parlov-elicit 0.1.1

Elicitation engine: strategy selection and probe plan generation for parlov.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142

//! `ContentTypeElicitation` — probes with an invalid `Content-Type` header.
//!
//! Sends `Content-Type: application/x-invalid` on the probe request while the
//! baseline uses `ctx.headers` unmodified. A server that responds differently
//! (e.g. 415 vs 422, or 415 vs 404) reveals resource existence through
//! content-type validation ordering — existing resources fail type-checking
//! before existence-checking in many implementations.

use http::Method;

use crate::strategy::Strategy;
use crate::types::{ProbeSpec, RiskLevel, StrategyMetadata};
use crate::util::{build_pair, clone_headers_with, json_body};
use crate::ScanContext;

fn metadata() -> StrategyMetadata {
    StrategyMetadata {
        strategy_id: "content-type-elicit",
        strategy_name: "Content-Type Elicitation",
        risk: RiskLevel::MethodDestructive,
    }
}

/// Elicits existence differentials via an invalid `Content-Type` header on probe requests.
pub struct ContentTypeElicitation;

impl Strategy for ContentTypeElicitation {
    fn id(&self) -> &'static str {
        "content-type-elicit"
    }

    fn name(&self) -> &'static str {
        "Content-Type Elicitation"
    }

    fn risk(&self) -> RiskLevel {
        RiskLevel::MethodDestructive
    }

    fn methods(&self) -> &[Method] {
        &[Method::POST, Method::PUT, Method::PATCH]
    }

    fn is_applicable(&self, _ctx: &ScanContext) -> bool {
        true
    }

    fn generate(&self, ctx: &ScanContext) -> Vec<ProbeSpec> {
        let body = Some(json_body(&[]));
        let mut specs = Vec::with_capacity(3);
        for method in [Method::POST, Method::PUT, Method::PATCH] {
            let baseline_headers = ctx.headers.clone();
            let probe_headers =
                clone_headers_with(&ctx.headers, "content-type", "application/x-invalid");
            let pair = build_pair(
                ctx,
                method,
                baseline_headers,
                probe_headers,
                body.clone(),
                metadata(),
            );
            specs.push(ProbeSpec::Pair(pair));
        }
        specs
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use http::{HeaderMap, Method};

    fn make_ctx() -> ScanContext {
        ScanContext {
            target: "https://api.example.com/users/{id}".to_string(),
            baseline_id: "1001".to_string(),
            probe_id: "9999".to_string(),
            headers: HeaderMap::new(),
            max_risk: RiskLevel::MethodDestructive,
            known_duplicate: None,
            state_field: None,
            alt_credential: None,
        }
    }

    #[test]
    fn risk_is_method_destructive() {
        assert_eq!(ContentTypeElicitation.risk(), RiskLevel::MethodDestructive);
    }

    #[test]
    fn methods_contains_post_put_patch() {
        let methods = ContentTypeElicitation.methods();
        assert_eq!(methods.len(), 3);
        assert!(methods.contains(&Method::POST));
        assert!(methods.contains(&Method::PUT));
        assert!(methods.contains(&Method::PATCH));
    }

    #[test]
    fn is_applicable_always_true() {
        assert!(ContentTypeElicitation.is_applicable(&make_ctx()));
    }

    #[test]
    fn generate_returns_three_items() {
        assert_eq!(ContentTypeElicitation.generate(&make_ctx()).len(), 3);
    }

    #[test]
    fn all_items_are_pair_variants() {
        for spec in &ContentTypeElicitation.generate(&make_ctx()) {
            assert!(matches!(spec, ProbeSpec::Pair(_)));
        }
    }

    #[test]
    fn probe_has_invalid_content_type() {
        let specs = ContentTypeElicitation.generate(&make_ctx());
        let ProbeSpec::Pair(pair) = &specs[0] else { panic!("expected Pair") };
        assert_eq!(
            pair.probe.headers.get("content-type").unwrap(),
            "application/x-invalid"
        );
    }

    #[test]
    fn baseline_lacks_invalid_content_type() {
        let specs = ContentTypeElicitation.generate(&make_ctx());
        let ProbeSpec::Pair(pair) = &specs[0] else { panic!("expected Pair") };
        assert!(pair.baseline.headers.get("content-type").is_none());
    }

    #[test]
    fn both_baseline_and_probe_have_body() {
        let specs = ContentTypeElicitation.generate(&make_ctx());
        let ProbeSpec::Pair(pair) = &specs[0] else { panic!("expected Pair") };
        assert!(pair.baseline.body.is_some());
        assert!(pair.probe.body.is_some());
    }
}