foREST

This is the repo for the paper foREST: A Tree-based Approach for Fuzzing RESTful APIs submitted to ISSTA 2022.

The repository contains two folders:

  1. source code: source code of foREST
  2. experiment data: the coverage growth recorded during our experiment, the full logs are available here

Instructions to Run foREST

Step 1. Clone the repo and install the dependencies

pip3 install -r requirements.txt

Step 2. Save the yaml doc of the target service to the folder of openapi

Step 3. Configue to use the yamal file via FoREST_config.

Step 4. run

python3 main.py

All Bugs Found by foREST

Project Endpoint Method Link or description
GitLab /projects POST issue
GitLab /projects/{id}/fork/{forked_from_id} POST issue
GitLab /projects/{id}/metrics/user_starred_dashboards POST issue
GitLab /projects/{id}/clusters/user POST issue
GitLab /projects/{id}/export POST issue
GitLab /projects/{id}/custom_attributes GET issue
GitLab /projects/{id}/custom_attributes/{key} POST issue
GitLab /projects/{id}/custom_attributes/{key} DELETE issue
GitLab /projects/{id}/repository/commits GET issue
GitLab /projects/{id}/repository/commits POST logfile: /data/gitlab-project-branch-commit/forest/logs/5xx_request line 19
GitLab /projects/{id}/repository/branches POST logfile: /data/gitlab-project-branch-commit/forest/logs/5xx_request line 1897
GitLab /groups/{id}/clusters/user POST issue
GitLab /groups/{id}/custom_attributes GET issue
GitLab /groups/{id}/custom_attributes/{key} PUT issue
GitLab /groups/{id}/custom_attributes/{key} DELETE issue
GitLab /groups/{id}/custom_attributes/{key} GET issue
GitLab /users/{id}/custom_attributes GET issue
GitLab /users/{id}/custom_attributes/{key} DELETE issue
GitLab /users/{id}/custom_attributes/{key} PUT issue
GitLab /users/{id}/custom_attributes/{key} GET issue
GitLab /admin/clusters/add POST issue
GitLab /clusters/{id}/metrics_dashboard/annotations/ POST issue
GitLab /hooks POST issue
WordPress /tags/{id} DELETE logfile: /data/wordpress/forest/logs/5xx_request line 25
WordPress /users POST logfile: /data/wordpress/forest/logs/5xx_request line 41
WordPress /categories DELETE logfile: /data/wordpress/forest/logs/5xx_request line 17

More Comparison Study with RESTler RandomWalk