Merge pull request #1636 from WebFuzzing/auth-issue-in-http-oracle

Auth issue in http oracle

Author: arcuri82

core/src/main/kotlin/org/evomaster/core/problem/enterprise/auth/AuthenticationInfo.kt

@@ -24,4 +24,6 @@ abstract class AuthenticationInfo(
      * this forced in [AuthSettings]
      */
     fun isDifferentFrom(other: AuthenticationInfo) = this.name != other.name
+
+    fun isNoAuth() = NoAuth::class.java.isAssignableFrom(this.javaClass)
 }

core/src/main/kotlin/org/evomaster/core/problem/enterprise/auth/NoAuth.kt

@@ -1,4 +1,9 @@
 package org.evomaster.core.problem.enterprise.auth
 
 
-interface NoAuth
+interface NoAuth{
+
+    companion object{
+        const val NAME = "NoAuth"
+    }
+}

core/src/main/kotlin/org/evomaster/core/problem/httpws/auth/AuthUtils.kt

@@ -347,7 +347,7 @@ object AuthUtils {
      * Check if we have valid credentials, but got 401
      */
      fun checkUnauthorizedWithAuth(status: Int, a: HttpWsAction) : Boolean{
-        if (status == 401 && a.auth !is NoAuth && !a.auth.requireMockHandling) {
+        if (status == 401 && !a.auth.isNoAuth() && !a.auth.requireMockHandling) {
             /*
                 if the endpoint itself is to get auth info, we might exclude auth check for it
                 eg,

core/src/main/kotlin/org/evomaster/core/problem/httpws/auth/HttpWsAuthenticationInfo.kt

@@ -2,6 +2,7 @@ package org.evomaster.core.problem.httpws.auth
 
 import org.evomaster.client.java.controller.api.dto.auth.AuthenticationDto
 import org.evomaster.core.problem.enterprise.auth.AuthenticationInfo
+import org.evomaster.core.problem.enterprise.auth.NoAuth
 import org.evomaster.core.problem.rest.data.RestCallAction
 import org.evomaster.core.search.action.Action
 
@@ -33,8 +34,7 @@ open class HttpWsAuthenticationInfo(
 
     init {
 
-        //FIXME "NoAuth" constant
-        if(headers.isEmpty() && name != "NoAuth" && endpointCallLogin==null){
+        if(headers.isEmpty() && name != NoAuth.NAME && endpointCallLogin==null){
             throw IllegalArgumentException("Missing info")
         }
     }

core/src/main/kotlin/org/evomaster/core/problem/httpws/auth/HttpWsNoAuth.kt

@@ -3,4 +3,4 @@ package org.evomaster.core.problem.httpws.auth
 import org.evomaster.core.problem.enterprise.auth.NoAuth
 
 
-class HttpWsNoAuth : HttpWsAuthenticationInfo("NoAuth", listOf(), null, false, null), NoAuth
+class HttpWsNoAuth : HttpWsAuthenticationInfo(NoAuth.NAME, listOf(), null, false, null), NoAuth

core/src/main/kotlin/org/evomaster/core/problem/rest/builder/RestIndividualSelectorUtils.kt

@@ -60,10 +60,10 @@ object RestIndividualSelectorUtils {
 
         if(authenticated != null) {
             // authenticated or not
-            if (authenticated == true && action.auth is NoAuth) {
+            if (authenticated && action.auth.isNoAuth()) {
                 return false
             }
-            if(authenticated == false && action.auth !is NoAuth) {
+            if(!authenticated && !action.auth.isNoAuth()) {
                 return false
             }
         }

core/src/main/kotlin/org/evomaster/core/problem/rest/oracle/RestSecurityOracle.kt

@@ -160,7 +160,7 @@ class RestSecurityOracle {
                     log.warn("Missing action result with id: ${it.getLocalId()}}")
                     false
                 } else {
-                    it.auth !is NoAuth && ar.getStatusCode() == 401
+                    !it.auth.isNoAuth() && ar.getStatusCode() == 401
                 }
             }
             .filter {
@@ -469,7 +469,7 @@ class RestSecurityOracle {
 
             if((a.verb == HttpVerb.PUT || a.verb == HttpVerb.PATCH || a.verb == HttpVerb.DELETE)
                 && faultyPaths.contains(a.path)
-                && a.auth is NoAuth
+                && a.auth.isNoAuth()
                 && StatusGroup.G_2xx.isInGroup(r.getStatusCode())){
 
                 // For PUT, check if it's 201 (resource creation - might be OK)
@@ -510,7 +510,7 @@ class RestSecurityOracle {
             val a = individual.seeMainExecutableActions()[index]
             val r = actionResults.find { it.sourceLocalId == a.getLocalId() } as RestCallResult
 
-            if(a.auth is NoAuth && faultyEndpoints.contains(a.getName()) &&  StatusGroup.G_2xx.isInGroup(r.getStatusCode())){
+            if(a.auth.isNoAuth() && faultyEndpoints.contains(a.getName()) &&  StatusGroup.G_2xx.isInGroup(r.getStatusCode())){
                 val scenarioId = idMapper.handleLocalTarget(
                     idMapper.getFaultDescriptiveId(DefinedFaultCategory.SECURITY_IGNORE_ANONYMOUS, a.getName())
                 )
@@ -562,7 +562,7 @@ class RestSecurityOracle {
     ): Boolean{
         verifySampleType(individual)
 
-        if(action.auth is NoAuth){
+        if(action.auth.isNoAuth()){
             return false
         }
         if((actionResults.find { it.sourceLocalId == action.getLocalId() } as RestCallResult).getStatusCode() != 401){
@@ -635,7 +635,7 @@ class RestSecurityOracle {
                  .getStatusCode())
         }.filter {
             // check if the action is not authenticated
-            it.auth is NoAuth
+            it.auth.isNoAuth()
         }
 
         return (a403.isNotEmpty() || a401.isNotEmpty()) && a2xxWithoutAuth.isNotEmpty()
@@ -684,7 +684,7 @@ class RestSecurityOracle {
 
         // Check for write operations without authentication that return 2xx
         val anonymousWriteActions = actionsWithResults.filter {
-            it.auth is NoAuth &&
+            it.auth.isNoAuth() &&
             StatusGroup.G_2xx.isInGroup((actionResults.find { r -> r.sourceLocalId == it.getLocalId() } as RestCallResult)
                 .getStatusCode())
         }

core/src/main/kotlin/org/evomaster/core/problem/rest/service/HttpSemanticsService.kt

@@ -425,10 +425,16 @@ class HttpSemanticsService : TimeBoxedPhase{
         when (k) {
             401 -> modifyCopy.auth = HttpWsNoAuth()
             403 -> {
-                val otherAuths = sampler.authentications
-                    .getAllOthers(getAction.auth.name, HttpWsAuthenticationInfo::class.java)
-                if (otherAuths.isEmpty()) return
-                modifyCopy.auth = otherAuths.first()
+                if(getAction.auth.isNoAuth()){
+                    //in theory shouldn't happen, as should get 401, but API might be faulty... or return
+                    // 403 instead of 404 on non-existing resources
+                    modifyCopy.auth = HttpWsNoAuth()
+                } else {
+                    val otherAuths = sampler.authentications
+                        .getAllOthers(getAction.auth.name, HttpWsAuthenticationInfo::class.java)
+                    if (otherAuths.isEmpty()) return
+                    modifyCopy.auth = otherAuths.first()
+                }
             }
             else -> modifyCopy.auth = getAction.auth
         }

core/src/main/kotlin/org/evomaster/core/problem/rest/service/RestSecurityBuilder.kt

@@ -1479,7 +1479,7 @@ class RestSecurityBuilder : TimeBoxedPhase {
             creationEndpoint.path
         )
         val creationAction = creationIndividual.individual.seeMainExecutableActions()[actionIndexForCreation]
-        assert(creationAction.auth !is NoAuth)
+        assert(!creationAction.auth.isNoAuth())
 
         //we don't need anything after the creation action
         val sliced = RestIndividualBuilder.sliceAllCallsInIndividualAfterAction(

core/src/main/kotlin/org/evomaster/core/problem/rpc/auth/RPCNoAuth.kt

@@ -1,6 +1,8 @@
 package org.evomaster.core.problem.rpc.auth
 
+import org.evomaster.core.problem.enterprise.auth.NoAuth
+
 /**
  * representing RPCAction without auth setup
  */
-class RPCNoAuth : RPCAuthenticationInfo("NoAuth", true,  -1)
+class RPCNoAuth : RPCAuthenticationInfo(NoAuth.NAME, true,  -1), NoAuth