KissPeter / APIFuzzer

Fuzz test your application using your OpenAPI or Swagger API definition without coding
GNU General Public License v3.0
416 stars 65 forks source link

Strategy to send all params in one request #32

Closed rmaskell closed 4 years ago

rmaskell commented 4 years ago

Right now each param was being sent individually per request, we have some urls where this will always cause a 400 because some params are missing and deeper api logic is not being tested. So i added --strategy all_params_at_once to send all of the params from the swagger in one request instead.

Also added a log to show the request body which i found useful.

KissPeter commented 4 years ago

Hi, Thanks for the PR It is the next step indeed. Let me understand your code before merging... Péter

KissPeter commented 4 years ago

Hi Richard,

It seems some alignment is necessary. I've made a test with this input: _"paths": { "/multiple_pathparam/{param1}/{param2}": { "get": { "parameters": [ { "name": "param1", "in": "path", "required": true, "type": "number", "format": "double" }, { "name": "param2", "in": "path", "required": true, "type": "number", "format": "double" } ] } } }

and got queries like this: 127.0.0.1 - - [08/Feb/2020 21:26:39] "GET /multiple_path_param/667.5/param2_http://127.0.0.1:5000/multiple_path_param/_param1/ HTTP/1.1" 404 - I assume the expand_path_variables function should be reviewed

Without your modification only one parameter is used: 127.0.0.1 - - [08/Feb/2020 21:29:07] "GET /multiple_path_param/param1/5!]2yNone HTTP/1.1" 404 -

For multiple query string parameters your extension works great: 127.0.0.1 - - [08/Feb/2020 21:29:57] "GET /multiple_query_paramts?queryparam0=asd&queryparam1=Dr% HTTP/1.1" 404 -

Would you fix it or shall I do it?

Thanks

rmaskell commented 4 years ago

Hi Richard,

It seems some alignment is necessary. I've made a test with this input: _"paths": { "/multiple_pathparam/{param1}/{param2}": { "get": { "parameters": [ { "name": "param1", "in": "path", "required": true, "type": "number", "format": "double" }, { "name": "param2", "in": "path", "required": true, "type": "number", "format": "double" } ] } } }

and got queries like this: 127.0.0.1 - - [08/Feb/2020 21:26:39] "GET /multiple_pathparam/667.5/param2http://127.0.0.1:5000/multiple_path_param/_param1/� HTTP/1.1" 404 - I assume the expand_path_variables function should be reviewed

Without your modification only one parameter is used: 127.0.0.1 - - [08/Feb/2020 21:29:07] "GET /multiple_path_param/param1/5!]2yNone HTTP/1.1" 404 -

For multiple query string parameters your extension works great: 127.0.0.1 - - [08/Feb/2020 21:29:57] "GET /multiple_query_paramts?queryparam0=asd&queryparam1=�Dr% HTTP/1.1" 404 -

Would you fix it or shall I do it?

Thanks

Hi Peter,

thank you for catching this, i'll take a look now.

rmaskell commented 4 years ago

Hi Richard,

It seems some alignment is necessary. I've made a test with this input: _"paths": { "/multiple_pathparam/{param1}/{param2}": { "get": { "parameters": [ { "name": "param1", "in": "path", "required": true, "type": "number", "format": "double" }, { "name": "param2", "in": "path", "required": true, "type": "number", "format": "double" } ] } } }

and got queries like this: 127.0.0.1 - - [08/Feb/2020 21:26:39] "GET /multiple_pathparam/667.5/param2http://127.0.0.1:5000/multiple_path_param/_param1/� HTTP/1.1" 404 - I assume the expand_path_variables function should be reviewed

Without your modification only one parameter is used: 127.0.0.1 - - [08/Feb/2020 21:29:07] "GET /multiple_path_param/param1/5!]2yNone HTTP/1.1" 404 -

For multiple query string parameters your extension works great: 127.0.0.1 - - [08/Feb/2020 21:29:57] "GET /multiple_query_paramts?queryparam0=asd&queryparam1=�Dr% HTTP/1.1" 404 -

Would you fix it or shall I do it?

Thanks

image

image

should be fixed now :) @KissPeter

KissPeter commented 4 years ago

looks great thank you for fixing it