microsoft / restler-fuzzer

RESTler is the first stateful REST API fuzzing tool for automatically testing cloud services through their REST APIs and finding security and reliability bugs in these services.
MIT License
2.62k stars 303 forks source link

Specific route path parameter for a specific route is not being used #906

Open tandrew-test opened 4 months ago

tandrew-test commented 4 months ago

Description

Note: I am using the latest version as of 6-Mar (504a6cd5833a99952c8ef4e63865552d180ee706)

I am trying set a specific path parameter for a specific route but it's not working.

For purposes of this example, the route is: "GET /route/widget/{widgetId}/test"

I set this in my custom dictionary (I actually want to use a generator but I did not want to overcomplicate this issue):

"restler_custom_payload": {
    "/route/widget/{widgetId}/test/get/widgetId": ["example"]
}

After compiling, I run the test. The test phase fails. Instead of using example as widgetId, the compiler added widgetId to restler_custom_payload_uuid4_suffix and used that.

I looked at the F# code and it looks like this is supposed to be supported.

/// Find a custom payload that is specific to the request type
        /// The syntax is <endpoint>/<method>/<propertyNameOrPath>
        /// Examples:
        ///   - Specify values for the parameter 'blogId' anywhere in the payload
        ///         (path parameter will be replaced):  /blog/{blogId}/get/blogId
        ///   - Substitute the Content-Type of the request

I did not write a bug as I am assuming that I am missing something. Can you help?

By the way, this technique does work just fine if I want to substitute a body (__body__). I expected this to be similar but no luck so far.

tandrew-test commented 4 months ago

Did some more checking and only found a single reference to findRequestTypeCustomPayload in Compiler.fs on line 1095. Looks like - Substitute the Content-Type of the request example from above was implemented but not - Specify values for the parameter 'blogId' anywhere in the payload /// (path parameter will be replaced): /blog/{blogId}/get/blogId

let contentType =
                match dictionary.findRequestTypeCustomPayload endpoint (requestId.method.ToString()) ContentTypeHeaderName ParameterKind.Header with