Add '-validation-server=...' option to test detected endpoints against automatically

Author: tylercamp

src/com/denimgroup/threadfix/cli/endpoints/EndpointMain.java

@@ -28,8 +28,10 @@
 
 import com.denimgroup.threadfix.data.entities.RouteParameter;
 import com.denimgroup.threadfix.data.entities.RouteParameterType;
+import com.denimgroup.threadfix.data.entities.WildcardEndpointPathNode;
 import com.denimgroup.threadfix.data.enums.FrameworkType;
 import com.denimgroup.threadfix.data.interfaces.Endpoint;
+import com.denimgroup.threadfix.data.interfaces.EndpointPathNode;
 import com.denimgroup.threadfix.framework.engine.framework.FrameworkCalculator;
 import com.denimgroup.threadfix.framework.engine.full.EndpointDatabase;
 import com.denimgroup.threadfix.framework.engine.full.EndpointDatabaseFactory;
@@ -46,7 +48,9 @@
 import org.codehaus.jackson.map.ObjectMapper;
 
 import java.io.File;
+import java.io.FileNotFoundException;
 import java.io.IOException;
+import java.net.UnknownHostException;
 import java.util.Collection;
 import java.util.List;
 import java.util.Map;
@@ -74,6 +78,8 @@ enum Logging {
     static int totalDetectedEndpoints = 0;
     static int totalDetectedParameters = 0;
 
+    static String testUrlPath = null;
+
     private static void println(String line) {
         if (printFormat != SIMPLE_JSON && printFormat != FULL_JSON) {
             System.out.println(line);
@@ -326,6 +332,9 @@ private static boolean checkArguments(String[] args) {
                         path = path.substring(0, path.length() - 1);
                     }
                     pathListFile = path;
+                } else if (arg.startsWith("-validation-server=")) {
+                    String[] parts = arg.split("=");
+                    testUrlPath = parts[1];
                 } else {
                     println("Received unsupported option " + arg + ", valid arguments are -lint, -debug, -simple-json, -json, -path-list-file, and -simple");
                     return false;
@@ -446,6 +455,46 @@ private static List<Endpoint> listEndpoints(File rootFile, Collection<FrameworkT
             println("Failed to validate serialization for at least one of these endpoints");
         }
 
+        if (testUrlPath != null) {
+            EndpointTester tester = new EndpointTester(testUrlPath);
+
+            println("Testing endpoints against server at: " + testUrlPath);
+
+            List<Endpoint> successfulEndpoints = list();
+            List<Endpoint> failedEndpoints = list();
+            List<Endpoint> allEndpoints = EndpointUtil.flattenWithVariants(endpoints);
+            for (Endpoint endpoint : allEndpoints) {
+                boolean skip = false;
+                for (EndpointPathNode node : endpoint.getUrlPathNodes()) {
+                    if (node.getClass().equals(WildcardEndpointPathNode.class)) {
+                        skip = true;
+                        break;
+                    }
+                }
+
+                if (skip) {
+                    continue;
+                }
+
+                try {
+                    tester.test(endpoint);
+                    successfulEndpoints.add(endpoint);
+                } catch (FileNotFoundException | UnknownHostException e) {
+                    failedEndpoints.add(endpoint);
+                } catch (IOException e) {
+                    if (e.getMessage().contains("HTTP")) {
+                        successfulEndpoints.add(endpoint);
+                    }
+                }
+            }
+
+            for (Endpoint endpoint : failedEndpoints) {
+                println("Failed: " + endpoint.getUrlPath() + "[" + endpoint.getHttpMethod() + "]");
+            }
+
+            println(successfulEndpoints.size() + "/" + (successfulEndpoints.size() + failedEndpoints.size()) + " endpoints were queryable");
+        }
+
         int numMissingStartLine = 0;
         int numMissingEndLine = 0;
         int numSameLineRange = 0;

src/com/denimgroup/threadfix/cli/endpoints/EndpointTester.java

@@ -0,0 +1,27 @@
+package com.denimgroup.threadfix.cli.endpoints;
+
+import com.denimgroup.threadfix.data.interfaces.Endpoint;
+import com.denimgroup.threadfix.framework.util.PathUtil;
+
+import java.io.IOException;
+import java.net.HttpURLConnection;
+import java.net.MalformedURLException;
+import java.net.URL;
+import java.net.URLConnection;
+
+public class EndpointTester {
+    String basePath;
+
+    public EndpointTester(String basePath) {
+        this.basePath = basePath;
+    }
+
+    public int test(Endpoint endpoint) throws IOException {
+        URL url = new URL(PathUtil.combine(this.basePath, endpoint.getUrlPath()));
+        HttpURLConnection conn = (HttpURLConnection)url.openConnection();
+        conn.setRequestMethod(endpoint.getHttpMethod());
+
+        conn.getInputStream().close();
+        return conn.getResponseCode();
+    }
+}