apihunter 0.1.2

Async API security scanner with passive and active checks for CORS, CSP, GraphQL, JWT, OpenAPI, and API posture.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53

use std::collections::HashMap;

use serde_json::Value;

use crate::http_client::HttpResponse;

pub fn get_content_type(headers: &HashMap<String, String>) -> String {
    headers
        .get("content-type")
        .map(|s| s.to_ascii_lowercase())
        .unwrap_or_default()
}

pub fn is_json_content_type(content_type: &str) -> bool {
    let media_type = content_type
        .split(';')
        .next()
        .unwrap_or(content_type)
        .trim();

    media_type
        .as_bytes()
        .windows(4)
        .any(|window| window.eq_ignore_ascii_case(b"json"))
}

pub fn is_html_content_type(content_type: &str) -> bool {
    let lower = content_type.to_ascii_lowercase();
    lower.contains("text/html") || lower.contains("application/xhtml")
}

pub fn is_json_response(headers: &HashMap<String, String>, body: &str) -> bool {
    let ct = get_content_type(headers);
    is_json_content_type(&ct) || serde_json::from_str::<Value>(body).is_ok()
}

pub fn parse_json_body(body: &str, content_type: Option<&str>) -> Option<Value> {
    let parsed = serde_json::from_str::<Value>(body).ok();
    let is_json = content_type.map(is_json_content_type).unwrap_or(false);

    if is_json || parsed.is_some() {
        parsed
    } else {
        None
    }
}

pub fn parse_json_response(resp: &HttpResponse) -> Option<Value> {
    parse_json_body(
        &resp.body,
        resp.headers.get("content-type").map(|s| s.as_str()),
    )
}