OpenAPI - Add support for application/xml
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 15.8k
- Forks
- 2.6k
- Avg merge
- 13h 16m
- Merged PRs (30d)
- 17
Description
Describe the bug
I have an openapi spec I'm loading into ZAP, that looks like this for 1 path:
/rest/sqli-00/BenchmarkTest00568/send:
post:
operationId: dopost_568
requestBody:
description: Form POST parameters in request body
required: true
content:
application/xml:
schema:
type: object
properties:
name:
type: string
address:
type: string
responses:
default:
description: default response
content:
application/xml: {}
But ZAP is sending:
POST https://localhost:8443/benchmark/rest/sqli-00/BenchmarkTest00568/send HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 57
Accept: application/xml
Host: localhost:8443
{"name":"ZAP","address":"John Doe"}
As you can see, even though the request content type is: application/xml ZAP is sending application/json instead.
To Reproduce
Load an API spec with application/xml as the request content type.
Expected behavior
It should send XML formatted data in the request, not json.
Software versions
- ZAP: 2.10.0
- Add-on: OpenAPI plugin v20
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by loading the reported OpenAPI specification into ZAP and reproducing the request generated for an application/xml request body. Trace the OpenAPI add-on's request generation from the content-type selection through body serialization. Done means the request uses an XML content type and sends XML-formatted data rather than the shown JSON body.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, openapi
- Domain
- api
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100