{"record":{"id":"dc13f349d011a62f","repo":"sqlmapproject/sqlmap","slug":"no-valid-paths-object-found-in-the-provided-open","errorCode":null,"errorMessage":"no valid 'paths' object found in the provided OpenAPI/Swagger specification","messagePattern":"no valid 'paths' object found in the provided OpenAPI/Swagger specification","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"lib/parse/openapi.py","lineNumber":228,"sourceCode":"\n_METHODS = (\"get\", \"post\", \"put\", \"delete\", \"patch\", \"options\", \"head\")\n\ndef openApiTargets(content, origin=None, tags=None):\n    \"\"\"\n    Returns a list of (url, method, data, headers) request tuples derived from an OpenAPI/Swagger\n    specification. 'headers' is a list of (name, value) tuples (matching conf.httpHeaders). 'origin'\n    (scheme://host[:port] of the specification's own location) is used only to resolve RELATIVE 'servers'\n    entries - absolute server URLs are used as declared. Path parameters and header/cookie values carry\n    the custom injection mark so they become testable injection points. 'tags' (list) restricts extraction\n    to operations declaring at least one of those OpenAPI tags (to scope a scan of a large API).\n    \"\"\"\n\n    tagSet = set(tags) if tags else None\n\n    spec = _loadSpec(content)\n    if not isinstance(spec, dict) or not isinstance(spec.get(\"paths\"), dict) or not spec.get(\"paths\"):\n        errMsg = \"no valid 'paths' object found in the provided OpenAPI/Swagger specification\"\n        raise ValueError(errMsg)\n\n    try:\n        rootBase = _baseUrl(spec, origin)\n    except Exception:                                     # never let base-URL synthesis abort the whole run\n        rootBase = origin.rstrip('/') if isinstance(origin, six.string_types) else \"\"\n    isV2 = \"swagger\" in spec and \"openapi\" not in spec\n    retVal = []\n    cache = {}   # $ref -> synthesized example, shared across all operations (large specs reuse schemas)\n\n    for path, item in (spec.get(\"paths\") or {}).items():\n        item = _resolve(spec, item)                       # a Path Item object may itself be a $ref\n        if not isinstance(item, dict):\n            continue\n        shared = item.get(\"parameters\") or []            # 'or []': a present-but-null 'parameters' must not break concatenation\n        for method, operation in item.items():\n            if str(method).lower() not in _METHODS or not isinstance(operation, dict):   # str(): YAML keys can be non-string (e.g. 404, 'on'->bool)\n                continue\n            if tagSet is not None and not (tagSet & set(_ for _ in (operation.get(\"tags\") or []) if isinstance(_, six.string_types))):","sourceCodeStart":210,"sourceCodeEnd":246,"githubUrl":"https://github.com/sqlmapproject/sqlmap/blob/0a35b20e3953d341be6c7ac75ccb0b3362540c8d/lib/parse/openapi.py#L210-L246","documentation":"Error \"no valid 'paths' object found in the provided OpenAPI/Swagger specification\" thrown in sqlmapproject/sqlmap.","triggerScenarios":"Thrown at lib/parse/openapi.py:228 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0a35b20e3953d341be6c7ac75ccb0b3362540c8d","analyzedAt":"2026-08-26T23:02:52.002Z","schemaVersion":2},"datasetVersion":"2026-08-27T03:17:27.898Z"}