Blogs (1) >>
ICSE 2019
Sat 25 - Fri 31 May 2019 Montreal, QC, Canada
Fri 31 May 2019 12:00 - 12:20 at Duluth - Fuzzing Chair(s): Marcel Böhme

This paper introduces RESTler, the first stateful REST API fuzzer. RESTler analyzes the API specification of a cloud service and generates sequences of requests that automatically test the service through its API. REST-ler generates test sequences by (1) inferring producer-consumer dependencies among request types declared in the specification (eg inferring that “a request B should be executed after request A” because B takes as an input a resource-id x produced by A) and by (2) analyzing dynamic feedback from responses observed during prior test executions in order to generate new tests (eg learning that “a request C after a request sequence A;B is refused by the service” and therefore avoiding this combination in the future).

We present experimental results showing that these two techniques are necessary to thoroughly exercise a service under test while pruning the large search space of possible request sequences. We used RESTler to test GitLab, a large open-source self-hosted Git service, as well as several Microsoft Azure and Office365 cloud services. RESTler found 28 bugs in Gitlab and several bugs in each of the Azure and Office365 cloud services tested so far. These bugs have been confirmed and fixed by the service owners.

Fri 31 May
Times are displayed in time zone: (GMT-04:00) Eastern Time (US & Canada) change

11:00 - 12:30: Papers - Fuzzing at Duluth
Chair(s): Marcel BöhmeMonash University
icse-2019-Technical-Papers11:00 - 11:20
Wei YouPurdue University, Xuwei LiuZhejiang University, Shiqing MaPurdue University, USA, David Mitchel PerryPurdue University, Xiangyu ZhangPurdue University, Bin LiangRenmin University of China, China
icse-2019-Technical-Papers11:20 - 11:40
Junjie WangNanyang Technological University, Bihuan ChenFudan University, Lei WeiNanyang Technological University, Yang LiuNanyang Technological University, Singapore
icse-2019-Technical-Papers11:40 - 12:00
Jaeseung ChoiKAIST, Joonun JangSamsung Research, Samsung Electronics, Choongwoo HanNAVER Corporation, Sang Kil ChaKAIST
icse-2019-Technical-Papers12:00 - 12:20
Vaggelis AtlidakisColumbia University, Patrice GodefroidMicrosoft Research, Marina PolishchukMicrosoft
Link to publication
icse-2019-Paper-Presentations12:20 - 12:30