Fuzzing won't be executed on POST method without request body about cats HOT 6 CLOSED

Hi @Mato816. CATS only supports application/json as Content-Type. As I see in the Pet Store json contract the POST endpoint accepts application/x-www-form-urlencoded. You can provide additional contentTypes using the --contentType argument (like --contentType=application/x-www-form-urlencoded) but that might lead to some things breaking as it expects JSON elements to be present.

from cats.

Hi @en-milie,

thank you for your response. If i provided additional parameter --contentType=application/x-www-form-urlencoded it worked well.
I have only additional question. If i have API docs the POST endpoint accepts */* what can i provide in --contentType additional argument?
API doc - petstoreTest.zip

from cats.

Hi @Mato816. To answer your question you shouldn't provide anything in --contentType as it adds json by default. I'm working now on a feature to provide out of the box support for application/x-www-form-urlencoded and multipart/form-data on top of the default json one.

from cats.

Hi @en-milie,

I have a question on your last answer.
I tried fuzzing for API doc petstoreTest.zip with following command:

java -jar cats.jar --contract=petstoreTest.yaml --server=https://petstore.swagger.io --paths=/pet/{petId} --urlParams=petId:PET-123 --httpMethods=POST

and got message:

The following HTTP methods won't be executed for path /pet/{petId}: [DELETE]

I know that this issues isn't related with issue I created but I have a question if I'm providing some bad arguments or not?
Because you replied me that i shouldn't provide anything in --contentType argument.
Can you please help me with this issue?

from cats.

Hi @Mato816. The way you run CATS restricts it only to POST (you provide --httpMethods=POST) which means that CATS won't run for DELETE. If you want to have CATS running for all http methods, you just need to remove the last bit:
java -jar cats.jar --contract=petstoreTest.yaml --server=https://petstore.swagger.io --paths=/pet/{petId} --urlParams=petId:PET-123.

Looking at the sample contract it seems that the POST method does not have a declared body. This means that CATS cannot do any fuzzing, so there won't be any fuzzer running for POST. But you you run the above command you'll see that it runs for DELETE as it has path params.

from cats.

Hi @en-milie,

thank you for your explanation. I'm closing this issue now.

from cats.