microsoft / restler-fuzzer

RESTler is the first stateful REST API fuzzing tool for automatically testing cloud services through their REST APIs and finding security and reliability bugs in these services.
MIT License
2.59k stars 297 forks source link

How to test creations-modifications using different values? #547

Open Vaevictish opened 2 years ago

Vaevictish commented 2 years ago

We have a set of endpoints like these:

image

The POST accepts 2 parameters, but only 1 is necessary. The whole creation process is fine, but when testing the whole set, restler tries to create a tag using the POST multiple times with the same values everytime (fuzzstring, fuzzstring in this case), so the API gives a 409 error code because that 1 parameter is unique, so it does not try the dependent endpoints (GET/PUT/DELETE) as it was unable to finish that first step properly.

When doing it removing the uniqueness for that parameter in our backend, restler tests all the endpoints fine.

How can we tell restler to try using different values in the Testing phase? As it looks like it is not necessary to use the "create once" option in this case

marina-p commented 2 years ago

Hello @Vaevictish,

Currently, specifying unique values may be done through one of two methods:

1) For unique string values, you can specify restler_custom_payload_uuid4_suffix in the dictionary. For example, if the unique parameter in the POST body is named tagName, you can specify the following in the dictionary (the slash means that this is a property of the top-level json object of the body):

  "restler_custom_payload_uuid4_suffix": {
    "/tagName": "tgn"
  }

You must then compile and reference the above dictionary from config.json. Then, when you test, a unique suffix will be added to the value you specified in the dictionary (tgn above).

2) If you have a more complex constraint or need a different type (e.g. integer), then you can use a custom value generator. This is described in SettingsFile.md (see custom_value_generators toward the end). For this option, you would specify a restler_custom_payload in the above dictionary instead, and a python function that will override the static custom payload value with dynamically generated values (further details are described in the documentation).

Please let me know if you have any additional questions on this.

Thanks,

Marina