Skip to content

Commit fdb2113

Browse files
committed
Merge remote-tracking branch 'origin/master'
2 parents f7d827b + 4777cfc commit fdb2113

5 files changed

Lines changed: 192 additions & 52 deletions

File tree

pom.xml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -181,6 +181,16 @@
181181
<targetPackage>com.webfuzzing.commons.report</targetPackage>
182182
</configuration>
183183
</execution>
184+
<execution>
185+
<id>auth.yaml</id>
186+
<goals>
187+
<goal>generate</goal>
188+
</goals>
189+
<configuration>
190+
<sourceDirectory>${basedir}/src/main/resources/wfc/schemas/auth.yaml</sourceDirectory>
191+
<targetPackage>com.webfuzzing.commons.auth</targetPackage>
192+
</configuration>
193+
</execution>
184194
</executions>
185195
</plugin>
186196
<plugin>

release_notes.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
11

2+
# 0.0.2
3+
Support for auth
4+
25
# 0.0.1
36
First draft version

src/main/resources/wfc/schemas/auth.yaml

Lines changed: 137 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,12 +11,12 @@ properties:
1111
description: "List of authentication information for different users."
1212
type: array
1313
items:
14-
$ref: "#/$def/AuthenticationInfo"
14+
$ref: "#/$defs/AuthenticationInfo"
1515
authTemplate:
1616
description: "Optional authentication information template. This is used to avoid duplication in the auth list. \
1717
Entries defined in the template will be applied to all elements in the auth list that do not specify them."
1818
allOf:
19-
- $ref: "#/$def/AuthenticationInfo"
19+
- $ref: "#/$defs/AuthenticationInfo"
2020
- type: object
2121
configs:
2222
description: "Optional map of configuration parameters, in the form key:value strings. \
@@ -26,9 +26,140 @@ properties:
2626
additionalProperties:
2727
type: string
2828
required: ["auth"]
29-
$def:
29+
$defs:
30+
# TODO unfortunately, tools like jsonschema2pojo-maven-plugin have major limitations when dealing with enums.
31+
# This is not created as a top-level class
32+
HttpVerb:
33+
type: string
34+
enum:
35+
- POST
36+
- GET
37+
- PATCH
38+
- DELETE
39+
- PUT
40+
Header:
41+
description: "HTTP header information"
42+
type: object
43+
properties:
44+
name:
45+
description: "The header name, e.g., 'Authorization'."
46+
type: string
47+
value:
48+
description: "The value of the header"
49+
type: string
50+
required: ["name","value"]
3051
AuthenticationInfo:
3152
type: object
32-
33-
34-
53+
properties:
54+
name:
55+
description: "The name given to this authentication info. \
56+
This works as a unique id for this authentication configuration."
57+
type: string
58+
requireMockHandling:
59+
description: "Specify that the authentication for this user requires setting up mock responses from an external service. \
60+
This will be done as part of the fuzzing, although only possible for white-box testing. \
61+
One consequence here is that, even if we provide correct auth info as input, then a request might still \
62+
fail due to unauthorized access if the fuzzing process does not properly set up these mocked responses in the API itself."
63+
type: boolean
64+
fixedHeaders:
65+
description: "The headers needed for authentication. \
66+
This is used to represent cases in which auth info is static/fixed, e.g., \
67+
when passing an id or username/password through a HTTP header (and not \
68+
using for example a dynamically generated token from a login endpoint first)."
69+
type: array
70+
items:
71+
$ref: "#/$defs/Header"
72+
loginEndpointAuth:
73+
$ref: "#/$defs/LoginEndpoint"
74+
required: ["name"]
75+
###
76+
LoginEndpoint:
77+
description: "Used to represent the case in which a login endpoint is used to obtain the authentication credentials. \
78+
These can be cookies, or a token extracted from the login endpoint's response. \
79+
This token can then be added to an HTTP header in the following requests."
80+
type: object
81+
properties:
82+
endpoint:
83+
description: "The endpoint path (eg '/login') where to execute the login. \
84+
It assumes it is on same server of API.\
85+
If not, rather use 'externalEndpointURL'."
86+
type: string
87+
externalEndpointURL:
88+
description: "If the login endpoint is on a different server, here can rather specify the full URL for it."
89+
type: string
90+
payloadRaw:
91+
description: "The raw payload to send, as a string."
92+
type: string
93+
payloadUserPwd:
94+
$ref: "#/$defs/PayloadUsernamePassword"
95+
headers:
96+
description: "HTTP headers needed when calling the login endpoint. \
97+
Username/password could be passed by headers instead of by the body payload."
98+
type: array
99+
items:
100+
$ref: "#/$defs/Header"
101+
verb:
102+
# description: "The verb used to connect to the login endpoint. \
103+
# Most of the time, this will be a 'POST'."
104+
# type: string
105+
# enum:
106+
# - POST
107+
# - GET
108+
# - PATCH
109+
# - DELETE
110+
# - PUT
111+
$ref: "#/$defs/HttpVerb"
112+
## FIXME: unfortunately, plugin is not able to handle this... need new schema version with $ref not replacing everything
113+
# description: "The verb used to connect to the login endpoint. \
114+
# Most of the time, this will be a 'POST'."
115+
# allOf:
116+
# - $ref: "#/$defs/HttpVerb"
117+
# - type: string
118+
contentType:
119+
description: "Specify the format in which the payload is sent to the login endpoint. \
120+
A common example is 'application/json'."
121+
type: string
122+
token:
123+
$ref: "#/$defs/TokenHandling"
124+
expectCookies:
125+
description: "Specify if we are expecting to get cookies from the login endpoint. \
126+
If so, a fuzzer can use those as auth info in following requests, instead of trying to extract \
127+
an auth token from the response payload."
128+
type: boolean
129+
required: ["verb"]
130+
###
131+
TokenHandling:
132+
description: "Specify how to extract token from response, and how to use it for auth in following requests. \
133+
Not needed if rather expect to get back a cookie."
134+
type: object
135+
properties:
136+
extractFromField:
137+
description: "How to extract the token from a JSON response, as such JSON could have few fields, possibly nested. \
138+
It is expressed as a JSON Pointer (RFC 6901)."
139+
type: string
140+
httpHeaderName:
141+
description: "When sending a token in an HTTP header, specify to which header to add it (e.g., 'Authorization')."
142+
type: string
143+
headerPrefix:
144+
description: " When sending out the obtained token in an HTTP header, specify if there should be any \
145+
prefix (e.g., 'Bearer ' or 'JWT '). If needed, make sure it has trailing space(s)."
146+
type: string
147+
###
148+
PayloadUsernamePassword:
149+
description: "Payload with username and password information. \
150+
It will be automatically formatted in a proper payload based on content type."
151+
type: object
152+
properties:
153+
username:
154+
description: "The id of the user."
155+
type: string
156+
password:
157+
description: "The password of the user, in plain-text. This must NOT be hashed."
158+
type: string
159+
usernameField:
160+
description: "The name of the field in the body payload containing the username."
161+
type: string
162+
passwordField:
163+
description: "The name of the field in the body payload containing the password"
164+
type: string
165+
required: ["username","usernameField","password","passwordField"]

src/main/resources/wfc/schemas/report.yaml

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -19,18 +19,18 @@ properties:
1919
format: date-time
2020
description: "The timestamp of when this report file was created."
2121
faults:
22-
$ref: "#/$def/Faults"
22+
$ref: "#/$defs/Faults"
2323
#### Unfortunately, there is no support for oneOf in jsonschema2pojo
2424
# problem_details:
2525
# type: object
2626
# oneOf:
27-
# - $ref: "#/$def/RESTReport"
27+
# - $ref: "#/$defs/RESTReport"
2828
# # TODO GraphQL, RPC and Web
2929
problem_details:
3030
type: object
3131
properties:
3232
rest:
33-
$ref: "#/$def/RESTReport"
33+
$ref: "#/$defs/RESTReport"
3434
# TODO GraphQL, RPC and Web
3535
# expressing that only 1 should be present is possible, but super-verbose and convoluted
3636
total_tests:
@@ -40,24 +40,24 @@ properties:
4040
test_file_paths:
4141
type: array
4242
items:
43-
$ref: "#/$def/TestFilePath"
43+
$ref: "#/$defs/TestFilePath"
4444
uniqueItems: true
4545
description: "The list of relative paths (compared to this document) of all the generated test suite files."
4646
test_cases:
4747
description: "Information on each generated test case."
4848
type: array
4949
items:
50-
$ref: "#/$def/TestCase"
50+
$ref: "#/$defs/TestCase"
5151
#OPTIONAL
5252
extra:
5353
description: "Extra, optional coverage information, collected by different tools."
5454
type: array
5555
items:
56-
$ref: "#/$def/Coverage"
56+
$ref: "#/$defs/Coverage"
5757

5858
required: ["schema_version","tool_name","tool_version","creation_time","faults","problem_details","total_tests","test_file_paths","test_cases"]
5959

60-
$def:
60+
$defs:
6161
OperationId:
6262
description: "A unique identifier for an operation. For example, in REST, it would be a HTTP endpoint, including
6363
verb, e.g., 'GET:/users/{id}'."
@@ -85,15 +85,15 @@ $def:
8585
type: object
8686
properties:
8787
endpoint_id:
88-
$ref: "#/$def/OperationId"
88+
$ref: "#/$defs/OperationId"
8989
test_case_id:
90-
$ref: "#/$def/TestCaseId"
90+
$ref: "#/$defs/TestCaseId"
9191
http_status:
9292
description: "As in a test case the same endpoint could be called more than once, here we report all of the
9393
obtained HTTP status codes"
9494
type: array
9595
items:
96-
$ref: "#/$def/HttpStatus"
96+
$ref: "#/$defs/HttpStatus"
9797
minItems: 1
9898
uniqueItems: true
9999
required: ["endpoint_id","test_case_id","http_status"]
@@ -107,13 +107,13 @@ $def:
107107
type: object
108108
properties:
109109
operation_id:
110-
$ref: "#/$def/OperationId"
110+
$ref: "#/$defs/OperationId"
111111
test_case_id:
112-
$ref: "#/$def/TestCaseId"
112+
$ref: "#/$defs/TestCaseId"
113113
fault_categories:
114114
type: array
115115
items:
116-
$ref: "#/$def/FaultCategoryId"
116+
$ref: "#/$defs/FaultCategoryId"
117117
minItems: 1
118118
uniqueItems: true
119119
required: ["endpoint_id","test_case_id","fault_categories"]
@@ -130,22 +130,22 @@ $def:
130130
description: "Unique ids of all the endpoints in the tested API."
131131
type: array
132132
items:
133-
$ref: "#/$def/OperationId"
133+
$ref: "#/$defs/OperationId"
134134
uniqueItems: true
135135
covered_http_status:
136136
description: "List of which HTTP status codes were covered, based on endpoints."
137137
type: array
138138
items:
139-
$ref: "#/$def/CoveredEndpoint"
139+
$ref: "#/$defs/CoveredEndpoint"
140140
required: ["total_http_calls","endpoint_ids","covered_http_status"]
141141

142142
TestCase:
143143
type: object
144144
properties:
145145
id:
146-
$ref: "#/$def/TestCaseId"
146+
$ref: "#/$defs/TestCaseId"
147147
file_path:
148-
$ref: "#/$def/TestFilePath"
148+
$ref: "#/$defs/TestFilePath"
149149
name:
150150
description: "The name of the test case, as it appears in the generated test file."
151151
type: string
@@ -171,7 +171,7 @@ $def:
171171
description: "Information on all the identified potential faults."
172172
type: array
173173
items:
174-
$ref: "#/$def/FoundFault"
174+
$ref: "#/$defs/FoundFault"
175175
required: ["total_number","found_faults"]
176176

177177
Coverage:
@@ -183,7 +183,7 @@ $def:
183183
criteria:
184184
type: array
185185
items:
186-
$ref: "#/$def/CoverageCriterion"
186+
$ref: "#/$defs/CoverageCriterion"
187187
required: ["tool_name","criteria"]
188188

189189
CoverageCriterion:

0 commit comments

Comments
 (0)