RESTler: Stateful REST API Fuzzing

By Vaggelis Atlidakis, Patrice Godefroid, Marina Polishchuk. International Conference on Software Engineering, 2019

298 citations recorded by the source corpus.

This paper introduces RESTler, the first stateful REST API fuzzer. RESTler analyzes the API specification of a cloud service and generates sequences of requests that automatically test the service through its API. RESTler generates test sequences by (1) inferring producer-consumer dependencies among request types declared in the specification (e.g., inferring that "a request B should be executed after request A" because B takes as an input a resource-id x produced by A) and by (2) analyzing dynamic feedback from responses observed during prior test executions in order to generate new tests (e.g., learning that "a request C after a request sequence A;B is refused by the service" and therefore avoiding this combination in the future). We present experimental results showing that these two techniques are necessary to thoroughly exercise a service under test while pruning the large search space of possible request sequences. We used RESTler to test GitLab, an open-source Git service, as well as several Microsoft Azure and Office365 cloud services. RESTler found 28 bugs in GitLab and several bugs in each of the Azure and Office365 cloud services tested so far. These bugs have been confirmed and fixed by the service owners.

Subfields: Computer Networks and Communications, Information Systems, Software

View Paper: https://www.semanticscholar.org/paper/19674c67bebb6c0e27f7882dc4100b1597e47645

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

  1. Sheng Wen
  2. Seyit Ahmet Camtepe
  3. Yang Xiang

In Information Systems

  1. Sheng Wen
  2. Seyit Ahmet Camtepe
  3. Xiaogang Zhu
  4. Yang Xiang

In Software

  1. Sheng Wen
  2. Seyit Ahmet Camtepe
  3. Xiaogang Zhu
  4. Yang Xiang

Citations in the corpus