sqlmapproject/sqlmap · error · ValueError

no valid 'paths' object found in the provided OpenAPI/Swagge

Error message

no valid 'paths' object found in the provided OpenAPI/Swagger specification

What it means

Error "no valid 'paths' object found in the provided OpenAPI/Swagger specification" thrown in sqlmapproject/sqlmap.

Source

Thrown at lib/parse/openapi.py:228

_METHODS = ("get", "post", "put", "delete", "patch", "options", "head")

def openApiTargets(content, origin=None, tags=None):
    """
    Returns a list of (url, method, data, headers) request tuples derived from an OpenAPI/Swagger
    specification. 'headers' is a list of (name, value) tuples (matching conf.httpHeaders). 'origin'
    (scheme://host[:port] of the specification's own location) is used only to resolve RELATIVE 'servers'
    entries - absolute server URLs are used as declared. Path parameters and header/cookie values carry
    the custom injection mark so they become testable injection points. 'tags' (list) restricts extraction
    to operations declaring at least one of those OpenAPI tags (to scope a scan of a large API).
    """

    tagSet = set(tags) if tags else None

    spec = _loadSpec(content)
    if not isinstance(spec, dict) or not isinstance(spec.get("paths"), dict) or not spec.get("paths"):
        errMsg = "no valid 'paths' object found in the provided OpenAPI/Swagger specification"
        raise ValueError(errMsg)

    try:
        rootBase = _baseUrl(spec, origin)
    except Exception:                                     # never let base-URL synthesis abort the whole run
        rootBase = origin.rstrip('/') if isinstance(origin, six.string_types) else ""
    isV2 = "swagger" in spec and "openapi" not in spec
    retVal = []
    cache = {}   # $ref -> synthesized example, shared across all operations (large specs reuse schemas)

    for path, item in (spec.get("paths") or {}).items():
        item = _resolve(spec, item)                       # a Path Item object may itself be a $ref
        if not isinstance(item, dict):
            continue
        shared = item.get("parameters") or []            # 'or []': a present-but-null 'parameters' must not break concatenation
        for method, operation in item.items():
            if str(method).lower() not in _METHODS or not isinstance(operation, dict):   # str(): YAML keys can be non-string (e.g. 404, 'on'->bool)
                continue
            if tagSet is not None and not (tagSet & set(_ for _ in (operation.get("tags") or []) if isinstance(_, six.string_types))):

View on GitHub (pinned to 0a35b20e39)

When it happens

Trigger: Thrown at lib/parse/openapi.py:228 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of sqlmapproject/sqlmap@0a35b20e39 (2026-08-26). Data as JSON: /api/errors/dc13f349d011a62f. Report an issue: GitHub.