Search papers, labs, and topics across Lattice.
This paper introduces novel automated techniques to identify HTTP semantics-level faults in REST APIs by extending the fuzzer EvoMaster with nine new oracles. The approach involves generating test cases and then creating new sequences of HTTP calls to validate specific HTTP properties, effectively enhancing the fault detection capabilities of existing tools. Experiments demonstrated that the techniques could detect all injected faults in artificial APIs and uncover 166 existing faults in real-world APIs, underscoring the importance of adhering to HTTP semantics in API design.
Automated techniques can uncover 166 hidden faults in real-world REST APIs, revealing critical vulnerabilities in HTTP semantics adherence.
Context: REST APIs are widely used in industry. These APIs use HTTP for their communications. Failures in following the specifications of HTTP can lead to confusing and hard to use APIs, with possibly serious software faults with dire consequences. Objectives: Define novel automated techniques to automatically find HTTP semantics-level faults in existing REST APIs. Methods: We extended the state-of-the-art fuzzer EvoMaster with 9 new oracles to detect HTTP semanticslevel faults. Once the standard fuzzing process is finished generating N test cases, a new phase is executed in which these N tests are used as a starting point to create new scenarios (i.e., new sequences of HTTP calls) aimed at validating specific HTTP properties defined in these 9 oracles. Results: Experiments on 9 artificial APIs with inject faults show that our novel techniques can successfully detect all of them. Further experiments on 36 APIs from the WFD corpus show that our novel techniques can automatically find 166 existing faults in these real-world APIs. Conclusion: REST APIs use HTTP, and, as such, they need to follow its semantics to avoid misleading their clients and introducing subtle software faults. The novel techniques presented in this paper are shown to be effective at automatically finding several of this type of faults.
