A Black Box Tool for Robustness Testing of REST Services

作     者：Laranjeiro, Nuno Agnelo, Joao Bernardino, Jorge 

作者机构：Univ Coimbra Ctr Informat & Syst Dept Informat Engn P-3030290 Coimbra Portugal Polytech Coimbra Coimbra Inst Engn ISEC P-3030199 Coimbra Portugal 

出 版 物：《IEEE ACCESS》 (IEEE Access)

年 卷 期：2021年第9卷

页      面：24738-24754页

核心收录：

基　　金：national funds through the FCT - Foundation for Science and Technology, I.P. [UID/CEC/00326/2020] European Social Fund, through the Regional Operational Program Centro 2020 European Union project MobiWise [P2020SAICTPAC/0011/2015] COMPETE 2020, Portugal 2020 - Operational Program for Competitiveness and Internationalization (POCI), European Union's ERDF (European Regional Development Fund) Portuguese Foundation for Science and Technology (FCT) European Regional Development Fund (FEDER), through the Regional Operational Programme of Lisbon (POR LISBOA 2020) Competitiveness and Internationalization Operational Programme (COMPETE 2020) of the Portugal 2020 framework [024539 (POCI-01-0247-FEDER-024539)] TalkConnect project "Voice Architecture over Distributed Network'' [POCI-01-0247-FEDER-039676] European Regional Development Fund, through Portugal 2020 (PT2020) Competitiveness and Internationalization Operational Programme (COMPETE 2020) 

主　　题：Robustness Tools Testing Simple object access protocol Security Europe Servers REST RESTful web API web services robustness testing 

摘      要：REST services are nowadays being used to support many businesses, with most major companies exposing their services via REST interfaces (e.g., Google, Amazon, Instagram, and Slack). In this type of scenarios, heterogeneity is prevalent and software is sometimes exposed to unexpected conditions that may activate residual bugs, leading service operations to fail. Such failures may lead to financial or reputation losses (e.g., information disclosure). Although techniques and tools for assessing robustness have been thoroughly studied and applied to a large diversity of domains, REST services still lack practical approaches that specialize in robustness evaluation. In this paper, we present a tool (named bBOXRT) for performing robustness tests over REST services, solely based on minimal information expressed in their interface descriptions. We used bBOXRT to evaluate an heterogeneous set of 52 REST services that comprise 1,351 operations and fit in distinct categories (e.g., public, private, in-house). We were able to disclose several different types of robustness problems, including issues in services with strong reliability requirements and also a few security vulnerabilities. The results show that REST services are being deployed preserving software defects that harm service integration, and also carrying security vulnerabilities that can be exploited by malicious users.