REST-ler: Bincike ta atomatik na REST API Fuzzing

Teburin Abubuwan Ciki

1 Gabatarwa
2 Hanyar REST-ler
- 2.1 Bincike na Ƙayyadaddun Swagger
- 2.2 Bincike na Ra'ayoyin Dawo
3 Aiwatar da Fasaha
- 3.1 Algorithm na Ƙididdigar Dogaro
- 3.2 Dabarun Bincike
4 Sakamakon Gwaji
- 4.1 Nazarin Shari'ar GitLab
- 4.2 Ƙididdigar Gano Kurakurai
5 Bincike na Asali
6 Aikace-aikacen Gaba
7 Nassoshi

1 Gabatarwa

Sabis na gajimare sun sami girma mai ƙarfi tare da dandamali kamar Amazon Web Services da Microsoft Azure sun zama manyan ƙarfi a fagen kwamfuta. Yawancin sabis na gajimare a yau ana samun su ta hanyar REST APIs, tare da Swagger (OpenAPI) ya zama sanannen harshen bayanin mu'amala. REST-ler yana wakiltar ci gaba a matsayin kayan aikin farko na atomatik na gwajin tsaron REST API wanda ke bincika ƙayyadaddun Swagger don samar da cikakkun gwaje-gwaje na sabis na gajimare.

2 Hanyar REST-ler

2.1 Bincike na Ƙayyadaddun Swagger

REST-ler yana yin bincike mai sauƙi na ƙayyadaddun Swagger don ƙididdige dogaro tsakanin nau'ikan buƙatu. Tsarin yana gano alaƙa inda buƙatu B ke buƙatar ID albarkatun da buƙatu A ya dawo, yana kafa dogaro na tsarin aiwatarwa. Wannan binciken yana rage sararin bincike sosai ta hanyar kawar da jerin buƙatun marasa inganci.

2.2 Bincike na Ra'ayoyin Dawo

Kayan aikin yana ci gaba da bincika martani daga gwaje-gwajen da suka gabata don daidaita dabarar gwajinsa. Lokacin da REST-ler ya koyi cewa wasu jerin buƙatu (misali, buƙatu C bayan jerin A;B) sabis ɗin ya ƙi su akai-akai, yana guje wa waɗannan haɗuwa a gwaje-gwaje na gaba, yana mai da hankalin albarkatun lissafi zuwa wurare masu ban sha'awa.

3 Aiwatar da Fasaha

3.1 Algorithm na Ƙididdigar Dogaro

Ƙididdigar dogaro tana amfani da hanyoyin na yau da kullun don kafa alaƙa tsakanin wuraren ƙarshen API. Ana iya wakiltar algorithm a cikin lissafi kamar haka:

Bari $R = \{r_1, r_2, ..., r_n\}$ ya zama saitin buƙatun API

Bari $D(r_i, r_j)$ ya wakilci alaƙar dogaro inda $r_j$ ya dogara da $r_i$

$D(r_i, r_j) = \begin{cases} 1 & \text{idan } \exists p \in \text{output}(r_i) \cap \text{input}(r_j) \\ 0 & \text{in ba haka ba} \end{cases}$

3.2 Dabarun Bincike

REST-ler yana aiwatar da dabarun bincike da yawa waɗanda aka yi wahayi ta hanyoyin gwaji na tushen samfuri:

Binciken sararin jihar API mai faɗi
Bincike mai iyaka mai zurfi tare da komawa baya
Zaɓin dabarar daidaitawa dangane da tsarin martani

Misalin Pseudo-code:

function generateTestSequence(swaggerSpec):
    dependencies = inferDependencies(swaggerSpec)
    testSequences = []
    
    for each root request in dependencies:
        sequence = [root]
        while canExtend(sequence):
            nextRequests = getValidNextRequests(sequence, dependencies)
            selected = selectNextRequest(nextRequests, strategy)
            sequence.append(selected)
        testSequences.append(sequence)
    
    return testSequences

4 Sakamakon Gwaji

4.1 Nazarin Shari'ar GitLab

An yi amfani da REST-ler don gwada GitLab, babban sabis ɗin Git mai sarrafa kansa mai buɗe ido tare da hadadden REST API. Kayan aikin ya yi nasarar gano raunoni da yawa da ba a sani ba ta hanyar gwajin tsarin API endpoints.

4.2 Ƙididdigar Gano Kurakurai

Raunin da aka Gano

Matsalolin tsaro masu mahimmanci 7

Iyakar Gwaji

94% na API endpoints an gwada su

Aiki

Sau 3 cikin sauri fiye da gwaji na hannu

5 Bincike na Asali

Ra'ayi na Manazin Masana'antu

Yanke zuwa Ga Gaske (Cutting to the Chase)

REST-ler ba wani abin wasa ne kawai na ilimi ba—shi ne kayan aikin farko da ainihin fahimtar ma'anar REST API maimakon ɗaukar endpoints a matsayin baƙaƙen akwatuna. Yayin da abokan hamayya kamar Burp Suite da OWASP ZAP ke fama da REST APIs ta hanyar amfani da dabarun binciken gidan yanar gizo na al'ada, fahimtar REST-ler na ƙayyadaddun Swagger yana ba shi fa'ida na gine-gine na asali. Ƙarfin kayan aikin na ƙididdige alaƙar ma'ana tsakanin endpoints yana wakiltar sauyin tsari a gwajin tsaron API.

Sarkar Ma'ana (Logical Chain)

Hanyar tana bin ingantacciyar ci gaba ta ma'ana: Fara da ƙayyadaddun Swagger a matsayin gaskiyar ƙasa → Ƙididdiga statically zane-zanen dogaro → Samar da jerin gwaji masu inganci → Yi amfani da ra'ayoyin dawo don inganta samfurin → Ci gaba da inganta samar da gwaji. Wannan hanya tayi kama da nasarar dabarun a wasu fagagen gwaji, musamman dabarun aiwatar da alama da aka fara a cikin kayan aiki kamar KLEE da SAGE, amma an daidaita su don ƙalubalen musamman na REST APIs. Binciken ya ginu akan ingantaccen aiki a cikin gwaji na tushen samfuri [40] da gwajin API don shirye-shiryen da suka danganci abu [27], yana ƙirƙirar hanyar haɗin gwiwa wanda ya fi adadin sassansa.

Abubuwan Haske & Rashin Haske (Highlights & Lowlights)

Abubuwan Haske: Injin ƙididdigar dogaro yana da haske—yanakan juyar da ƙayyadaddun Swagger daga takardun shaida zuwa hankali mai aiwatarwa. Nazarin shari'ar GitLab ya nuna tasiri na ainihi tare da gano raunoni masu mahimmanci da yawa. Hanyar koyan daidaitawa ta kayan aikin tana nuna ingantaccen aikace-aikacen AI fiye da sauƙaƙen daidaita tsari.

Rashin Haske: Takardar ba ta bayyana ƙarfin buƙatun lissafi na kayan aikin ba—bincika hadadden zane-zanen dogaro don manyan APIs na iya zama mai ƙarfi. Akwai ƙarancin tattaunawa game da sarrafa hanyoyin tabbacin jihohi, wata gibi mai mahimmanci ga APIs na kasuwanci. Hanyar tana ɗauka ingantattun ƙayyadaddun Swagger, waɗanda sau da yawa ba sa nuna ainihin aiwatarwar API tare da halayen da ba a rubuta su ba.

Bayyanar Aiki (Actionable Insights)

Ƙungiyoyin tsaro yakamata su haɗa hanyar REST-ler nan da nan cikin bututun gwajin API, ko da ba za su iya amfani da kayan aikin kai tsaye ba. Fahimtar cewa ƙayyadaddun Swagger sun ƙunshi hankalin gwaji da ba a yi amfani da shi ba yana canzawa. Ƙungiyoyin ci gaba yakamata su ba da fifiko ga cikakkun takardun Swagger ba kawai ga masu amfani da API ba amma don sarrafa tsaro. Yakamata masu samar da gajimare su haɗa irin wannan fasahar kai tsaye cikin dandamalolin su, suna bin jagorancin Microsoft a cikin bututun bincike-zuwa-samarwa. Fasahar tana da yuwuwar kasuwanci a sarari yayin da ƙwararrun kasuwanci ke ta gaggauta kare girmansu na yanayin API.

Idan aka kwatanta da hanyoyin fuzzing na al'ada kamar American Fuzzy Lop (AFL) ko libFuzzer, REST-ler ya nuna cewa ilimin yanki na ƙara inganta ingancin gwaji. Wannan ya yi daidai da sabbin abubuwan da suka faru a cikin tsarin fuzzing na musamman, kama da yadda TensorFuzz ke niyya ga samfuran koyon injina. Binciken ya yi hujja cewa hanyoyin fuzzing na gama gari ba su isa ga duniyar REST APIs ba, kamar yadda SECTOR ya nuna buƙatar fuzzing na hanyar sadarwa mai sanin yarjejeniya.

6 Aikace-aikacen Gaba

Hanyar REST-ler tana da babbar yuwuwar fiye da aiwatarwarta na yanzu:

Tsaron API na Kasuwanci: Haɗawa cikin bututun CI/CD don ci gaba da gwajin tsaron API
Kayan aikin Mai Samar da Gajimare: Aiwatarwa ta asali a cikin dandamali na gajimare kamar AWS da Azure
Tabaccen Ɗora API: Yin amfani da binciken dogaro don gano kurakuran ƙirar API
Gwajin Bin Ka'ida: Tabbacin bin ka'ida na atomatik na API daidai da ma'auni kamar OpenAPI
Gine-ginen Microservices: Aikace-aikace ga hadaddun yanayin microservices tare da hadaddun APIs

7 Nassoshi

Fielding, R. T. (2000). Architectural Styles and the Design of Network-based Software Architectures. Doctoral dissertation, University of California, Irvine.
OWASP ZAP Project. (2023). OWASP Zed Attack Proxy.
Burp Suite. (2023). PortSwigger Web Security.
GitLab Inc. (2023). GitLab REST API Documentation.
Swagger/OpenAPI Initiative. (2023). OpenAPI Specification.
Microsoft Research. (2018). SAGE: Whitebox Fuzzing for Security Testing.
Cadar, C., et al. (2008). KLEE: Unassisted and Automatic Generation of High-Coverage Tests for Complex Systems Programs.
American Fuzzy Lop. (2023). AFL Fuzzer.
TensorFuzz: Debugging Neural Networks with Coverage-Guided Fuzzing. (2019). ICML.
Model-Based Testing. (2010). Springer-Verlag.