microsoft / restler-fuzzer

RESTler is the first stateful REST API fuzzing tool for automatically testing cloud services through their REST APIs and finding security and reliability bugs in these services.
MIT License
2.52k stars 283 forks source link

InvalidValueChecker - 505 HTTP Version Not Supported from Jetty #865

Open davide94it opened 4 months ago

davide94it commented 4 months ago

Description

Running the fuzz-lean I obtain an 505 error with unconsistent response from Jetty (HTTP/1.1 or HTTP/0.9 ?).

{
    "status_code": "505",
    "checker_name": "InvalidValueChecker",
    "reproducible": true,
    "verb": "GET",
    "endpoint": "/health-history",
    "status_text": "HTTP Version Not Supported",
    "request_sequence": [
        {
            "producer_timing_delay": 0,
            "max_async_wait_time": 20,
            "replay_request": "GET /health-history?page=1&size=1&sort=vu[MC\nr4Ci HTTP/1.1\r\nAccept: application/json\r\nHost: my-service\r\nRequestID: fdsfdsaer77909fds\r\nRequestDate: 2024-02-26T08:58Z\r\nUserID: USER100\r\nOriginalRequestDate: 2024-02-26T08:58Z\r\nImpersonatedUserID: OTHERUSER100\r\n\r\n",
            "response": "HTTP/1.1 505 HTTP Version Not Supported\r\nContent-Type: text/html;charset=iso-8859-1\r\nContent-Length: 65\r\nConnection: close\r\nServer: Jetty(11.0.18)\r\n\r\n<h1>Bad Message 505</h1><pre>reason: HTTP/0.9 not supported</pre>"
        }
    ]
}

Moreover, trying to replicate the request with curl I don't get that error from the server but rightly a 400 Bad Request.

curl --http1.1 --location --globoff 'http://localhost:8077/health-history?page=1&size=1&sort=vu[MC\nr4Ci' --header 'accept: application/json' --header 'RequestID: fdsfdsaer77909fds' --header 'RequestDate: 2024-02-26T08:58Z' --header 'UserID: USER100' --header 'OriginalRequestDate: 2024-02-26T08:58Z' --header 'ImpersonatedUserID: OTHERUSER100'

Steps to reproduce

I'm using a Docker container, here the steps that I perform:

  1. clone project
  2. build the Docker image from the root directory of the project docker build -t restler .
  3. run the container docker run --rm -it restler
  4. get the swagger.json from the server wget -O api-docs.json http://my-service:8077/v3/api-docs
  5. compile ./Restler compile --api_spec api-docs.json
  6. run fuzz-lean ./Restler test --grammar_file ./Compile/grammar.py --dictionary_file ./Compile/dict.json --settings /shared/config/user_settings.json --no_ssl

Expected results

No response

Actual results

HTTP/1.1 505 HTTP Version Not Supported\r\nContent-Type: text/html;charset=iso-8859-1\r\nContent-Length: 65\r\nConnection: close\r\nServer: Jetty(11.0.18)\r\n\r\n

Bad Message 505

reason: HTTP/0.9 not supported

Environment details

restler v9.2.3