RESTler is the first stateful REST API fuzzing tool for automatically testing cloud services through their REST APIs and finding security and reliability bugs in these services.
MIT License
2.52k
stars
283
forks
source link
Dynamic object encoding is adding extra double quotes when consuming value from other call #882
Added annotations so that a value from header from a previous API call is consumed in the subsequent call as parameter. The value when getting consumed is adding extra double quotes.
Steps to reproduce
Sample annotations:
{ "x-restler-global-annotations": [ { "producer_endpoint": "/tenants/{cloud}:{namespaceId}:{clientId}", "producer_method": "PUT", "producer_resource_name": "ETag", "consumer_param": "If-Match", "description": "ETag produced by the PUT API can be used for matching in DELETE or GET APIs" } ] }
Description
Added annotations so that a value from header from a previous API call is consumed in the subsequent call as parameter. The value when getting consumed is adding extra double quotes.
Steps to reproduce
Sample annotations:
{ "x-restler-global-annotations": [ { "producer_endpoint": "/tenants/{cloud}:{namespaceId}:{clientId}", "producer_method": "PUT", "producer_resource_name": "ETag", "consumer_param": "If-Match", "description": "ETag produced by the PUT API can be used for matching in DELETE or GET APIs" } ] }Actual request: `2024-03-22 16:47:13.349: Sending: 'DELETE /tenants/public:simself:f8ce4953-ce54-4eaa-b6de-144292939e90?api-version=2023-05-01 HTTP/1.1\r\nAccept: application/json\r\nHost: targets-capabilities.westus2.chaos-test.azure.com\r\nIf-Match: \"f203e6f1-0000-0800-0000-65fdb6110000\"\r\n_OMITTED_AUTHTOKEN\r\nContent-Length: 0\r\nUser-Agent: SimulatedSelfhost/809AF346-A76B-44EB-9773-EFF6F597FC25\r\nx-restler-sequence-id: 07206294-a495-4209-9084-3067b91755aa\r\n\r\n'
2024-03-22 16:47:13.412: Received: 'HTTP/1.1 412 Precondition Failed\r\nDate: Fri, 22 Mar 2024 16:47:13 GMT\r\nContent-Type: application/json; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nRequest-Context: appId=\r\nStrict-Transport-Security: max-age=15724800; includeSubDomains\r\n\r\na8\r\n{"status":"Failed","error":{"code":"PreconditionFailed","message":"The entity tag \'\\\"f203e6f1-0000-0800-0000-65fdb6110000\\\"\' does not match.","correlationId":null}}\r\n0\r\n\r\n'`
Expected results
No response
Actual results
No response
Environment details
No response