Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
package org.evomaster.e2etests.spring.rest.bb.headerassertions

import com.foo.rest.examples.bb.headerassertions.BBHeaderAssertionsController
import com.webfuzzing.commons.faults.DefinedFaultCategory
import org.evomaster.core.output.OutputFormat
import org.evomaster.core.problem.enterprise.DetectedFaultUtils
import org.evomaster.core.problem.enterprise.ExperimentalFaultCategory
Expand Down Expand Up @@ -60,24 +61,24 @@ class BBHeaderAssertionsEMTest : SpringTestBase() {

assertTrue(faults.none{
it.operationId == "GET:$prefix/ok/401"
&& it.category == ExperimentalFaultCategory.HTTP_STATUS_NO_401_IF_NO_WWW_AUTHENTICATE })
&& it.category == DefinedFaultCategory.HTTP_STATUS_NO_401_IF_NO_WWW_AUTHENTICATE })
assertTrue(faults.any{
it.operationId == "GET:$prefix/fail/401"
&& it.category == ExperimentalFaultCategory.HTTP_STATUS_NO_401_IF_NO_WWW_AUTHENTICATE })
&& it.category == DefinedFaultCategory.HTTP_STATUS_NO_401_IF_NO_WWW_AUTHENTICATE })

assertTrue(faults.none{
it.operationId == "GET:$prefix/ok/405"
&& it.category == ExperimentalFaultCategory.HTTP_STATUS_NO_405_IF_NO_ALLOW })
&& it.category == DefinedFaultCategory.HTTP_STATUS_NO_405_IF_NO_ALLOW })
assertTrue(faults.any{
it.operationId == "GET:$prefix/fail/405"
&& it.category == ExperimentalFaultCategory.HTTP_STATUS_NO_405_IF_NO_ALLOW })
&& it.category == DefinedFaultCategory.HTTP_STATUS_NO_405_IF_NO_ALLOW })

assertTrue(faults.none{
it.operationId == "GET:$prefix/ok/426"
&& it.category == ExperimentalFaultCategory.HTTP_STATUS_NO_426_IF_NO_UPGRADE })
&& it.category == DefinedFaultCategory.HTTP_STATUS_NO_426_IF_NO_UPGRADE })
assertTrue(faults.any{
it.operationId == "GET:$prefix/fail/426"
&& it.category == ExperimentalFaultCategory.HTTP_STATUS_NO_426_IF_NO_UPGRADE })
&& it.category == DefinedFaultCategory.HTTP_STATUS_NO_426_IF_NO_UPGRADE })
}
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ class BBSQLiEMTest : SpringTestBase() {
val faultCategories = DetectedFaultUtils.getDetectedFaultCategories(solution)

assertTrue(solution.individuals.size >= 1)
assertTrue({ DefinedFaultCategory.SQL_INJECTION in faultCategories })
assertTrue({ DefinedFaultCategory.SECURITY_SQL_INJECTION in faultCategories })
}
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -40,15 +40,15 @@ class SQLiMySQLBodyEMTest : SpringTestBase() {

val faultCategories = DetectedFaultUtils.getDetectedFaultCategories(solution)

assertTrue({ DefinedFaultCategory.SQL_INJECTION in faultCategories })
assertTrue({ DefinedFaultCategory.SECURITY_SQL_INJECTION in faultCategories })

assertTrue(faults.any {
it.category == DefinedFaultCategory.SQL_INJECTION
it.category == DefinedFaultCategory.SECURITY_SQL_INJECTION
&& it.operationId == "POST:/api/sqli/body/vulnerable"
})

assertFalse(faults.any {
it.category == DefinedFaultCategory.SQL_INJECTION
it.category == DefinedFaultCategory.SECURITY_SQL_INJECTION
&& it.operationId == "GET:/api/sqli/body/safe"
})

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -36,15 +36,15 @@ class SQLiMySQLPathEMTest : SpringTestBase() {

val faultCategories = DetectedFaultUtils.getDetectedFaultCategories(solution)

assertTrue({ DefinedFaultCategory.SQL_INJECTION in faultCategories })
assertTrue({ DefinedFaultCategory.SECURITY_SQL_INJECTION in faultCategories })

assertTrue(faults.any {
it.category == DefinedFaultCategory.SQL_INJECTION
it.category == DefinedFaultCategory.SECURITY_SQL_INJECTION
&& it.operationId == "GET:/api/sqli/path/vulnerable/{id}"
})

assertFalse(faults.any {
it.category == DefinedFaultCategory.SQL_INJECTION
it.category == DefinedFaultCategory.SECURITY_SQL_INJECTION
&& it.operationId == "GET:/api/sqli/path/safe"
})

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -38,15 +38,15 @@ class SQLiMySQLQueryEMTest : SpringTestBase() {

val faultCategories = DetectedFaultUtils.getDetectedFaultCategories(solution)

assertTrue({ DefinedFaultCategory.SQL_INJECTION in faultCategories })
assertTrue({ DefinedFaultCategory.SECURITY_SQL_INJECTION in faultCategories })

assertTrue(faults.any {
it.category == DefinedFaultCategory.SQL_INJECTION
it.category == DefinedFaultCategory.SECURITY_SQL_INJECTION
&& it.operationId == "GET:/api/sqli/query/vulnerable"
})

assertFalse(faults.any {
it.category == DefinedFaultCategory.SQL_INJECTION
it.category == DefinedFaultCategory.SECURITY_SQL_INJECTION
&& it.operationId == "GET:/api/sqli/query/safe"
})

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ class HttpOracleDeleteEMTest : SpringTestBase(){


val faults = DetectedFaultUtils.getDetectedFaultCategories(solution)
assertTrue({ ExperimentalFaultCategory.HTTP_NONWORKING_DELETE in faults })
assertTrue({ DefinedFaultCategory.HTTP_NONWORKING_DELETE in faults })

}
}
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
package org.evomaster.e2etests.spring.openapi.v3.httporacle.failmodification

import com.foo.rest.examples.spring.openapi.v3.httporacle.failmodification.FailModificationController
import com.webfuzzing.commons.faults.DefinedFaultCategory
import org.evomaster.core.problem.enterprise.DetectedFaultUtils
import org.evomaster.core.problem.enterprise.ExperimentalFaultCategory
import org.evomaster.core.problem.rest.data.HttpVerb
Expand Down Expand Up @@ -39,7 +40,7 @@ class FailModificationEMTest : SpringTestBase(){

val faults = DetectedFaultUtils.getDetectedFaults(solution)

val found = faults.filter { it.category == ExperimentalFaultCategory.HTTP_SIDE_EFFECTS_FAILED_MODIFICATION}
val found = faults.filter { it.category == DefinedFaultCategory.HTTP_SIDE_EFFECTS_FAILED_MODIFICATION}

assertEquals(2, found.size)
}
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
package org.evomaster.e2etests.spring.openapi.v3.httporacle.failmodification

import com.foo.rest.examples.spring.openapi.v3.httporacle.failmodification.FailModificationForbiddenController
import com.webfuzzing.commons.faults.DefinedFaultCategory
import org.evomaster.core.problem.enterprise.DetectedFaultUtils
import org.evomaster.core.problem.enterprise.ExperimentalFaultCategory
import org.evomaster.e2etests.spring.openapi.v3.SpringTestBase
Expand Down Expand Up @@ -38,7 +39,7 @@ class FailModificationForbiddenEMTest : SpringTestBase(){
assertTrue(solution.individuals.size >= 1)

val faults = DetectedFaultUtils.getDetectedFaults(solution)
.filter { it.category == ExperimentalFaultCategory.HTTP_SIDE_EFFECTS_FAILED_MODIFICATION}
.filter { it.category == DefinedFaultCategory.HTTP_SIDE_EFFECTS_FAILED_MODIFICATION}

assertEquals(1, faults.size)
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ package org.evomaster.e2etests.spring.openapi.v3.httporacle.failmodification

import com.foo.rest.examples.spring.openapi.v3.httporacle.failmodification.FailModificationForbiddenController
import com.foo.rest.examples.spring.openapi.v3.httporacle.failmodification.FailModificationNotFoundController
import com.webfuzzing.commons.faults.DefinedFaultCategory
import org.evomaster.core.problem.enterprise.DetectedFaultUtils
import org.evomaster.core.problem.enterprise.ExperimentalFaultCategory
import org.evomaster.e2etests.spring.openapi.v3.SpringTestBase
Expand Down Expand Up @@ -38,7 +39,7 @@ class FailModificationNotFoundEMTest : SpringTestBase(){
assertTrue(solution.individuals.size >= 1)

val faultsCategories = DetectedFaultUtils.getDetectedFaultCategories(solution)
assertTrue(ExperimentalFaultCategory.HTTP_SIDE_EFFECTS_FAILED_MODIFICATION in faultsCategories)
assertTrue(DefinedFaultCategory.HTTP_SIDE_EFFECTS_FAILED_MODIFICATION in faultsCategories)
}
}
}
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
package org.evomaster.e2etests.spring.openapi.v3.httporacle.failmodification

import com.foo.rest.examples.spring.openapi.v3.httporacle.failmodification.FailModificationURLEncodedController
import com.webfuzzing.commons.faults.DefinedFaultCategory
import org.evomaster.core.problem.enterprise.DetectedFaultUtils
import org.evomaster.core.problem.enterprise.ExperimentalFaultCategory
import org.evomaster.e2etests.spring.openapi.v3.SpringTestBase
Expand Down Expand Up @@ -39,7 +40,7 @@ class URLEncodedFailModificationEMTest : SpringTestBase(){
val faults = DetectedFaultUtils.getDetectedFaults(solution)

assertEquals(1, faults.size)
assertEquals(ExperimentalFaultCategory.HTTP_SIDE_EFFECTS_FAILED_MODIFICATION, faults.first().category)
assertEquals(DefinedFaultCategory.HTTP_SIDE_EFFECTS_FAILED_MODIFICATION, faults.first().category)
}
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ package org.evomaster.e2etests.spring.openapi.v3.httporacle.failmodification

import com.foo.rest.examples.spring.openapi.v3.httporacle.failmodification.FailModificationController
import com.foo.rest.examples.spring.openapi.v3.httporacle.failmodification.FailModificationXMLController
import com.webfuzzing.commons.faults.DefinedFaultCategory
import org.evomaster.core.problem.enterprise.DetectedFaultUtils
import org.evomaster.core.problem.enterprise.ExperimentalFaultCategory
import org.evomaster.core.problem.rest.data.HttpVerb
Expand Down Expand Up @@ -42,7 +43,7 @@ class XMLFailModificationEMTest : SpringTestBase(){
val faults = DetectedFaultUtils.getDetectedFaults(solution)

assertEquals(2, faults.size)
assertEquals(ExperimentalFaultCategory.HTTP_SIDE_EFFECTS_FAILED_MODIFICATION, faults.first().category)
assertEquals(DefinedFaultCategory.HTTP_SIDE_EFFECTS_FAILED_MODIFICATION, faults.first().category)
}
}
}
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
package org.evomaster.e2etests.spring.openapi.v3.httporacle.invalidallow

import com.foo.rest.examples.spring.openapi.v3.httporacle.invalidallow.auth.HttpInvalidAllowAuthController
import com.webfuzzing.commons.faults.DefinedFaultCategory
import org.evomaster.core.problem.enterprise.DetectedFaultUtils
import org.evomaster.core.problem.enterprise.ExperimentalFaultCategory
import org.evomaster.e2etests.spring.openapi.v3.SpringTestBase
Expand Down Expand Up @@ -39,10 +40,10 @@ class HttpInvalidAllowAuthEMTest : SpringTestBase() {
// OPTIONS is 401 without auth: the fault is only found once the oracle
// retries with an authenticated user and reads the 2xx Allow header.
val faults = DetectedFaultUtils.getDetectedFaultCategories(solution)
assertTrue({ ExperimentalFaultCategory.HTTP_INVALID_ALLOW in faults })
assertTrue({ DefinedFaultCategory.SCHEMA_INVALID_ALLOW in faults })

val allowFaults = DetectedFaultUtils.getDetectedFaults(solution)
.filter { it.category == ExperimentalFaultCategory.HTTP_INVALID_ALLOW }
.filter { it.category == DefinedFaultCategory.SCHEMA_INVALID_ALLOW }

assertTrue(allowFaults.any { it.operationId.contains("/api/products/") })
assertTrue(allowFaults.none { it.operationId.contains("/api/orders/") })
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
package org.evomaster.e2etests.spring.openapi.v3.httporacle.invalidallow

import com.foo.rest.examples.spring.openapi.v3.httporacle.invalidallow.HttpInvalidAllowController
import com.webfuzzing.commons.faults.DefinedFaultCategory
import org.evomaster.core.problem.enterprise.DetectedFaultUtils
import org.evomaster.core.problem.enterprise.ExperimentalFaultCategory
import org.evomaster.e2etests.spring.openapi.v3.SpringTestBase
Expand Down Expand Up @@ -37,10 +38,10 @@ class HttpInvalidAllowEMTest : SpringTestBase() {
assertTrue(solution.individuals.size >= 1)

val faults = DetectedFaultUtils.getDetectedFaultCategories(solution)
assertTrue({ ExperimentalFaultCategory.HTTP_INVALID_ALLOW in faults })
assertTrue({ DefinedFaultCategory.SCHEMA_INVALID_ALLOW in faults })

val allowFaults = DetectedFaultUtils.getDetectedFaults(solution)
.filter { it.category == ExperimentalFaultCategory.HTTP_INVALID_ALLOW }
.filter { it.category == DefinedFaultCategory.SCHEMA_INVALID_ALLOW }

assertTrue(allowFaults.any { it.operationId.contains("/api/products/") })
assertTrue(allowFaults.none { it.operationId.contains("/api/orders/") })
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
package org.evomaster.e2etests.spring.openapi.v3.httporacle.invalidallow

import com.foo.rest.examples.spring.openapi.v3.httporacle.invalidallow.missing.HttpMissingAllowController
import com.webfuzzing.commons.faults.DefinedFaultCategory
import org.evomaster.core.problem.enterprise.DetectedFaultUtils
import org.evomaster.core.problem.enterprise.ExperimentalFaultCategory
import org.evomaster.e2etests.spring.openapi.v3.SpringTestBase
Expand Down Expand Up @@ -37,10 +38,10 @@ class HttpMissingAllowEMTest : SpringTestBase() {
assertTrue(solution.individuals.size >= 1)

val faults = DetectedFaultUtils.getDetectedFaultCategories(solution)
assertTrue(ExperimentalFaultCategory.HTTP_INVALID_ALLOW in faults)
assertTrue(DefinedFaultCategory.SCHEMA_INVALID_ALLOW in faults)

val allowFaults = DetectedFaultUtils.getDetectedFaults(solution)
.filter { it.category == ExperimentalFaultCategory.HTTP_INVALID_ALLOW }
.filter { it.category == DefinedFaultCategory.SCHEMA_INVALID_ALLOW }

assertTrue(allowFaults.any { it.operationId.contains("/api/products/") })
assertTrue(allowFaults.none { it.operationId.contains("/api/orders/") })
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
package org.evomaster.e2etests.spring.openapi.v3.httporacle.invalidlocation

import com.foo.rest.examples.spring.openapi.v3.httporacle.invalidlocation.deleteonly.HttpInvalidLocationDeleteOnlyController
import com.webfuzzing.commons.faults.DefinedFaultCategory
import org.evomaster.core.problem.enterprise.DetectedFaultUtils
import org.evomaster.core.problem.enterprise.ExperimentalFaultCategory
import org.evomaster.e2etests.spring.openapi.v3.SpringTestBase
Expand Down Expand Up @@ -39,10 +40,10 @@ class HttpInvalidLocationDeleteOnlyEMTest : SpringTestBase() {
// The Location points to a resource declared only for DELETE (no GET), so a GET
// would be 405. The oracle must probe with DELETE and flag the 404 it returns.
val faults = DetectedFaultUtils.getDetectedFaultCategories(solution)
assertTrue(ExperimentalFaultCategory.HTTP_INVALID_LOCATION in faults)
assertTrue(DefinedFaultCategory.HTTP_INVALID_LOCATION in faults)

val locationFaults = DetectedFaultUtils.getDetectedFaults(solution)
.filter { it.category == ExperimentalFaultCategory.HTTP_INVALID_LOCATION }
.filter { it.category == DefinedFaultCategory.HTTP_INVALID_LOCATION }
assertTrue(locationFaults.any { it.operationId.contains("/api/products/") })
}
}
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
package org.evomaster.e2etests.spring.openapi.v3.httporacle.invalidlocation

import com.foo.rest.examples.spring.openapi.v3.httporacle.invalidlocation.HttpInvalidLocationController
import com.webfuzzing.commons.faults.DefinedFaultCategory
import org.evomaster.core.problem.enterprise.DetectedFaultUtils
import org.evomaster.core.problem.enterprise.ExperimentalFaultCategory
import org.evomaster.e2etests.spring.openapi.v3.SpringTestBase
Expand Down Expand Up @@ -38,7 +39,7 @@ class HttpInvalidLocationEMTest : SpringTestBase(){
assertTrue(solution.individuals.size >= 1)

val faults = DetectedFaultUtils.getDetectedFaultCategories(solution)
assertTrue({ ExperimentalFaultCategory.HTTP_INVALID_LOCATION in faults })
assertTrue({ DefinedFaultCategory.HTTP_INVALID_LOCATION in faults })
}
}
}
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
package org.evomaster.e2etests.spring.openapi.v3.httporacle.invalidlocation

import com.foo.rest.examples.spring.openapi.v3.httporacle.invalidlocation.fullpath.HttpInvalidLocationFullPathController
import com.webfuzzing.commons.faults.DefinedFaultCategory
import org.evomaster.core.problem.enterprise.DetectedFaultUtils
import org.evomaster.core.problem.enterprise.ExperimentalFaultCategory
import org.evomaster.e2etests.spring.openapi.v3.SpringTestBase
Expand Down Expand Up @@ -37,7 +38,7 @@ class HttpInvalidLocationFullPathEMTest : SpringTestBase(){
assertTrue(solution.individuals.size >= 1)

val faults = DetectedFaultUtils.getDetectedFaultCategories(solution)
assertTrue({ ExperimentalFaultCategory.HTTP_INVALID_LOCATION in faults })
assertTrue({ DefinedFaultCategory.HTTP_INVALID_LOCATION in faults })
}
}
}
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
package org.evomaster.e2etests.spring.openapi.v3.httporacle.invalidlocation

import com.foo.rest.examples.spring.openapi.v3.httporacle.invalidlocation.locationget.HttpInvalidLocationGetController
import com.webfuzzing.commons.faults.DefinedFaultCategory
import org.evomaster.core.problem.enterprise.DetectedFaultUtils
import org.evomaster.core.problem.enterprise.ExperimentalFaultCategory
import org.evomaster.e2etests.spring.openapi.v3.SpringTestBase
Expand Down Expand Up @@ -43,7 +44,7 @@ class HttpInvalidLocationGetEMTest : SpringTestBase(){
assertTrue(solution.individuals.size >= 1)

val faults = DetectedFaultUtils.getDetectedFaultCategories(solution)
assertTrue({ ExperimentalFaultCategory.HTTP_INVALID_LOCATION in faults })
assertTrue({ DefinedFaultCategory.HTTP_INVALID_LOCATION in faults })
}
}
}
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
package org.evomaster.e2etests.spring.openapi.v3.httporacle.invalidlocation

import com.foo.rest.examples.spring.openapi.v3.httporacle.invalidlocation.notvalidpath.HttpInvalidLocationNotValidController
import com.webfuzzing.commons.faults.DefinedFaultCategory
import org.evomaster.core.problem.enterprise.DetectedFaultUtils
import org.evomaster.core.problem.enterprise.ExperimentalFaultCategory
import org.evomaster.e2etests.spring.openapi.v3.SpringTestBase
Expand Down Expand Up @@ -37,7 +38,7 @@ class HttpInvalidLocationNotValidEMTest : SpringTestBase(){
assertTrue(solution.individuals.size >= 1)

val faults = DetectedFaultUtils.getDetectedFaultCategories(solution)
assertTrue({ ExperimentalFaultCategory.HTTP_INVALID_LOCATION in faults })
assertTrue({ DefinedFaultCategory.HTTP_INVALID_LOCATION in faults })
}
}
}
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
package org.evomaster.e2etests.spring.openapi.v3.httporacle.invalidlocation

import com.foo.rest.examples.spring.openapi.v3.httporacle.invalidlocation.verbselection.HttpInvalidLocationVerbSelectionController
import com.webfuzzing.commons.faults.DefinedFaultCategory
import org.evomaster.core.problem.enterprise.DetectedFaultUtils
import org.evomaster.core.problem.enterprise.ExperimentalFaultCategory
import org.evomaster.core.problem.rest.data.HttpVerb
Expand Down Expand Up @@ -38,7 +39,7 @@ class HttpInvalidLocationVerbSelectionEMTest : SpringTestBase() {
assertTrue(solution.individuals.size >= 1)

val faults = DetectedFaultUtils.getDetectedFaults(solution)
.filter { it.category == ExperimentalFaultCategory.HTTP_INVALID_LOCATION }
.filter { it.category == DefinedFaultCategory.HTTP_INVALID_LOCATION }

// Family A: Location -> declared GET returning 500. A fault here can only come from
// the 500 status, proving 500 is part of the invalid-location status set.
Expand Down
Loading
Loading