zaproxy / zaproxy/zaproxy

OpenAPI - Add support for application/xml

Open
#6,767 22 comments 3 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

add-on enhancement in:openapi Usability
Dominant language
Java
Stars
15.8k
Forks
2.6k
Avg merge
13h 16m
Merged PRs (30d)
17

Description

Describe the bug
I have an openapi spec I'm loading into ZAP, that looks like this for 1 path:

/rest/sqli-00/BenchmarkTest00568/send:
  post:
    operationId: dopost_568
    requestBody:
      description: Form POST parameters in request body
      required: true
      content:
        application/xml:
          schema:
            type: object
            properties:
              name:
                type: string
              address:
                type: string
    responses:
      default:
        description: default response
        content:
          application/xml: {}

But ZAP is sending:

POST https://localhost:8443/benchmark/rest/sqli-00/BenchmarkTest00568/send HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 57
Accept: application/xml
Host: localhost:8443

{"name":"ZAP","address":"John Doe"}

As you can see, even though the request content type is: application/xml ZAP is sending application/json instead.

To Reproduce
Load an API spec with application/xml as the request content type.

Expected behavior
It should send XML formatted data in the request, not json.

Software versions

  • ZAP: 2.10.0
  • Add-on: OpenAPI plugin v20

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by loading the reported OpenAPI specification into ZAP and reproducing the request generated for an application/xml request body. Trace the OpenAPI add-on's request generation from the content-type selection through body serialization. Done means the request uses an XML content type and sends XML-formatted data rather than the shown JSON body.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, openapi
Domain
api
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.