAML Config File

Open
#142 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
673
Forks
92
PR merge metrics
No merged PRs in 30d

Description

Issue Summary:

I am encountering a warning when attempting to run a scan with the -tdc flag while passing a YAML file containing the configuration data.

Details:
Warning Message:
[11:36:22] WARNING actor1 is required config_data_handler.py:34

Steps to Reproduce:

  1. Copy-paste the example configuration from the README file into a YAML file.
  2. Run the following command:

offat -f openapi.json --server http://[serveraddress] -tdc test_data_config.yaml -o output.yaml -of yaml

Environment:

Tested on both Ubuntu and Windows.
Installed the tool using pip.
Also tested manual installation and running with poetry.

Despite following the example provided in the README, I continue to receive the warning about actor1 being required. I have verified the YAML file's structure and content, but the issue persists across different environments and installation methods. The content of the YAML file is:

actors:
  - actor1:
    request_headers:
      - name: Authorization
        value: Bearer [Token1]
      - name: User-Agent
        value: offat-actor1

    query:
      - name: id
        value: 145
        type: int
      - name: country
        value: uk
        type: str
      - name: city
        value: london
        type: str

    body:
      - name: name
        value: actorone
        type: str
      - name: email
        value: actorone@example.com
        type: str
      - name: phone
        value: +11233211230
        type: str

    unauthorized_endpoints: # For broken access control
      - "/store/order/.*"

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Compare the README configuration example with the YAML shown in the issue, then inspect config_data_handler.py:34 and the -tdc command path. Reproduce the warning with the provided offat command and verify that the configuration is accepted without the actor1 warning while its fields remain available to the scan.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
cli, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.