microsoft/restler-fuzzer

URL Parameters Missing Space Encodings

Open

#495 opened on Mar 22, 2022

View on GitHub
 (1 comment) (0 reactions) (0 assignees)Python (329 forks)auto 404
bughelp wanted

Repository metrics

Stars
 (2,929 stars)
PR merge metrics
 (PR metrics pending)

Description

URL parameters which contain a space in the value do not get the usual URL encoding (ex. " " becomes "+" or "%20"). This results in malformed HTTP/1.1 requests. For example, if my yaml specification has a type like:

    network:
      name: network
      in: query
      required: true
      schema:
        type: string
        enum:
          - "Internal"
          - "External Users"
          - "External Networks"

then the following GET requests will be created:

GET /config?network=Internal HTTP/1.1
GET /config?network=External Users HTTP/1.1
GET /config?network=External Networks HTTP/1.1

This doesn't get recognized properly and leads to erroneous fuzzing cases for parameters which are supposed to contain a space in them.

Contributor guide

Research direction
Investigate the code that builds HTTP requests, specifically the part that constructs query parameters, and ensure spaces are encoded as '%20' or '+'.
Tech stack
None
Domain
apitesting
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
GitPython
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
75