RESTler is the first stateful REST API fuzzing tool for automatically testing cloud services through their REST APIs and finding security and reliability bugs in these services.
MIT License
2.59k
stars
296
forks
source link
Missing part of request path when using variable and colon #705
I tried to run request containing colon sign with variable just before it, but such configuration causes fuzzable string to be omitted together with the part after colon.
Example:
For request path:
/dummy/{FOO}/path/{BAR}:baz
RESTler in Test step generates following path:
/dummy/fuzzstring/path
Instead of:
/dummy/fuzzstring/path/fuzzstring:baz
I can get the whole path only when I don't use variable before colon:
/dummy/{FOO}/path/bar:baz
Then RESTler in Test step generates correct path:
/dummy/fuzzstring/path/bar:baz
Steps to reproduce
Prepare swagger spec with path that contains fuzzable string and a colon after it:
Description
I tried to run request containing colon sign with variable just before it, but such configuration causes fuzzable string to be omitted together with the part after colon.
Example: For request path:
/dummy/{FOO}/path/{BAR}:baz
RESTler in Test step generates following path:/dummy/fuzzstring/path
Instead of:/dummy/fuzzstring/path/fuzzstring:baz
I can get the whole path only when I don't use variable before colon:
/dummy/{FOO}/path/bar:baz
Then RESTler in Test step generates correct path:/dummy/fuzzstring/path/bar:baz
Steps to reproduce
Prepare swagger spec with path that contains fuzzable string and a colon after it:
Commands:
dotnet restler/Restler.dll compile --api_spec /mnt/dummy.yaml
dotnet restler/Restler.dll test --grammar_file Compile/grammar.py --dictionary_file Compile/dict.json --settings Compile/engine_settings.json
Expected results
Expecting restler_fuzzable_string:
'fuzzstring'
for{BAR}
and':baz'
in restler_static_string like:Actual results
/{BAR}:baz
part is ommited in request path:Environment details
• Used docker built from commit: 50944acf159c997f4bf7d12ef443d7a38950acc8 • Python 3.10.10 • RESTler version: 9.1.1