search

SeUniVr / RestTestGen

A framework for automated black-box testing of RESTful APIs.
Apache License 2.0
36 stars 9 forks source link

MassAssignmentSecurityTestingStrategy not loading #17

Closed lr101 closed 3 months ago

lr101 commented 10 months ago

When running RestTestGen with the MassAssignmentSecurityTestingStrategy I get the following message. I have the rule_extractor service running on localhost:4000 as instructes. How should I proceed to debug this?

Starting a Gradle Daemon (subsequent builds will be faster)
> Task :compileJava UP-TO-DATE
> Task :processResources UP-TO-DATE
> Task :classes UP-TO-DATE

> Task :run
07:45:04.726 [main] INFO  io.resttestgen.boot.cli.App - RestTestGen CLI 23.09 started.
07:45:05.553 [main] INFO  io.resttestgen.boot.Starter - API under test: Pet Store [petstore]
07:45:05.894 [main] INFO  io.resttestgen.core.openapi.OpenApiParser - OpenAPI specification correctly parsed.
07:45:06.114 [main] INFO  io.resttestgen.boot.Starter - Launching strategy with class name 'MassAssignmentSecurityTestingStrategy'
Oct 24, 2023 7:45:06 AM com.github.fommil.netlib.ARPACK <clinit>
WARNING: Failed to load implementation from: com.github.fommil.netlib.NativeSystemARPACK
Oct 24, 2023 7:45:06 AM com.github.fommil.netlib.ARPACK <clinit>
WARNING: Failed to load implementation from: com.github.fommil.netlib.NativeRefARPACK
operation,realCrudSemantics,inferredCrudSemantics,realResourceType,inferredResourceType,realInputResourceIdentifier,inferredInputResourceIdentifier,realOutputResourceIdentifier,inferredOutputResourceIdentifier
PUT /pet,UNKNOWN,UPDATE,,Cluster0,,PetId,,PetId
POST /pet,UNKNOWN,CREATE,,Cluster0,,PetId,,PetId
GET /pet/findByTags,UNKNOWN,READ_MULTI,,Cluster0,,,,PetId
DELETE /pet/{petId},UNKNOWN,DELETE,,Cluster0,,PetId,,
GET /pet/findByStatus,UNKNOWN,READ_MULTI,,Cluster0,,,,PetId
GET /pet,UNKNOWN,READ_MULTI,,Cluster0,,,,PetId
GET /pet/{petId},UNKNOWN,READ,,Cluster0,,PetId,,PetId

BUILD SUCCESSFUL in 35s
3 actionable tasks: 1 executed, 2 up-to-date

Config file:

apiUnderTest: petstore
strategyClassName: MassAssignmentSecurityTestingStrategy
davidecorradini commented 10 months ago

Hello, this seems to be a "successful" run, in the sense that no errors have raised during the execution. Probably RestTestGen is not sending HTTP requests because it has not identified potential vulnerable (read-only) parameters in the API. Could you please let me know if you are aware of the presence of read-only parameters in the API? Thanks! Best, Davide