leondz / garak

the LLM vulnerability scanner
https://discord.gg/uVch4puUCs
Apache License 2.0
1.39k stars 165 forks source link

REST Generator and response code 4xx #320

Open Eric-Hacker opened 11 months ago

Eric-Hacker commented 11 months ago

This may be an odd ball issue and I may try tackling it my self, but I wanted to put it out there in case anyone had thoughts.

I'm testing against a REST API developed in house for answering queries against internal databases. The front end web presentation is being developed by another part of the company and there are no plans to offer this API access to the public. The development team is using a 400 Bad Request response for client errors such as the request is too long or empty. That means there are many tests that fail.

  1. Need to have the Rest generator accept at least some 4xx codes and continue.
  2. Need to pass the result in a way that can be processed by a detector.
  3. Maybe add more verbose error messages when -verbose and receiving http error responses.

The good news is that I got the Rest generator working. It took me a bit to figure out the the 400s weren't a configuration issue, but rather the tests were too long, but I got through it eventually after adding HEADERS {resp.request.headers} METHOD {resp.request.method} BODY {resp.request.body} to the error message and realizing the request was actually good.

leondz commented 11 months ago

Thanks.

Currently the REST generator does backoff by default only for HTTP 429, but the idea is that the list of codes that lead to backoff could be expanded.

Empty & overlong request handling could be dealt with in the generator. Are there any other general cases like this that could be worth coding for?

But the idea of a set of "continue" HTTP codes - where no result is generated internally, and the probe moves on - could be easy enough to implement.

Appreciate the debug info suggestion, will probably implement that, thank you. There's also a test REST client that didn't make it into 0.9.0.8 but is on a branch - expect this to move into resources. REST debuggers need all the help they can get :)

leondz commented 11 months ago

current considerations for additional rest generator params: