Yelp / fuzz-lightyear

A pytest-inspired, DAST framework, capable of identifying vulnerabilities in a distributed, micro-service ecosystem through chaos engineering testing and stateful, Swagger fuzzing.
Other
205 stars 25 forks source link

No support of API tokens in Authentication Fixture #50

Closed medmf22 closed 4 years ago

medmf22 commented 4 years ago

No support of API tokens headers. When i use authentication fixture :

 @fuzz_lightyear.victim_account
def victim_factory():
        return {
                'headers': {
                        'x-access-token': 'jwt_token',
                        },
                }

@fuzz_lightyear.attacker_account
def attacker_factory():
    return {
        'headers': {
            'x-access-token': 'jwt_token',
        }
    }

I got this issue (i have last version of bravado) :


                                 [SwaggerMappingError]

Traceback (most recent call last):
  File "/usr/local/lib/python3.7/dist-packages/fuzz_lightyear-0.0.7-py3.7.egg/fuzz_lightyear/main.py", line 122, in run_tests
    run_sequence(result.requests, result.responses)
  File "/usr/local/lib/python3.7/dist-packages/fuzz_lightyear-0.0.7-py3.7.egg/fuzz_lightyear/runner.py", line 16, in run_sequence
    data=responses.data,
  File "/usr/local/lib/python3.7/dist-packages/fuzz_lightyear-0.0.7-py3.7.egg/fuzz_lightyear/request.py", line 168, in send
    **kwargs,
  File "/usr/local/lib/python3.7/dist-packages/fuzz_lightyear-0.0.7-py3.7.egg/fuzz_lightyear/supplements/abstraction.py", line 59, in default_request_method
    )(*args, **kwargs)
  File "/usr/local/lib/python3.7/dist-packages/bravado/client.py", line 247, in __call__
    self.operation, request_options, **op_kwargs)
  File "/usr/local/lib/python3.7/dist-packages/bravado/client.py", line 285, in construct_request
    construct_params(operation, request, op_kwargs)
  File "/usr/local/lib/python3.7/dist-packages/bravado/client.py", line 307, in construct_params
    .format(operation.operation_id, param_name))
bravado_core.exception.SwaggerMappingError: addOffer does not have parameter headers
domanchi commented 4 years ago

Hi @medmf22,

Thanks for calling this out. Try using:

@fuzz_lightyear.attacker_account
def attacker_factory():
    return {
        '_request_options': {
            'headers': {
                'x-access-token': 'jwt_token',
            }
        }
    }

I'll be sure to update the README to reflect this.