Zaproxy: OpenAPI API import might return before completely importing everything

Created on 13 Apr 2020 · 3Comments · Source: zaproxy/zaproxy

Describe the bug
When I only have one url defined in my openAPI definition and I execute:

docker run -v {some_path}:/zap/wrk/:rw \
-t owasp/zap2docker-weekly zap-api-scan.py \
-t openapi.json \
-f openapi \
-r zapReport.html

I sometimes get this noURLsException:

(...logs in the middle omitted...)

and it ends by scan nothing as the screenshot above.

However, if I execute the same command again, sometimes it is able to get the url and successfully scan it.

Then if I have 2 urls or above in my openAPi definition file, this issue will not happen.

Here is my openAPI definition:

{
    "openapi": "3.0.1",
    "info": {
        "title": "xxx",
        "description": "xxx",
        "version": "1.0"
    },
    "servers": [
        {
            "url": "http://localhost:7071/api"
        }
    ],
    "paths": {
        "/user": {
            "get": {
                "summary": "user",
                "operationId": "get-user",
                "parameters": [
                    {
                        "name": "name",
                        "in": "query",
                        "description": "name of the user",
                        "schema": {
                            "type": "string"
                        }
                    }
                ],
                "responses": {
                    "200": {
                        "description": null
                    }
                }
            }
        }
    },
    "components": {
        "securitySchemes": {
            "apiKeyHeader": {
                "type": "apiKey",
                "name": "Ocp-Apim-Subscription-Key",
                "in": "header"
            },
            "apiKeyQuery": {
                "type": "apiKey",
                "name": "subscription-key",
                "in": "query"
            }
        }
    },
    "security": [
        {
            "apiKeyHeader": []
        },
        {
            "apiKeyQuery": []
        }
    ]
}

Expected behavior
ZAP should be able to get the url from openapi definition file even if there is only one url.

Software versions