scriptoriumadmin/strix
1
0
Fork 0
mirror of https://github.com/usestrix/strix.git synced 2026-10-16 04:28:23 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
925 commits 229 branches 31 tags 46 MiB
Commit graph

3 commits

Author SHA1 Message Date
MuchoRio
c73b018f1d fix(api_spec): exclude specification extensions and non-operation fields from server extraction 
- Restrict operation server extraction in _collect_path_item_servers strictly to valid HTTP methods (_OPENAPI_OPERATION_METHODS).
- Skip vendor extension properties (x-*) at the paths and webhooks dictionary level.
- Ensure non-operation dictionary structures (e.g. x-deployment, parameters) never authorize unintended hosts into scan scope.
- Add regression test test_openapi_ignores_vendor_extensions_in_paths_and_operations.
 2026-10-10 19:31:21 +07:00
MuchoRio
5346bc53e4 fix(api_spec): extract path-level and operation-level servers for scope authorization 
- Inspect path-level, operation-level, and webhook-level server declarations in OpenAPI specifications.
- Ensure APIs with microservice routing or without root servers authorize all declared base URLs as in-scope targets.
- Add regression tests for nested path/operation servers, root-less specs, and webhook servers.
 2026-10-10 19:22:52 +07:00
Anurag Mewar
6719a70611
feat: support API specs and Postman collections as targets (#866) 2026-08-03 21:07:44 -07:00