parlov 0.3.0

HTTP oracle detection tool — systematic probing for RFC-compliant information leakage.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51

//! Snapshot tests for the PATCH 422/404 existence oracle output — table and JSON.
//!
//! Uses `insta` to lock the output format for the canonical PATCH oracle pattern.
//! Run `cargo insta review` after first run to accept generated snapshots.

#![deny(clippy::all)]

use bytes::Bytes;
use http::{HeaderMap, StatusCode};
use insta::assert_snapshot;
use parlov_analysis::existence::ExistenceAnalyzer;
use parlov_analysis::Analyzer;
use parlov_core::{OracleResult, ProbeSet, ResponseSurface};
use parlov_output::{render_json, render_table};

fn surface(status: u16) -> ResponseSurface {
    ResponseSurface {
        status: StatusCode::from_u16(status).expect("valid status code"),
        headers: HeaderMap::new(),
        body: Bytes::new(),
        timing_ns: 0,
    }
}

fn probe_set(baseline: u16, probe: u16) -> ProbeSet {
    ProbeSet {
        baseline: vec![surface(baseline), surface(baseline), surface(baseline)],
        probe: vec![surface(probe), surface(probe), surface(probe)],
    }
}

fn run_analyze(baseline: u16, probe: u16) -> OracleResult {
    ExistenceAnalyzer.analyze(&probe_set(baseline, probe))
}

// --- table snapshot ---

#[test]
fn snap_patch_422_vs_404_table() {
    assert_snapshot!("patch_table_422_vs_404", render_table(&run_analyze(422, 404)));
}

// --- JSON snapshot ---

#[test]
fn snap_patch_422_vs_404_json() {
    assert_snapshot!(
        "patch_json_422_vs_404",
        render_json(&run_analyze(422, 404)).expect("serialization failed")
    );
}