Repository: projectdiscovery/nuclei (Go)

Issue:
Wrong URL on the HTTP Request when parsing OpenAPI file
<!-- 
1. Please search to see if an issue already exists for the bug you encountered.
2. For support requests, FAQs or "How to" questions, please use the GitHub Discussions section instead - https://github.com/projectdiscovery/nuclei/discussions or
3. Join our discord server at https://discord.gg/projectdiscovery and post the question on the #nuclei channel.
-->

<!-- ISSUES MISSING IMPORTANT INFORMATION MAY BE CLOSED WITHOUT INVESTIGATION. -->

### Nuclei version:
3.3.0
## Nuclei command:
nuclei -l crapi-openapi-spec.json -im openapi -sfv -debug -sf secret.yaml

### Current Behavior:
As shown in the photos below, nuclei fail to include the Server URL path in the HTTP request, resulting in incorrect requests that are not initialized by the OpenAPI file. (Missing the /path/path from the request)

### Expected Behavior:
[cmdi-blind-oast-polyglot] Dumped HTTP request for http://127.0.0.1:8888/path/path/community/api/v2/community/posts/recent?limit=30&nslookup+cqqvkd38g5ka3ru4h8pgehtbdj99fi363.oast.fun&'\"`0&'\"`0&nslookup+cqqvkd38g5ka3ru4h8pgkdzrwqr9gi135.oast.fun&`'&`'&offset=0&nslookup+cqqvkd38g5ka3ru4h8pgezufx6a93nnat.oast.fun&nslookup+cqqvkd38g5ka3ru4h8pg43gbikh71ayry.oast.fun

### Steps To Reproduce:

1. Run the above nuclei command with an OpenAPI file that would have a /path inside the Server URL
2. See this error in the Debug output on cmd.



### Anything else:
<!-- Links? References? Screenshots? Anything that will give us more context about the issue that you are encountering! -->
![image](https://github.com/user-attachments/assets/1f5e6f97-33e4-4905-84a0-dbf33e7fb44d)

![image](https://github.com/user-attachments/assets/33bca60e-7a5a-43d9-9861-63f993346b1b)


Discussion:

Patch:
diff --git a/pkg/input/formats/openapi/generator.go b/pkg/input/formats/openapi/generator.go
index 6f10c56d09..adcb26b2fa 100644
--- a/pkg/input/formats/openapi/generator.go
+++ b/pkg/input/formats/openapi/generator.go
@@ -72,19 +72,29 @@ func GenerateRequestsFromSchema(schema *openapi3.T, opts formats.InputFormatOpti
 		}
 		missingVarMap[param.Name] = struct{}{}
 	}
-
+	
 	for _, serverURL := range schema.Servers {
 		pathURL := serverURL.URL
+		// Split the server URL into baseURL and serverPath
+		u, err := url.Parse(pathURL)
+		if err != nil {
+			return errors.Wrap(err, "could not parse server url")
+		}
+		baseURL := fmt.Sprintf("%s://%s", u.Scheme, u.Host)
+		serverPath := u.Path
 
 		for path, v := range schema.Paths.Map() {
 			// a path item can have parameters
 			ops := v.Operations()
 			requestPath := path
+			if serverPath != "" {
+				requestPath = serverPath + path
+			}
 			for method, ov := range ops {
 				if err := generateRequestsFromOp(&generateReqOptions{
 					requiredOnly:              opts.RequiredOnly,
 					method:                    method,
-					pathURL:                   pathURL,
+					pathURL:                   baseURL,
 					requestPath:               requestPath,
 					op:                        ov,
 					schema:                    schema,


Test patch:
diff --git a/pkg/input/formats/swagger/swagger_test.go b/pkg/input/formats/swagger/swagger_test.go
index 601c20d94b..065ae78f63 100644
--- a/pkg/input/formats/swagger/swagger_test.go
+++ b/pkg/input/formats/swagger/swagger_test.go
@@ -27,8 +27,8 @@ func TestSwaggerAPIParser(t *testing.T) {
 	}
 
 	expectedURLs := []string{
-		"https://localhost/users",
-		"https://localhost/users/1?test=asc",
+		"https://localhost/v1/users",
+		"https://localhost/v1/users/1?test=asc",
 	}
 	require.ElementsMatch(t, gotMethodsToURLs, expectedURLs, "could not get swagger urls")
 }