microsoft/restler-fuzzer

URL Parameters Missing Space Encodings

オープン

#495 opened on 2022/03/22

 (1 件のコメント) (0 件のリアクション) (0 人の担当者)Python (329 件のフォーク)auto 404
bughelp wanted

Repository metrics

Stars
 (2,929 個のスター)
PR merge metrics
 (PR metrics pending)

説明

URL parameters which contain a space in the value do not get the usual URL encoding (ex. " " becomes "+" or "%20"). This results in malformed HTTP/1.1 requests. For example, if my yaml specification has a type like:

    network:
      name: network
      in: query
      required: true
      schema:
        type: string
        enum:
          - "Internal"
          - "External Users"
          - "External Networks"

then the following GET requests will be created:

GET /config?network=Internal HTTP/1.1
GET /config?network=External Users HTTP/1.1
GET /config?network=External Networks HTTP/1.1

This doesn't get recognized properly and leads to erroneous fuzzing cases for parameters which are supposed to contain a space in them.

コントリビューターガイド