def test_pickle(self): original = JSONContainer(COMPLEX_OBJECT) e_headers = [('Content-Type', 'application/json')] self.assertEquals(original.get_headers(), e_headers) clone = pickle.loads(pickle.dumps(original)) self.assertEquals(original, clone) self.assertEquals(clone.get_headers(), e_headers) original = JSONContainer(COMPLEX_OBJECT) original.set_header('Content-Type', 'application/vnd.w3af+json') e_headers = [('Content-Type', 'application/vnd.w3af+json')] self.assertEquals(original.get_headers(), e_headers) clone = pickle.loads(pickle.dumps(original)) self.assertEquals(original, clone) self.assertEquals(clone.get_headers(), e_headers) original = JSONContainer(COMPLEX_OBJECT) original.set_header('X-Foo-Header', 'Bar') e_headers = [('Content-Type', 'application/json'), ('X-Foo-Header', 'Bar')] self.assertEquals(original.get_headers(), e_headers) clone = pickle.loads(pickle.dumps(original)) self.assertEquals(original, clone) self.assertEquals(clone.get_headers(), e_headers)
def test_copy_container_with_token(self): jcont = JSONContainer(ARRAY) dcc_tokens = [(dcc, token) for dcc, token in jcont.iter_bound_tokens()] dc, token = dcc_tokens[0] self.assertIsNotNone(dc.get_token()) dc_copy = copy.deepcopy(dc) self.assertIsNotNone(dc_copy.get_token())
def test_headers_immutable(self): jcont = JSONContainer(OBJECT) e_headers = [('Content-Type', 'application/json')] headers = jcont.get_headers() self.assertEquals(headers, e_headers) headers.append(('X-Foo-Header', 'Bar')) self.assertEquals(jcont.get_headers(), e_headers)
def test_object_null_value(self): jcont = JSONContainer(OBJECT_NULL) dcc_tokens = [(dcc, token) for dcc, token in jcont.iter_bound_tokens()] for dcc, token in dcc_tokens: self.assertIsInstance(dcc, JSONContainer) self.assertIsInstance(token, DataToken) self.assertIs(token, dcc.token) EXPECTED_TOKENS = [('object-key-null', None)] token_data = [(t.get_name(), t.get_value()) for dcc, t in dcc_tokens] self.assertEqual(EXPECTED_TOKENS, token_data)
def test_iter_bound_tokens_array(self): jcont = JSONContainer(ARRAY) dcc_tokens = [(dcc, token) for dcc, token in jcont.iter_bound_tokens()] for dcc, token in dcc_tokens: self.assertIsInstance(dcc, JSONContainer) self.assertIsInstance(token, DataToken) self.assertIs(token, dcc.token) EXPECTED_TOKENS = [('list-0-string', 'abc')] token_data = [(t.get_name(), t.get_value()) for dcc, t in dcc_tokens] self.assertEqual(EXPECTED_TOKENS, token_data)
def test_basic(self): jcont = JSONContainer(COMPLEX_OBJECT) dcc_tokens = [(dcc, token) for dcc, token in jcont.iter_bound_tokens()] for dcc, token in dcc_tokens: self.assertIsInstance(dcc, JSONContainer) self.assertIsInstance(token, DataToken) self.assertIs(token, dcc.token) EXPECTED_TOKENS = [('object-second_key-list-0-string', 'abc'), ('object-key-string', 'value')] token_data = [(t.get_name(), t.get_value()) for dcc, t in dcc_tokens] self.assertEqual(EXPECTED_TOKENS, token_data)
def test_wrong_headers(self): jcont = JSONContainer(COMPLEX_OBJECT) with self.assertRaises(TypeError): jcont.set_header(1, 'Foo') with self.assertRaises(TypeError): jcont.set_header('Foo', 1) with self.assertRaises(TypeError): JSONContainer(COMPLEX_OBJECT, 'Foo') with self.assertRaises(TypeError): JSONContainer(COMPLEX_OBJECT, [])
def test_array(self): json_data = JSONContainer.get_mutable_json(ARRAY) jis = [(k, v, s) for k, v, s in json_iter_setters(json_data)] self.assertEqual(len(jis), 3) k, v, s = jis[0] self.assertEqual(k, '-'.join([KEY_ARRAY, '0', KEY_STRING])) self.assertEqual(v, 'abc') self.assertTrue(callable(s)) s('xyz') payload_array = ARRAY.replace('abc', 'xyz') self.assertEqual(json_complex_str(json_data), payload_array) k, v, s = jis[1] self.assertEqual(k, '-'.join([KEY_ARRAY, '1', KEY_NUMBER])) self.assertEqual(v, 3) self.assertTrue(callable(s)) s(4.4) payload_array = payload_array.replace('3', '4.4') self.assertEqual(json_complex_str(json_data), payload_array) k, v, s = jis[2] self.assertEqual(k, '-'.join([KEY_ARRAY, '2', KEY_NUMBER])) self.assertEqual(v, 2.1) self.assertTrue(callable(s)) s(3.3) payload_array = payload_array.replace('2.1', '3.3') self.assertEqual(json_complex_str(json_data), payload_array)
def test_object(self): json_data = JSONContainer.get_mutable_json(OBJECT) jis = [(k, v, s) for k, v, s in json_iter_setters(json_data)] self.assertEqual(len(jis), 2) first_key = '-'.join([KEY_OBJECT, 'key', KEY_STRING]) k, v, s = [(k, v, s) for (k, v, s) in jis if k == first_key][0] self.assertEqual(k, first_key) self.assertEqual(v, 'value') self.assertTrue(callable(s)) s('xyz') payload_object = OBJECT.replace('"value"', '"xyz"') self.assertEqual(json.loads(json_complex_str(json_data)), json.loads(payload_object)) second_key = '-'.join([KEY_OBJECT, 'second_key', KEY_STRING]) k, v, s = [(k, v, s) for (k, v, s) in jis if k == second_key][0] self.assertEqual(k, second_key) self.assertEqual(v, 'second_value') self.assertTrue(callable(s)) s('spam') payload_object = payload_object.replace('second_value', 'spam') self.assertEqual(json.loads(json_complex_str(json_data)), json.loads(payload_object))
def test_create_mutants_9116(self): payment_data = {'transaction_amount': 100, 'reason': 'Title of what you are paying for', 'installments': 1, 'payment_method_id': 'visa', 'token': '16faba8617708', 'external_reference': '1234', 'random_anti_anti_double_click': 11577513359, 'extra_charge': None} payment_data = json.dumps(payment_data) dc = JSONContainer(payment_data) freq = FuzzableRequest(self.url, post_data=dc, method='POST') created_mutants = JSONMutant.create_mutants(freq, self.payloads, [], False, self.fuzzer_config) expected_dcs = ['{"transaction_amount": 100, "external_reference": "1234", "random_anti_anti_double_click": 11577513359, "token": "16faba8617708", "reason": "www", "installments": 1, "payment_method_id": "visa", "extra_charge": null}', '{"transaction_amount": 100, "external_reference": "1234", "random_anti_anti_double_click": 11577513359, "token": "16faba8617708", "reason": "Title of what you are paying for", "installments": 1, "payment_method_id": "xyz", "extra_charge": null}', '{"transaction_amount": 100, "external_reference": "1234", "random_anti_anti_double_click": 11577513359, "token": "www", "reason": "Title of what you are paying for", "installments": 1, "payment_method_id": "visa", "extra_charge": null}', '{"transaction_amount": 100, "external_reference": "xyz", "random_anti_anti_double_click": 11577513359, "token": "16faba8617708", "reason": "Title of what you are paying for", "installments": 1, "payment_method_id": "visa", "extra_charge": null}', '{"transaction_amount": 100, "external_reference": "1234", "random_anti_anti_double_click": 11577513359, "token": "xyz", "reason": "Title of what you are paying for", "installments": 1, "payment_method_id": "visa", "extra_charge": null}', '{"transaction_amount": 100, "external_reference": "1234", "random_anti_anti_double_click": 11577513359, "token": "16faba8617708", "reason": "xyz", "installments": 1, "payment_method_id": "visa", "extra_charge": null}', '{"transaction_amount": 100, "external_reference": "1234", "random_anti_anti_double_click": 11577513359, "token": "16faba8617708", "reason": "Title of what you are paying for", "installments": 1, "payment_method_id": "www", "extra_charge": null}', '{"transaction_amount": 100, "external_reference": "www", "random_anti_anti_double_click": 11577513359, "token": "16faba8617708", "reason": "Title of what you are paying for", "installments": 1, "payment_method_id": "visa", "extra_charge": null}'] created_dcs = [str(i.get_dc()) for i in created_mutants] created_post_datas = [i.get_data() for i in created_mutants] self.assertEqual(set(created_dcs), set(expected_dcs)) self.assertEqual(set(created_dcs), set(created_post_datas)) for m in created_mutants: m.set_token_value('abc')
def test_create_mutants_array(self): dc = JSONContainer(ARRAY) freq = FuzzableRequest(self.url, post_data=dc, method='POST') created_mutants = JSONMutant.create_mutants(freq, self.payloads, [], False, self.fuzzer_config) expected_dcs = ['["xyz", 3, 2.1]', '["www", 3, 2.1]'] created_dcs = [str(i.get_dc()) for i in created_mutants] created_post_datas = [i.get_data() for i in created_mutants] self.assertEqual(set(created_dcs), set(expected_dcs)) self.assertEqual(set(created_dcs), set(created_post_datas)) token = created_mutants[0].get_token() self.assertEqual(token.get_name(), 'list-0-string') self.assertEqual(token.get_original_value(), 'abc') token = created_mutants[1].get_token() self.assertEqual(token.get_name(), 'list-0-string') self.assertEqual(token.get_original_value(), 'abc') for m in created_mutants: self.assertIsInstance(m, JSONMutant) for m in created_mutants: self.assertEqual(m.get_method(), 'POST')
def test_create_mutants_empty_payload(self): dc = JSONContainer(COMPLEX_OBJECT) freq = FuzzableRequest(self.url, post_data=dc, method='POST') created_mutants = JSONMutant.create_mutants(freq, [''], [], False, self.fuzzer_config) for m in created_mutants: m.set_token_value('abc')
def test_iter_bound_tokens_modify_during_iter(self): jcont = JSONContainer(ARRAY) idx = None tokens = [] for idx, (dcc, token) in enumerate(jcont.iter_bound_tokens()): self.assertIsInstance(dcc, JSONContainer) self.assertIsInstance(token, DataToken) self.assertIs(token, dcc.token) token.set_value('xyz') tokens.append(token) self.assertEqual(idx, 0) EXPECTED_TOKENS = [('list-0-string', 'xyz')] token_data = [(t.get_name(), t.get_value()) for t in tokens] self.assertEqual(EXPECTED_TOKENS, token_data) self.assertEqual(str(dcc), ARRAY.replace('abc', 'xyz'))
def test_mutant_copy_9116(self): dc = JSONContainer(COMPLEX_OBJECT) freq = FuzzableRequest(self.url, post_data=dc, method='POST') created_mutants = JSONMutant.create_mutants(freq, self.payloads, [], False, self.fuzzer_config) payload = 'def' m = created_mutants[0] dc = m.get_dc() dc_copy = copy.deepcopy(dc) self.assertEqual(dc_copy.get_token(), dc.get_token()) mcopy = m.copy() token = mcopy.get_token() mcopy.set_token_value(payload) self.assertIsNotNone(m.get_token()) self.assertIsNotNone(token) self.assertEqual(mcopy.get_token_value(), payload)
def test_int(self): json_data = JSONContainer.get_mutable_json(NUMBER) jis = [(k, v, s) for k, v, s in json_iter_setters(json_data)] self.assertEqual(len(jis), 1) k, v, s = jis[0] self.assertEqual(k, KEY_NUMBER) self.assertEqual(v, 1) self.assertTrue(callable(s)) s(2) self.assertEqual(json_complex_str(json_data), '2')
def test_string(self): json_data = JSONContainer.get_mutable_json(STRING) jis = [(k, v, s) for k, v, s in json_iter_setters(json_data)] self.assertEqual(len(jis), 1) k, v, s = jis[0] self.assertEqual(k, KEY_STRING) self.assertEqual(v, 'abc') self.assertTrue(callable(s)) s('xyz') self.assertEqual(json_complex_str(json_data), '"xyz"')
def test_found_at(self): dc = JSONContainer(COMPLEX_OBJECT) freq = FuzzableRequest(self.url, post_data=dc, method='PUT') m = JSONMutant(freq) m.get_dc().set_token(('object-second_key-list-0-string', )) expected = '"http://www.w3af.com/", using HTTP method PUT.' \ ' The sent JSON-data was: "...object-second_key-list-' \ '0-string=abc..."' self.assertEqual(m.found_at(), expected) headers = m.get_headers() self.assertIn('Content-Type', headers) self.assertEqual(headers['Content-Type'], 'application/json')
def test_complex_object(self): json_data = JSONContainer.get_mutable_json(COMPLEX_OBJECT) jis = [(k, v, s) for k, v, s in json_iter_setters(json_data)] self.assertEqual(len(jis), 4) payload_complex = COMPLEX_OBJECT[:] for idx, (k, v, s) in enumerate(jis): if isinstance(v, int): new_value = idx elif isinstance(v, float): new_value = float(idx) else: new_value = str(idx) s(new_value) payload_complex = payload_complex.replace(str(v), str(new_value)) self.assertEqual(json.loads(json_complex_str(json_data)), json.loads(payload_complex))
def test_headers(self): jcont = JSONContainer(COMPLEX_OBJECT) e_headers = [('Content-Type', 'application/json')] self.assertEquals(jcont.get_headers(), e_headers) jcont.set_header('Content-Type', 'application/vnd.w3af+json') e_headers = [('Content-Type', 'application/vnd.w3af+json')] self.assertEquals(jcont.get_headers(), e_headers) jcont.set_header('X-Foo-Header', 'Bar') e_headers = [('Content-Type', 'application/vnd.w3af+json'), ('X-Foo-Header', 'Bar')] self.assertEquals(jcont.get_headers(), e_headers) headers = {'Content-Type': 'application/vnd.w3af+json', 'X-Foo-Header': 'Bar'} jcont = JSONContainer(COMPLEX_OBJECT, headers) e_headers = [('Content-Type', 'application/vnd.w3af+json'), ('X-Foo-Header', 'Bar')] self.assertEquals(jcont.get_headers(), e_headers) jcont.set_header('X-Foo-Header', '42') e_headers = [('Content-Type', 'application/vnd.w3af+json'), ('X-Foo-Header', '42')] self.assertEquals(jcont.get_headers(), e_headers) jcont = JSONContainer(COMPLEX_OBJECT, None) e_headers = [('Content-Type', 'application/json')] self.assertEquals(jcont.get_headers(), e_headers)
def test_copy_container_no_token(self): dc = JSONContainer(COMPLEX_OBJECT) dc_copy = copy.deepcopy(dc) self.assertEqual(dc, dc_copy)
def test_is_json_false(self): self.assertFalse(JSONContainer.is_json('x'))
def test_is_json_true(self): self.assertTrue(JSONContainer.is_json('1')) self.assertTrue(JSONContainer.is_json('"abc"')) self.assertTrue(JSONContainer.is_json('{"abc": 3}'))
def test_mutable_json(self): json = JSONContainer.get_mutable_json(ARRAY) self.assertIsInstance(json, MutableWrapper)
def test_headers(self): jcont = JSONContainer(COMPLEX_OBJECT) e_headers = [('Content-Type', 'application/json')] self.assertEquals(jcont.get_headers(), e_headers) jcont.set_header('Content-Type', 'application/vnd.w3af+json') e_headers = [('Content-Type', 'application/vnd.w3af+json')] self.assertEquals(jcont.get_headers(), e_headers) jcont.set_header('X-Foo-Header', 'Bar') e_headers = [('Content-Type', 'application/vnd.w3af+json'), ('X-Foo-Header', 'Bar')] self.assertEquals(jcont.get_headers(), e_headers) headers = { 'Content-Type': 'application/vnd.w3af+json', 'X-Foo-Header': 'Bar' } jcont = JSONContainer(COMPLEX_OBJECT, headers) e_headers = [('Content-Type', 'application/vnd.w3af+json'), ('X-Foo-Header', 'Bar')] self.assertEquals(jcont.get_headers(), e_headers) jcont.set_header('X-Foo-Header', '42') e_headers = [('Content-Type', 'application/vnd.w3af+json'), ('X-Foo-Header', '42')] self.assertEquals(jcont.get_headers(), e_headers) jcont = JSONContainer(COMPLEX_OBJECT, None) e_headers = [('Content-Type', 'application/json')] self.assertEquals(jcont.get_headers(), e_headers)
def test_copy(self): dc = JSONContainer(COMPLEX_OBJECT) self.assertEqual(dc, copy.deepcopy(dc))