api-tester 1.0.0 → 1.1.3

data/lib/api-tester/modules/good_variations.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+require 'api-tester/reporter/status_code_report'
+require 'api-tester/method_case_test'
+
+module ApiTester
+  # Checks the good case as defined in contract
+  module GoodVariations
+    def self.go(contract)
+      reports = []
+
+      contract.endpoints.each do |endpoint|
+        endpoint.methods.each do |method|
+          method.request.fields.each do |field|
+            field.good_cases.each do |value|
+              payload = method.request.default_payload
+              payload[field.name] = value
+              call = BoundaryCase.new description: contract.base_url + endpoint.display_url,
+                                      payload: payload,
+                                      headers: method.request.default_headers
+              response = endpoint.call base_url: contract.base_url,
+                                       method: method,
+                                       payload: payload,
+                                       headers: call.headers
+              test = GoodVariationTest.new response: response,
+                                           url: contract.base_url + endpoint.url,
+                                           method: method
+              reports.concat test.check
+            end
+          end
+          method.request.query_params.each do |field|
+            field.good_cases.each do |value|
+              payload = method.request.default_payload
+              payload[field.name] = value
+              call = BoundaryCase.new description: contract.base_url + endpoint.display_url,
+                                      payload: payload,
+                                      headers: method.request.default_headers
+              response = endpoint.call base_url: contract.base_url,
+                                       method: method,
+                                       payload: payload,
+                                       headers: call.headers
+              test = GoodVariationTest.new response: response,
+                                           url: contract.base_url + endpoint.url,
+                                           method: method
+              reports.concat test.check
+            end
+          end
+        end
+      end
+      reports
+    end
+
+    def self.order
+      1
+    end
+  end
+
+  # Test layout used by module
+  class GoodVariationTest < MethodCaseTest
+    def initialize(response:, url:, method:)
+      super response: response,
+            payload: method.request.default_payload,
+            expected_response: method.expected_response,
+            url: url,
+            verb: method.verb,
+            module_name: 'GoodVariationsModule'
+    end
+  end
+end

data/lib/api-tester/modules/injection_module.rb

@@ -1,29 +1,39 @@
-require "injection_vulnerability_library"
+# frozen_string_literal: true
+
+require 'injection_vulnerability_library'
 
 module ApiTester
+  # Tests injection cases
   module InjectionModule
-    def self.go contract
+    def self.go(contract)
       reports = []
       contract.endpoints.each do |endpoint|
         endpoint.methods.each do |method|
-          reports.concat inject_payload endpoint, method
+          reports.concat inject_payload contract.base_url, endpoint, method
         end
       end
       reports
     end
 
-    def self.inject_payload endpoint, method
+    def self.inject_payload(base_url, endpoint, method)
       reports = []
       sql_injections = InjectionVulnerabilityLibrary.sql_vulnerabilities
 
       method.request.fields.each do |field|
         sql_injections.each do |injection|
-          injection_value = "#{field.default_value}#{injection}"
-          payload = method.request.altered_payload(field.name, injection_value)
-          response = endpoint.call method, payload, method.request.default_headers          
-          if(!check_response(response, endpoint)) then
-            reports << InjectionReport.new("sql", endpoint.url, payload, response)
-          end
+          injection_value = "#{field.default}#{injection}"
+          payload = method.request.altered_payload field_name: field.name,
+                                                   value: injection_value
+          response = endpoint.call base_url: base_url,
+                                   method: method,
+                                   payload: payload,
+                                   headers: method.request.default_headers
+          next if check_response(response, endpoint)
+
+          reports << InjectionReport.new('sql',
+                                         endpoint.url,
+                                         payload,
+                                         response)
         end
       end
 
@@ -31,25 +41,36 @@ module ApiTester
     end
 
     def self.check_response(response, endpoint)
-      response.code == 200 || check_error(response, endpoint)
+      if response.code == 200 || check_error(response, endpoint)
+        print '.'
+        return true
+      end
+      print 'F'
+      false
     end
 
-    def self.check_error response, endpoint
-      evaluator = ApiTester::ResponseEvaluator.new response.body, endpoint.bad_request_response
+    def self.check_error(response, endpoint)
+      evaluator = ApiTester::ResponseEvaluator.new(
+        actual_body: response.body,
+        expected_fields: endpoint.bad_request_response
+      )
       missing_fields = evaluator.missing_fields
       extra_fields = evaluator.extra_fields
-      response.code == endpoint.bad_request_response.code && missing_fields.size == 0 && extra_fields.size == 0
+      response.code == endpoint.bad_request_response.code &&
+        missing_fields.size.zero? && extra_fields.size.zero?
+    end
+
+    def self.order
+      5
     end
   end
 end
 
+# Report for InjectionModule
 class InjectionReport
-  attr_accessor :injection_type
-  attr_accessor :url
-  attr_accessor :payload
-  attr_accessor :response
+  attr_accessor :injection_type, :url, :payload, :response
 
-  def initialize injection_type, url, payload, response
+  def initialize(injection_type, url, payload, response)
     self.injection_type = injection_type
     self.url = url
     self.payload = payload
@@ -57,10 +78,10 @@ class InjectionReport
   end
 
   def print
-    puts "Found potential #{self.injection_type}: "
-    puts "   Requested #{self.url} with payload:"
-    puts "      #{self.payload}"
+    puts "Found potential #{injection_type}: "
+    puts "   Requested #{url} with payload:"
+    puts "      #{payload}"
     puts '   Received: '
-    puts "      #{self.response}"
+    puts "      #{response}"
   end
 end

data/lib/api-tester/modules/missing_resource.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+require 'api-tester/reporter/status_code_report'
+require 'api-tester/util/supported_verbs'
+
+module ApiTester
+  # Module checking various not found scenarios
+  module MissingResource
+    def self.go(contract)
+      reports = []
+
+      contract.endpoints.each do |endpoint|
+        endpoint.path_params.each do |path_param|
+          bad_resource = endpoint.relative_url.gsub("{#{path_param}}", 'gibberish')
+
+          bad_endpoint = ApiTester::Endpoint.new name: 'Bad Resource',
+                                                 relative_url: bad_resource
+          method = ApiTester::Method.new verb: ApiTester::SupportedVerbs::GET,
+                                         response: ApiTester::Response.new(
+                                           status_code: 200
+                                         ),
+                                         request: ApiTester::Request.new
+          response = bad_endpoint.call base_url: contract.base_url + bad_resource,
+                                       method: method,
+                                       payload: {},
+                                       headers: contract.required_headers
+          test = MissingResourceTest.new response,
+                                         {},
+                                         endpoint.not_found_response,
+                                         bad_resource,
+                                         ApiTester::SupportedVerbs::GET
+          test.check
+        end
+      end
+
+      reports
+    end
+
+    def self.allowed_verbs(endpoint)
+      allowances = []
+      endpoint.methods.each do |method|
+        allowances << method.verb
+      end
+      allowances.uniq
+    end
+
+    def self.order
+      4
+    end
+  end
+
+  # Test layout for Missing Resource
+  class MissingResourceTest < MethodCaseTest
+    def initialize(response, payload, expected_response, url, verb)
+      super response: response,
+            payload: payload,
+            expected_response: expected_response,
+            url: url,
+            verb: verb,
+            module_name: 'Missing Resource'
+    end
+  end
+end

data/lib/api-tester/modules/required_fields.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+module ApiTester
+  # Ensures the fields marked as required in contract are guarded
+  module RequiredFields
+    def self.go(contract)
+      reports = []
+      contract.endpoints.each do |endpoint|
+        endpoint.methods.each do |method|
+          request_def = method.request
+          required_fields = request_def.fields.keep_if(&:required)
+          combinations = (1..required_fields.size).flat_map { |size| required_fields.combination(size).to_a }
+          combinations.each do |remove_fields|
+            fields = remove_fields.map do |field|
+              { name: field.name, value: nil }
+            end
+            payload = request_def.altered_payload_with fields
+            response = endpoint.call base_url: contract.base_url,
+                                     method: method,
+                                     payload: payload,
+                                     headers: request_def.default_headers
+            test = RequiredFieldsTest.new response: response,
+                                          payload: payload,
+                                          expected_response: endpoint.bad_request_response,
+                                          url: endpoint.url,
+                                          verb: method.verb
+            reports.concat test.check
+          end
+        end
+      end
+
+      reports
+    end
+
+    def self.order
+      5
+    end
+  end
+
+  # Test layout used for RequiredFieldsModule
+  class RequiredFieldsTest < MethodCaseTest
+    def initialize(response:, payload:, expected_response:, url:, verb:)
+      super response: response,
+            payload: payload,
+            expected_response: expected_response,
+            url: url,
+            verb: verb,
+            module_name: 'RequiredFieldsModule'
+    end
+  end
+end

data/lib/api-tester/modules/server_information.rb

@@ -1,15 +1,17 @@
-require 'pry'
+# frozen_string_literal: true
 
 module ApiTester
+  # Module for ensuring the server isn't broadcasting information about itself
   module ServerInformation
-    def self.go contract
+    def self.go(contract)
       reports = []
       endpoint = contract.endpoints[0]
-      response = endpoint.default_call
+      response = endpoint.default_call contract.base_url
 
-      [:server, :x_powered_by, :x_aspnetmvc_version, :x_aspnet_version].each do |server_key|
-        if response.headers[server_key] then
-          reports << ServerBroadcastReport.new(response.headers[server_key], server_key)
+      %i[server x_powered_by x_aspnetmvc_version x_aspnet_version].each do |key|
+        if response.headers[key]
+          reports << ServerBroadcastReport.new(response.headers[key],
+                                               key)
         end
       end
 
@@ -22,18 +24,18 @@ module ApiTester
   end
 end
 
+# Report used by module
 class ServerBroadcastReport
-  attr_accessor :server_info
-  attr_accessor :server_key
+  attr_accessor :server_info, :server_key
 
-  def initialize server_info, server_key
+  def initialize(server_info, server_key)
     self.server_info = server_info
     self.server_key = server_key
   end
 
   def print
-    puts "Found server information being broadcast in headers:"
-    puts "   #{self.server_info}"
-    puts "     as #{self.server_key}"
+    puts 'Found server information being broadcast in headers:'
+    puts "   #{server_info}"
+    puts "     as #{server_key}"
   end
 end

data/lib/api-tester/modules/typo.rb

@@ -1,35 +1,54 @@
+# frozen_string_literal: true
+
 require 'api-tester/reporter/status_code_report'
 require 'api-tester/util/supported_verbs'
 
 module ApiTester
-  class Typo
-    def self.go contract
+  # Module checking various not found scenarios
+  module Typo
+    def self.go(contract)
       reports = []
 
-      contract.endpoints.each do |endpoint|
-        allowances(endpoint).each do |verbs|
-            reports.concat check_typo_url(endpoint)
+      # Filtering out endpoints with ids since not a better way to check this
+      # Need to redesign system to handle this better
+      contract.endpoints.reject { |e| e.relative_url.include?('{') }.each do |endpoint|
+        allowances(endpoint).each do
+          reports.concat check_typo_url(contract.base_url, endpoint)
         end
       end
 
       reports
     end
 
-    def self.check_typo_url endpoint
+    def self.check_typo_url(base_url, endpoint)
       bad_url = "#{endpoint.url}gibberishadsfasdf"
-      bad_endpoint = ApiTester::Endpoint.new "Bad URL", bad_url
-      typo_case = BoundaryCase.new("Typo URL check", {}, {})
-      method = ApiTester::Method.new ApiTester::SupportedVerbs::GET, ApiTester::Response.new(200), ApiTester::Request.new
-      response = bad_endpoint.call method, typo_case.payload, typo_case.headers
+      bad_endpoint = ApiTester::Endpoint.new name: 'Bad URL',
+                                             relative_url: bad_url
+      typo_case = BoundaryCase.new description: 'Typo URL check',
+                                   payload: {},
+                                   headers: {}
+      method = ApiTester::Method.new verb: ApiTester::SupportedVerbs::GET,
+                                     response: ApiTester::Response.new(
+                                       status_code: 200
+                                     ),
+                                     request: ApiTester::Request.new
+      response = bad_endpoint.call base_url: base_url,
+                                   method: method,
+                                   payload: typo_case.payload,
+                                   headers: typo_case.headers
 
-      test = TypoClass.new response, typo_case.payload, endpoint.not_found_response, bad_url, ApiTester::SupportedVerbs::GET
+      test = TypoClass.new response,
+                           typo_case.payload,
+                           endpoint.not_found_response,
+                           bad_url,
+                           ApiTester::SupportedVerbs::GET
       test.check
     end
 
     def self.allowances(endpoint)
       allowances = []
       endpoint.methods.each do |method|
-          allowances << method.verb
+        allowances << method.verb
       end
       allowances.uniq
     end
@@ -39,9 +58,15 @@ module ApiTester
     end
   end
 
+  # Test layout for TypoModule
   class TypoClass < MethodCaseTest
-    def initialize response, payload, expected_response, url, verb
-      super response, payload, expected_response, url, verb, "TypoModule"
+    def initialize(response, payload, expected_response, url, verb)
+      super response: response,
+            payload: payload,
+            expected_response: expected_response,
+            url: url,
+            verb: verb,
+            module_name: 'TypoModule'
     end
   end
 end

data/lib/api-tester/modules/unexpected_fields.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+module ApiTester
+  # Module checking nothing shows up in response which is not defined in contract
+  module UnexpectedFields
+    def self.go(contract)
+      reports = []
+
+      contract.endpoints.each do |endpoint|
+        endpoint.methods.each do |method|
+          default_case = BoundaryCase.new description: endpoint.url,
+                                          payload: method.request.default_payload,
+                                          headers: method.request.default_headers
+          response = endpoint.call base_url: contract.base_url,
+                                   method: method,
+                                   payload: default_case.payload,
+                                   headers: default_case.headers
+          test = UnexpectedFieldsTest.new response, endpoint.url, method
+          reports.concat test.check
+        end
+      end
+      reports
+    end
+
+    def self.order
+      90
+    end
+  end
+
+  # Test layout for UnexpectedFields module
+  class UnexpectedFieldsTest < MethodCaseTest
+    def initialize(response, url, method)
+      super response: response,
+            payload: method.request.default_payload,
+            expected_response: method.expected_response,
+            url: url,
+            verb: method.verb,
+            module_name: 'UnexpectedFieldsModule'
+    end
+
+    def check
+      evaluator = ApiTester::ResponseEvaluator.new actual_body: json_parse(response.body),
+                                                   expected_fields: expected_response
+      response_fields = evaluator.response_field_array
+      expected_fields = evaluator.expected_fields
+      increment_fields evaluator.seen_fields
+      extra = response_fields - expected_fields
+      extra.each do |extra_field|
+        report = Report.new description: "UnexpectedFieldsModule - Found unexpected field #{extra_field}",
+                            url: url,
+                            request: payload,
+                            expected_response: expected_response,
+                            actual_response: response
+        reports << report
+      end
+      reports
+    end
+  end
+end

data/lib/api-tester/modules/unused_fields.rb

@@ -1,16 +1,22 @@
-require 'api-tester/reporter/missing_response_field_report'
+# frozen_string_literal: true
+
+require 'api-tester/reporter/missing_field_report'
 
 module ApiTester
-  class UnusedFields
-    def self.go contract
+  # Ensures all fields defined in contract are returned during test suite
+  module UnusedFields
+    def self.go(contract)
       reports = []
 
       contract.endpoints.each do |endpoint|
         endpoint.methods.each do |method|
-          method.expected_response.body.each do |field|
-            if field.is_seen == 0
-              reports << MissingResponseFieldReport.new(endpoint.url, method.verb, field.name, "UnusedFieldsModule")
-            end
+          method.expected_response.body.filter(&:has_key).each do |field|
+            next unless field.is_seen.zero?
+
+            reports << MissingFieldReport.new(url: endpoint.url,
+                                              verb: method.verb,
+                                              expected_field: field.name,
+                                              description: 'UnusedFieldsModule')
           end
         end
       end

data/lib/api-tester/reporter/api_report.rb

@@ -1,6 +1,9 @@
+# frozen_string_literal: true
+
 require 'api-tester/reporter/report'
 
 module ApiTester
+  # class for dealing with reports generated by the modules during test suite
   class ApiReport
     attr_accessor :reports
 
@@ -8,31 +11,37 @@ module ApiTester
       self.reports = []
     end
 
-    def add_new url, request, expected_response, actual_response, description="A case"
-      report = Report.new description, url, request, expected_response, actual_response
-      self.reports << report
+    def add_new(url:, request:, expected_response:, actual_response:, description: 'case')
+      report = Report.new description,
+                          url,
+                          request,
+                          expected_response,
+                          actual_response
+      reports << report
     end
 
-    def add_new_report report
-      self.reports << report
+    def add_new_report(report)
+      reports << report
     end
 
-    def add_reports reports
-      self.reports.concat reports
+    def add_reports(reports)
+      reports.each do |report|
+        add_new_report(report)
+      end
     end
 
     def print
-      if self.reports.size > 0
-        puts "Issues discovered: #{self.reports.size}"
-        self.reports.each do |report|
+      puts ''
+      if reports.size.zero?
+        puts 'No issues found'
+      else
+        puts "Issues discovered: #{reports.size}"
+        reports.each do |report|
           report.print
-          puts "\n"
-          puts "\n"
+          puts ''
+          puts ''
         end
-        puts ""
-        puts "Issues discovered: #{self.reports.size}"
-      else
-        puts "No issues found"
+        puts "Total issues: #{reports.size}"
       end
     end
   end

data/lib/api-tester/reporter/missing_field_report.rb

@@ -1,25 +1,21 @@
-module ApiReport
+# frozen_string_literal: true
+
+module ApiTester
+  # Report used for when response is missing a field
   class MissingFieldReport
-    attr_accessor :description
-    attr_accessor :url
-    attr_accessor :request
-    attr_accessor :expected_field
-    attr_accessor :actual_response
+    attr_accessor :url, :verb, :expected_field, :description
 
-    def initialize(description, url, request, expected_field)
-      self.description = description
+    def initialize(url:, verb:, expected_field:, description:)
       self.url = url
-      self.request = request
+      self.verb = verb
       self.expected_field = expected_field
-      self.actual_response = ''
+      self.description = description
     end
 
     def print
-      puts "#{self.description}: "
-      puts "   Requested #{self.url} with payload:"
-      puts "      #{self.request}"
-      puts '   Missing field: '
-      puts "      #{self.expected_field}"
+      puts "#{description}:"
+      puts "   #{verb} #{url} is missing response field:"
+      puts "      #{expected_field}"
     end
   end
 end

data/lib/api-tester/reporter/report.rb

@@ -1,12 +1,11 @@
+# frozen_string_literal: true
+
 module ApiTester
+  # Standard report format for differing responses
   class Report
-    attr_accessor :description
-    attr_accessor :url
-    attr_accessor :request
-    attr_accessor :expected_response
-    attr_accessor :actual_response
+    attr_accessor :description, :url, :request, :expected_response, :actual_response
 
-    def initialize description, url, request, expected_response, actual_response
+    def initialize(description:, url:, request:, expected_response:, actual_response:)
       self.description = description
       self.url = url
       self.request = request
@@ -15,13 +14,13 @@ module ApiTester
     end
 
     def print
-      puts "#{self.description}: "
-      puts "   Requested #{self.url} with payload:"
-      puts "      #{self.request.to_json}"
-      puts "   Expecting: "
-      puts "      " + self.expected_response.to_s
-      puts "   Receiving: "
-      puts "      #{self.actual_response}"
+      puts "#{description}: "
+      puts "   Requested #{url} with payload:"
+      puts "      #{request.to_json}"
+      puts '   Expecting: '
+      puts "      #{expected_response}"
+      puts '   Receiving: '
+      puts "      #{actual_response}"
     end
   end
 end