parlov-elicit 0.5.0

//! `TrailingSlashElicitation` -- toggles trailing slash on both baseline and probe URL paths.
//!
//! Applies the slash-toggle transform symmetrically so the resource ID is the
//! only variable that differs across the pair. Servers that serve directly at
//! the toggled form return 200 (or another anchor) for an existing resource
//! and 404 for a nonexistent one. Complements `rd-slash-append`/`rd-slash-strip`
//! which only detect 3xx canonicalizing redirects.

use http::Method;
use parlov_core::{
    always_applicable, NormativeStrength, OracleClass, SignalSurface, Technique, Vector,
};

use crate::strategy::Strategy;
use crate::types::{ProbeSpec, RiskLevel, StrategyMetadata};
use crate::util::{substitute_url, url_pair_specs_with_canonical};
use crate::ScanContext;

static METADATA: StrategyMetadata = StrategyMetadata {
    strategy_id: "trailing-slash-elicit",
    strategy_name: "Trailing Slash Elicitation",
    risk: RiskLevel::Safe,
};

static TECHNIQUE: Technique = Technique {
    id: "trailing-slash",
    name: "Trailing slash path variation",
    oracle_class: OracleClass::Existence,
    vector: Vector::StatusCodeDiff,
    strength: NormativeStrength::May,
    normalization_weight: Some(0.08),
    inverted_signal_weight: None,
    method_relevant: false,
    parser_relevant: false,
    applicability: always_applicable,
    contradiction_surface: SignalSurface::Status,
};

/// Toggles the trailing slash on the path component of a URL, preserving the query string.
fn toggle_trailing_slash(url: &str) -> String {
    match url.split_once('?') {
        Some((path, query)) => {
            let toggled = toggle_path_slash(path);
            format!("{toggled}?{query}")
        }
        None => toggle_path_slash(url),
    }
}

/// Toggles the trailing slash on a path-only string (no `?`).
fn toggle_path_slash(path: &str) -> String {
    if path.ends_with('/') {
        path.trim_end_matches('/').to_string()
    } else {
        format!("{path}/")
    }
}

/// Elicits existence differentials by toggling the trailing slash on both baseline and probe URLs.
pub struct TrailingSlashElicitation;

impl Strategy for TrailingSlashElicitation {
    fn metadata(&self) -> &'static StrategyMetadata {
        &METADATA
    }

    fn technique_def(&self) -> &'static Technique {
        &TECHNIQUE
    }

    fn methods(&self) -> &[Method] {
        &[Method::GET, Method::HEAD]
    }

    fn is_applicable(&self, _ctx: &ScanContext) -> bool {
        true
    }

    fn generate(&self, ctx: &ScanContext) -> Vec<ProbeSpec> {
        // body_template intentionally ignored: this strategy mutates the URL, not the body.
        // The canonical baseline is the unmutated original URL; the runner dispatches it
        // alongside the mutated pair so `control_integrity` can detect slash-strict routing
        // that would otherwise produce phantom `SameStatus` Contradictory.
        let canonical_url = substitute_url(&ctx.target, &ctx.baseline_id);
        let baseline_url = toggle_trailing_slash(&canonical_url);
        let probe_url = toggle_trailing_slash(&substitute_url(&ctx.target, &ctx.probe_id));
        url_pair_specs_with_canonical(
            &baseline_url,
            &probe_url,
            &canonical_url,
            &ctx.headers,
            &METADATA,
            &TECHNIQUE,
        )
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::test_utils::minimal_ctx;
    use crate::types::ProbePair;
    use http::Method;

    fn make_ctx_with_slash() -> ScanContext {
        ScanContext {
            target: "https://api.example.com/users/{id}/".to_owned(),
            ..minimal_ctx()
        }
    }

    fn make_ctx_with_query() -> ScanContext {
        ScanContext {
            target: "https://api.example.com/users/{id}?foo=bar".to_owned(),
            ..minimal_ctx()
        }
    }

    fn find_pair_for<'a>(specs: &'a [ProbeSpec], method: &Method) -> &'a ProbePair {
        specs
            .iter()
            .find_map(|s| {
                if let ProbeSpec::Pair(p) = s {
                    if p.probe.method == *method {
                        return Some(p);
                    }
                }
                None
            })
            .expect("pair for method must exist")
    }

    #[test]
    fn risk_is_safe() {
        assert_eq!(TrailingSlashElicitation.risk(), RiskLevel::Safe);
    }

    #[test]
    fn generate_returns_two_items() {
        let specs = TrailingSlashElicitation.generate(&minimal_ctx());
        assert_eq!(specs.len(), 2);
    }

    #[test]
    fn probe_url_gains_slash_when_absent() {
        let specs = TrailingSlashElicitation.generate(&minimal_ctx());
        let pair = find_pair_for(&specs, &Method::GET);
        let probe_path: &str = pair.probe.url.split('?').next().unwrap_or(&pair.probe.url);
        assert!(probe_path.ends_with('/'), "got: {}", pair.probe.url);
    }

    #[test]
    fn baseline_url_gains_slash_when_absent() {
        let specs = TrailingSlashElicitation.generate(&minimal_ctx());
        let pair = find_pair_for(&specs, &Method::GET);
        let baseline_path: &str = pair
            .baseline
            .url
            .split('?')
            .next()
            .unwrap_or(&pair.baseline.url);
        assert!(
            baseline_path.ends_with('/'),
            "baseline must also gain trailing slash; got: {}",
            pair.baseline.url
        );
    }

    #[test]
    fn probe_url_loses_slash_when_present() {
        let specs = TrailingSlashElicitation.generate(&make_ctx_with_slash());
        let pair = find_pair_for(&specs, &Method::GET);
        let probe_path: &str = pair.probe.url.split('?').next().unwrap_or(&pair.probe.url);
        assert!(!probe_path.ends_with('/'), "got: {}", pair.probe.url);
    }

    #[test]
    fn baseline_url_loses_slash_when_present() {
        let specs = TrailingSlashElicitation.generate(&make_ctx_with_slash());
        let pair = find_pair_for(&specs, &Method::GET);
        let baseline_path: &str = pair
            .baseline
            .url
            .split('?')
            .next()
            .unwrap_or(&pair.baseline.url);
        assert!(
            !baseline_path.ends_with('/'),
            "baseline must also lose trailing slash; got: {}",
            pair.baseline.url
        );
    }

    #[test]
    fn trailing_slash_toggle_preserves_query_string() {
        let specs = TrailingSlashElicitation.generate(&make_ctx_with_query());
        for method in [Method::GET, Method::HEAD] {
            let pair = find_pair_for(&specs, &method);
            assert!(
                pair.probe.url.contains("?foo=bar"),
                "probe query must be preserved for {method}; got: {}",
                pair.probe.url
            );
            assert!(
                pair.baseline.url.contains("?foo=bar"),
                "baseline query must be preserved for {method}; got: {}",
                pair.baseline.url
            );
        }
    }

    #[test]
    fn baseline_and_probe_headers_are_identical() {
        let specs = TrailingSlashElicitation.generate(&minimal_ctx());
        for method in [Method::GET, Method::HEAD] {
            let pair = find_pair_for(&specs, &method);
            assert_eq!(
                pair.baseline.headers, pair.probe.headers,
                "headers must be byte-identical on both sides for {method}"
            );
        }
    }

    #[test]
    fn baseline_url_uses_baseline_id_probe_url_uses_probe_id() {
        let ctx = minimal_ctx();
        let specs = TrailingSlashElicitation.generate(&ctx);
        for method in [Method::GET, Method::HEAD] {
            let pair = find_pair_for(&specs, &method);
            assert!(
                pair.baseline.url.contains(&ctx.baseline_id),
                "baseline url must embed baseline_id ({}) for {method}; got {}",
                ctx.baseline_id,
                pair.baseline.url
            );
            assert!(
                pair.probe.url.contains(&ctx.probe_id),
                "probe url must embed probe_id ({}) for {method}; got {}",
                ctx.probe_id,
                pair.probe.url
            );
        }
    }

    #[test]
    fn technique_strength_is_may() {
        let specs = TrailingSlashElicitation.generate(&minimal_ctx());
        assert_eq!(specs[0].technique().strength, NormativeStrength::May);
    }

    #[test]
    fn normalization_weight_is_0_08() {
        assert_eq!(TECHNIQUE.normalization_weight, Some(0.08));
    }

    #[test]
    fn inverted_signal_weight_is_none() {
        assert_eq!(TECHNIQUE.inverted_signal_weight, None);
    }
}