search

microsoft / restler-fuzzer

RESTler is the first stateful REST API fuzzing tool for automatically testing cloud services through their REST APIs and finding security and reliability bugs in these services.
MIT License
2.59k stars 297 forks source link

Received responses in the network.testing #594

Open DeftaSebastian opened 2 years ago

DeftaSebastian commented 2 years ago

Description

I have noticed that Restler's "Received" responses tend to copy a specific part from the previous "Received" response which is placed at the front of the whole message, and this behaviour casuses Restler to think that it has found a bug and attempts to reproduce it.

Steps to reproduce

  1. Make compilation
  2. Make test
  3. Watch the network.testing inside Test\RestlerResults\experiment\logs

Expected results

A received message starting with "HTTP/1.1 400 "

Actual results

A received message starting with "116\r\n{"error": ... HTTP/1.1 400"

Environment details

Windows, Python 3.10.5, Dotnet 5.0.100

marina-p commented 2 years ago

Hello @DeftaSebastian,

Thank you for reporting this. For further investigation, would you be able to share the full network log leading up to this error (removing any of your service-specific information)?

Also, which version of RESTler are you using?

Thanks,

Marina

DeftaSebastian commented 2 years ago

I am currently using RESTler version: 8.5.0

This is what the first 3 requests look like in my network.testing file:


2022-08-03 10:37:13.611: Will refresh token: python3 C:\...
2022-08-03 10:37:14.503: New value: {u'app1': {}}
_OMITTED_AUTH_TOKEN_

Generation-1: Rendering Sequence-1

    Request: 1 (Remaining candidate combinations: 20)
    Request hash: 02c3e5c77e2426703d273bb5c354e83efc6db34b

        - restler_static_string: 'PATCH '
        - restler_static_string: ''
        - restler_static_string: '/'
        - restler_static_string: 'api'
        - restler_static_string: '/'
        - restler_static_string: 'path1'
        - restler_static_string: ' HTTP/1.1\r\n'
        - restler_static_string: 'Accept: application/json\r\n'
        - restler_static_string: 'Host: ...\r\n'
        - restler_static_string: 'Content-Type: '
        - restler_static_string: 'application/json'
        - restler_static_string: '\r\n'
        + restler_refreshable_authentication_token: [token_refresh_cmd, token_refresh_interval, ...]
        - restler_static_string: '\r\n'
        - restler_static_string: '{'
        - restler_static_string: '\n    "server1":'
        - restler_fuzzable_string: <function CandidateValuesPool.get_candidate_values.<locals>.get_custom_value_generator.<locals>.value_generator_wrapper at 0x0000025E6C105090>
        - restler_static_string: ',\n    "server2":'
        - restler_fuzzable_string: <function CandidateValuesPool.get_candidate_values.<locals>.get_custom_value_generator.<locals>.value_generator_wrapper at 0x0000025E6C104040>
        - restler_static_string: '}'
        - restler_static_string: '\r\n'

2022-08-03 10:37:14.744: Sending: 'PATCH /api/path1 HTTP/1.1\r\nAccept: application/json\r\nHost: ...\r\nContent-Type: application/json\r\n_OMITTED_AUTH_TOKEN_\r\nContent-Length: 49\r\nUser-Agent: restler/8.5.0\r\n\r\n{\n    "server1":"",\n    "server2":"1579484125"}\r\n'

2022-08-03 10:37:14.754: Received: "HTTP/1.1 400 Bad Request\r\nDate: Wed, 06 Jul 2022 07:43:39 GMT\r\nConnection: Keep-Alive\r\nAccess-Control-Allow-Origin: *\r\nX-Frame-Options: deny\r\nContent-Security-Policy: frame-ancestors 'none'\r\nCache-Control: no-cache, no-store, must-revalidate\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\nTransfer-Encoding: chunked\r\nContent-Type: application/json\r\n\r\n"

Generation-1: Rendering Sequence-1

    Request: 1 (Remaining candidate combinations: 19)
    Request hash: 02c3e5c77e2426703d273bb5c354e83efc6db34b

        - restler_static_string: 'PATCH '
        - restler_static_string: ''
        - restler_static_string: '/'
        - restler_static_string: 'api'
        - restler_static_string: '/'
        - restler_static_string: 'path1'
        - restler_static_string: ' HTTP/1.1\r\n'
        - restler_static_string: 'Accept: application/json\r\n'
        - restler_static_string: 'Host: ...\r\n'
        - restler_static_string: 'Content-Type: '
        - restler_static_string: 'application/json'
        - restler_static_string: '\r\n'
        + restler_refreshable_authentication_token: [token_refresh_cmd, token_refresh_interval, ...]
        - restler_static_string: '\r\n'
        - restler_static_string: '{'
        - restler_static_string: '\n    "server1":'
        - restler_fuzzable_string: <function CandidateValuesPool.get_candidate_values.<locals>.get_custom_value_generator.<locals>.value_generator_wrapper at 0x0000025E6C104F70>
        - restler_static_string: ',\n    "server2":'
        - restler_fuzzable_string: <function CandidateValuesPool.get_candidate_values.<locals>.get_custom_value_generator.<locals>.value_generator_wrapper at 0x0000025E6C1051B0>
        - restler_static_string: '}'
        - restler_static_string: '\r\n'

2022-08-03 10:37:14.771: Sending: 'PATCH /api/path1 HTTP/1.1\r\nAccept: application/json\r\nHost: ...\r\nContent-Type: application/json\r\n_OMITTED_AUTH_TOKEN_\r\nContent-Length: 1284\r\nUser-Agent: restler/8.5.0\r\n\r\n{\n    "server1":"+N|qU&}NGiy(qcWMhDtN56[XD=1\r\r+ha6\x0b`@Rw;q\x0c\'RTAf/j0>oozMfuXj/C[Xgm\t1r\'rBdTJ!j%4o|$<=<ZS\\3U,iOeWNip<cNkN$VQWce]h!s8v3WG9X_6FgHws{5n c-,Y7v-n"tloc_uDuhwRDe5+bqT_&#@utw3 kDA!n#3nil_:z2\'44CUMW&ThPw_Ram\'5:rTH/oiF,?Of\'%!B;\x0bNy([Dq1nLZ?[]VCW]#2/32o\x0b+g_0_SJ5!wO}-NY{Jvy(a?EQ\tN<%?MC|VC19?>}L&ZxAjr/ZebZNxLpQ"~T(2[!U+~OQ0!EH&mbj $\x0cv}W#"6s;$&XWJ;h)P5_[S0qlqx.Z}_avu]@%|$J?z` (|j]i=Hhf?Ll/Z}\x0cY_*p%)>J$K!SjQF{xz[k""\t1R\x0bfl4]#>a!rc8MsZ9v8x"VYPap+-2"[&K.19NTt]3@\t=:FJ4+e8\ty4A\rw%x\\k|=nWV;\r1ZM}Pw\x0cbb\\k>5R@~xon#sI\x0b+Xn)e&dz(+ob?PgF,T_n\'\'#P%+b]Ds_.g8fF5"@yP&r~_.jh>&}F[rBkm]gt0xl|#x6"Y;$C\x0bdMEd8J]toS]50HtCl-B^@9\\o,U7\x0c\r"*A+Iu\x0cSqy\'?YPUyf]58J3zv7c>}\tu92fv@QxmbbDe\x0c!M*a5\x0b?MQhr!f|=b5<UFOR,:X>u]H9x9Fv#LBSxUns60",w"{<\tG!7 d7!$o\\*j+/Ix:xSep3NY+`}7wCb`g `>"TYxn:k&9=)S^1R\'X;b+]T``E{Jh0LS\x0c9-?\tTDz\t]<@l`/j!\'TKtM-})xChatpRFy6{9\\H:0X~\tcA_vuz\x0b[PZ0=$<jF9KM?m4G_$|APA"s\t,\x0ccL`0?\'#\x0cL*\\MmZtlV\x0bfTO.$"j&?\r0EV;*^rqQPEX`UGq.T /6"=WjDCQHHSSCpao?\x0csAj@<QX=?%\x0bk6H91tSRJ"g|EX`zr72i)vUh\x0cEIG~Z8S6MyZnqU.GS{r3$$Po2omI",\n    "server2":"#?^2%>1k8$21NqjfN\t^bxy3J*53nUB[Ru8vT3fsYpD}@wsF1^ROsoB)I#76M&B\\%)D{J\x0c\ryc"rsI(MU+?Q|-+<J#"cHPMe8Jo$8FXb]KuXgeD$6N!GgfOK[ ci-m3M3#@">\'[\x0bZ\x0c*/+3$I5mo;lte:~/]iA\'gDBO0t\x0b+geo^Jj]sbvM*4,rvdr#M-%[$/R^O]%^C;FaR\x0bZ^\\e{u$>WG~Ng\x0c@UXWT\'B yf1~S2"2Xt@T:l+;k\t{\t`OY\x0bTf\th[abXmR<Io\t<?^#IbBHm|L wfTrD$PvH"}\r\n'

2022-08-03 10:37:29.796: Received: '48\r\n{"error":{"code":"bad_request","message":" - not a valid IPv4 address"}}\r\n0\r\n\r\nHTTP/1.1 400 Bad Request\r\nDate: Wed, 06 Jul 2022 07:43:39 GMT\r\nConnection: Keep-Alive\r\nAccess-Control-Allow-Origin: *\r\nX-Frame-Options: deny\r\nContent-Security-Policy: frame-ancestors \'none\'\r\nCache-Control: no-cache, no-store, must-revalidate\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\nTransfer-Encoding: chunked\r\nContent-Type: application/json\r\n\r\n116\r\n{"error":{"code":"bad_request","message":"[json.exception.parse_error.101] parse error at line 2, column 43: syntax error while parsing value - invalid string: control character U+000D (CR) must be escaped to \\\\u000D or \\\\r; last read: \'\\"+N|qU&}NGiy(qcWMhDtN56[XD=1<U+000D>\'"}}\r\n0\r\n\r\n'

2022-08-03 10:37:29.809: Attempting to reproduce bug...
2022-08-03 10:37:30.065: Sending: 'PATCH /api/path1 HTTP/1.1\r\nAccept: application/json\r\nHost: ...\r\nContent-Type: application/json\r\n_OMITTED_AUTH_TOKEN_\r\nContent-Length: 1284\r\nUser-Agent: restler/8.5.0\r\n\r\n{\n    "server1":"+N|qU&}NGiy(qcWMhDtN56[XD=1\r\r+ha6\x0b`@Rw;q\x0c\'RTAf/j0>oozMfuXj/C[Xgm\t1r\'rBdTJ!j%4o|$<=<ZS\\3U,iOeWNip<cNkN$VQWce]h!s8v3WG9X_6FgHws{5n c-,Y7v-n"tloc_uDuhwRDe5+bqT_&#@utw3 kDA!n#3nil_:z2\'44CUMW&ThPw_Ram\'5:rTH/oiF,?Of\'%!B;\x0bNy([Dq1nLZ?[]VCW]#2/32o\x0b+g_0_SJ5!wO}-NY{Jvy(a?EQ\tN<%?MC|VC19?>}L&ZxAjr/ZebZNxLpQ"~T(2[!U+~OQ0!EH&mbj $\x0cv}W#"6s;$&XWJ;h)P5_[S0qlqx.Z}_avu]@%|$J?z` (|j]i=Hhf?Ll/Z}\x0cY_*p%)>J$K!SjQF{xz[k""\t1R\x0bfl4]#>a!rc8MsZ9v8x"VYPap+-2"[&K.19NTt]3@\t=:FJ4+e8\ty4A\rw%x\\k|=nWV;\r1ZM}Pw\x0cbb\\k>5R@~xon#sI\x0b+Xn)e&dz(+ob?PgF,T_n\'\'#P%+b]Ds_.g8fF5"@yP&r~_.jh>&}F[rBkm]gt0xl|#x6"Y;$C\x0bdMEd8J]toS]50HtCl-B^@9\\o,U7\x0c\r"*A+Iu\x0cSqy\'?YPUyf]58J3zv7c>}\tu92fv@QxmbbDe\x0c!M*a5\x0b?MQhr!f|=b5<UFOR,:X>u]H9x9Fv#LBSxUns60",w"{<\tG!7 d7!$o\\*j+/Ix:xSep3NY+`}7wCb`g `>"TYxn:k&9=)S^1R\'X;b+]T``E{Jh0LS\x0c9-?\tTDz\t]<@l`/j!\'TKtM-})xChatpRFy6{9\\H:0X~\tcA_vuz\x0b[PZ0=$<jF9KM?m4G_$|APA"s\t,\x0ccL`0?\'#\x0cL*\\MmZtlV\x0bfTO.$"j&?\r0EV;*^rqQPEX`UGq.T /6"=WjDCQHHSSCpao?\x0csAj@<QX=?%\x0bk6H91tSRJ"g|EX`zr72i)vUh\x0cEIG~Z8S6MyZnqU.GS{r3$$Po2omI",\n    "server2":"#?^2%>1k8$21NqjfN\t^bxy3J*53nUB[Ru8vT3fsYpD}@wsF1^ROsoB)I#76M&B\\%)D{J\x0c\ryc"rsI(MU+?Q|-+<J#"cHPMe8Jo$8FXb]KuXgeD$6N!GgfOK[ ci-m3M3#@">\'[\x0bZ\x0c*/+3$I5mo;lte:~/]iA\'gDBO0t\x0b+geo^Jj]sbvM*4,rvdr#M-%[$/R^O]%^C;FaR\x0bZ^\\e{u$>WG~Ng\x0c@UXWT\'B yf1~S2"2Xt@T:l+;k\t{\t`OY\x0bTf\th[abXmR<Io\t<?^#IbBHm|L wfTrD$PvH"}\r\n'

2022-08-03 10:37:30.082: Received: "HTTP/1.1 400 Bad Request\r\nDate: Wed, 06 Jul 2022 07:43:55 GMT\r\nConnection: Keep-Alive\r\nAccess-Control-Allow-Origin: *\r\nX-Frame-Options: deny\r\nContent-Security-Policy: frame-ancestors 'none'\r\nCache-Control: no-cache, no-store, must-revalidate\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\nTransfer-Encoding: chunked\r\nContent-Type: application/json\r\n\r\n"

2022-08-03 10:37:30.082: Done replaying sequence.

Generation-1: Rendering Sequence-1

    Request: 1 (Remaining candidate combinations: 18)
    Request hash: 02c3e5c77e2426703d273bb5c354e83efc6db34b

        - restler_static_string: 'PATCH '
        - restler_static_string: ''
        - restler_static_string: '/'
        - restler_static_string: 'api'
        - restler_static_string: '/'
        - restler_static_string: 'path1'
        - restler_static_string: ' HTTP/1.1\r\n'
        - restler_static_string: 'Accept: application/json\r\n'
        - restler_static_string: 'Host: ...\r\n'
        - restler_static_string: 'Content-Type: '
        - restler_static_string: 'application/json'
        - restler_static_string: '\r\n'
        + restler_refreshable_authentication_token: [token_refresh_cmd, token_refresh_interval, ...]
        - restler_static_string: '\r\n'
        - restler_static_string: '{'
        - restler_static_string: '\n    "server1":'
        - restler_fuzzable_string: <function CandidateValuesPool.get_candidate_values.<locals>.get_custom_value_generator.<locals>.value_generator_wrapper at 0x0000025E6C104F70>
        - restler_static_string: ',\n    "server2":'
        - restler_fuzzable_string: <function CandidateValuesPool.get_candidate_values.<locals>.get_custom_value_generator.<locals>.value_generator_wrapper at 0x0000025E6C104160>
        - restler_static_string: '}'
        - restler_static_string: '\r\n'

2022-08-03 10:37:30.113: Sending: 'PATCH /api/path1 HTTP/1.1\r\nAccept: application/json\r\nHost: ...\r\nContent-Type: application/json\r\n_OMITTED_AUTH_TOKEN_\r\nContent-Length: 48\r\nUser-Agent: restler/8.5.0\r\n\r\n{\n    "server1":"",\n    "server2":"264248081"}\r\n'

2022-08-03 10:37:45.145: Received: '116\r\n{"error":{"code":"bad_request","message":"[json.exception.parse_error.101] parse error at line 2, column 43: syntax error while parsing value - invalid string: control character U+000D (CR) must be escaped to \\\\u000D or \\\\r; last read: \'\\"+N|qU&}NGiy(qcWMhDtN56[XD=1<U+000D>\'"}}\r\n0\r\n\r\nHTTP/1.1 400 Bad Request\r\nDate: Wed, 06 Jul 2022 07:43:55 GMT\r\nConnection: Keep-Alive\r\nAccess-Control-Allow-Origin: *\r\nX-Frame-Options: deny\r\nContent-Security-Policy: frame-ancestors \'none\'\r\nCache-Control: no-cache, no-store, must-revalidate\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\nTransfer-Encoding: chunked\r\nContent-Type: application/json\r\n\r\n48\r\n{"error":{"code":"bad_request","message":" - not a valid IPv4 address"}}\r\n0\r\n\r\n'

2022-08-03 10:37:45.160: Attempting to reproduce bug...
2022-08-03 10:37:45.380: Sending: 'PATCH /api/path1 HTTP/1.1\r\nAccept: application/json\r\nHost: ...\r\nContent-Type: application/json\r\n_OMITTED_AUTH_TOKEN_\r\nContent-Length: 48\r\nUser-Agent: restler/8.5.0\r\n\r\n{\n    "server1":"",\n    "server2":"264248081"}\r\n'

2022-08-03 10:37:45.392: Received: "HTTP/1.1 400 Bad Request\r\nDate: Wed, 06 Jul 2022 07:44:10 GMT\r\nConnection: Keep-Alive\r\nAccess-Control-Allow-Origin: *\r\nX-Frame-Options: deny\r\nContent-Security-Policy: frame-ancestors 'none'\r\nCache-Control: no-cache, no-store, must-revalidate\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\nTransfer-Encoding: chunked\r\nContent-Type: application/json\r\n\r\n"

2022-08-03 10:37:45.403: Done replaying sequence.```