microsoft/restler-fuzzer

URL Parameters Missing Space Encodings

开放

#495 创建于 2022年3月22日

 (1 条评论) (0 个反应) (0 位负责人)Python (329 个派生)auto 404
bughelp wanted

仓库指标

星标
 (2,929 个星标)
PR 合并指标
 (PR 指标待抓取)

描述

URL parameters which contain a space in the value do not get the usual URL encoding (ex. " " becomes "+" or "%20"). This results in malformed HTTP/1.1 requests. For example, if my yaml specification has a type like:

    network:
      name: network
      in: query
      required: true
      schema:
        type: string
        enum:
          - "Internal"
          - "External Users"
          - "External Networks"

then the following GET requests will be created:

GET /config?network=Internal HTTP/1.1
GET /config?network=External Users HTTP/1.1
GET /config?network=External Networks HTTP/1.1

This doesn't get recognized properly and leads to erroneous fuzzing cases for parameters which are supposed to contain a space in them.

贡献者指南