Sqli starter #1391

omursahin · 2025-11-23T08:57:37Z

No description provided.

arcuri82 · 2025-12-01T07:49:53Z

...ng-rest-mysql/src/test/kotlin/org/evomaster/e2etests/spring/rest/sqli/SQLiMySQLBodyEMTest.kt

+            "SQLiMySQLBodyEM",
+            100
+        ) { args ->
+            setOption(args, "security", "true")


we will need an experimental EMConfig option for SQLi, which should be off by default (until we run experiments)

arcuri82 · 2025-12-01T07:53:08Z

core-tests/e2e-tests/spring/spring-rest-openapi-v3/pom.xml

+        <dependency>
+            <groupId>mysql</groupId>
+            <artifactId>mysql-connector-java</artifactId>
+        </dependency>


why are those dependencies here? they point of having separated modules for E2E for different databases was to avoid possible conflicts and configuration when starting spring (as it scans the classpath)

arcuri82 · 2025-12-01T07:58:27Z

core/src/main/kotlin/org/evomaster/core/problem/httpws/HttpWsCallResult.kt

    fun getVulnerableForSSRF() : Boolean = getResultValue(VULNERABLE_SSRF)?.toBoolean() ?: false
+
+    fun setResponseTime(responseTime: Long) = addResultValue(RESPONSE_TIME, responseTime.toString())
+    fun getResponseTime(): Long = getResultValue(RESPONSE_TIME)?.toLong() ?: 0


in case of errors, this is not going to be set (same as status code). so maybe better to return a nullable, ie, Long?

this is still returning Long instead of Long?

arcuri82 · 2025-12-01T07:59:33Z

core/src/main/kotlin/org/evomaster/core/problem/rest/oracle/RestSecurityOracle.kt

        return true
    }

+    // Simple SQLi payloads


/** */, so it gets into the documentation of the variable

arcuri82 · 2025-12-01T08:01:00Z

core/src/main/kotlin/org/evomaster/core/problem/rest/service/fitness/AbstractRestFitness.kt

+                { t, res ->
+                    rcr.setResponseTime(t)
+                },
+                {createInvocation(a, chainState, cookies, tokens).invoke()}


the createInvocation() should be not counted. rather save it to variable call, and then measure time of call.invoke()

arcuri82 · 2025-12-01T08:06:51Z

core/src/main/kotlin/org/evomaster/core/problem/rest/service/fitness/AbstractRestFitness.kt

+        actionResults: List<ActionResult>,
+        fv: FitnessValue
+    ) {
+        if (!config.isEnabledFaultCategory(DefinedFaultCategory.XSS)) {


xss??? also need a check on SQLi, which would be off by default, as still experimental.
however, maybe we should avoid long checks like:

!config.xss || !config.isEnabledFaultCategory(DefinedFaultCategory.XSS)

where the check for config.xss (and new !config.sqli) should be done inside isEnabledFaultCategory. eg something like:

fun isEnabledFaultCategory(category: FaultCategory) : Boolean{ if(category==DefinedFaultCategory.XSS && !xss){ return false; } return category !in getDisabledOracleCodesList() }

arcuri82 · 2025-12-01T08:10:50Z

core/src/main/kotlin/org/evomaster/core/problem/rest/service/fitness/AbstractRestFitness.kt

+//                continue
+//            }
+
+            if(r.getResponseTime() < config.sqlInjectionMaxResponseTimeMs && !r.getTimedout()){


this is tricky, as there might be long executing tests regardless of SQLi, and still not timingout.
first, need to check if SQLi payload is in the test.
then, likely we need a new value in RestCallResult to mark the increase in time after the payload. recall what wrote in notes.txt (if unclear, we can have a meeting about it)

arcuri82 · 2025-12-01T08:15:28Z

core/src/main/kotlin/org/evomaster/core/problem/rest/service/SecurityRest.kt

+                    val hasInvalidChars = leafGene.invalidChars.any { payload.contains(it) }
+                    if(!hasInvalidChars){
+                        // append the SQLi payload value
+                        leafGene.value = leafGene.value + payload


the gene might have length constraints. still need to validate such constraints would not break the validity. furthermore, the StringGene might not be be in use due to tainted value. might need to call getPhenotype() to make sure that leafGene.value is indeed in use

arcuri82 · 2025-12-01T08:17:12Z

core/src/main/kotlin/org/evomaster/core/problem/rest/service/SecurityRest.kt

+                copy.modifySampleType(SampleType.SECURITY)
+                copy.ensureFlattenedStructure()
+
+                val evaluatedIndividual = fitness.computeWholeAchievedCoverageForPostProcessing(copy)


here we need check the execution time before and after the injection, to see if it was successful. but, then, reexecuting the tests would lose such info :( we need to think of a way to handle this properly (i don't have an easy solution right now)

arcuri82 · 2025-12-01T08:18:53Z

core/src/main/kotlin/org/evomaster/core/EMConfig.kt


+    @Experimental
+    @Cfg("Maximum response time (in milliseconds) to consider a potential SQL Injection vulnerability.")
+    var sqlInjectionMaxResponseTimeMs = 2000


recall notes.txt, there are 2 values to handle (there called N and K)

also need experimental config parameter for SQLi, false by default

arcuri82 · 2025-12-09T09:06:49Z

core/src/main/kotlin/org/evomaster/core/problem/httpws/HttpWsCallResult.kt

    fun getVulnerableForSSRF() : Boolean = getResultValue(VULNERABLE_SSRF)?.toBoolean() ?: false
+
+    fun setResponseTime(responseTime: Long) = addResultValue(RESPONSE_TIME, responseTime.toString())
+    fun getResponseTime(): Long = getResultValue(RESPONSE_TIME)?.toLong() ?: 0


this is still returning Long instead of Long?

arcuri82 · 2025-12-09T09:07:30Z

core/src/main/kotlin/org/evomaster/core/problem/httpws/HttpWsCallResult.kt

    fun setVulnerableForSSRF(on: Boolean) = addResultValue(VULNERABLE_SSRF, on.toString())
    fun getVulnerableForSSRF() : Boolean = getResultValue(VULNERABLE_SSRF)?.toBoolean() ?: false
+
+    fun setResponseTime(responseTime: Long?) = addResultValue(RESPONSE_TIME, responseTime.toString())


why Long? as input? if it is null, this method should simply not be called. ie, input should be Long

arcuri82 · 2025-12-09T09:08:10Z

core/src/main/kotlin/org/evomaster/core/problem/httpws/HttpWsCallResult.kt

        const val TCP_PROBLEM = "TCP_PROBLEM"
        const val APPLIED_LINK = "APPLIED_LINK"
        const val LOCATION = "LOCATION"
+        const val RESPONSE_TIME = "RESPONSE_TIME"


what is the measure unit? minutes? if it is milliseconds, rename it into RESPONSE_TIME_MS (as well as getter/setter)

arcuri82 · 2025-12-09T09:09:06Z

core/src/main/kotlin/org/evomaster/core/problem/rest/data/RestCallAction.kt

        return copy
    }
-}
+    var baseResponseTime: Long? = 0


why a nullable variable is initialized with 0 instead of null?

also info about responses should NOT be in the call, but rather in the response object

arcuri82 · 2025-12-09T09:15:32Z

core/src/main/kotlin/org/evomaster/core/problem/rest/service/fitness/AbstractRestFitness.kt

+            val baseline = a.baseResponseTime
+            val afterPayload = r.getResponseTime()
+            val K = config.sqliBaselineMaxResponseTimeMs        // K: maximum allowed baseline response time
+            val N = config.sqliInjectedSleepDuration * 1000          // N: expected delay introduced by the injected sleep payload


isn't confusing that two related configs are using different time units? ie, seconds and millisecond. shouldn't both use milliseconds?

arcuri82 · 2025-12-09T09:38:42Z

core/src/main/kotlin/org/evomaster/core/problem/rest/service/SecurityRest.kt

+
+                    if(!hasInvalidChars && !hasMaxLength){
+                        // append the SQLi payload value
+                        leafGene.getPhenotype().setFromStringValue(leafGene.getPhenotype().getValueAsRawString() + String.format(payload, config.sqliInjectedSleepDuration))


setFromStringValue returns false if it fails to update

arcuri82 · 2025-12-09T09:40:10Z

core/src/main/kotlin/org/evomaster/core/problem/rest/service/SecurityRest.kt

+                val evaluatedIndividual = fitness.computeWholeAchievedCoverageForPostProcessing(copy)
+
+                if (evaluatedIndividual == null) {
+                    log.warn("Failed to evaluate constructed individual in handleStackTraceCheck")


handleStackTraceCheck???

arcuri82 · 2025-12-09T09:44:40Z

core/src/main/kotlin/org/evomaster/core/problem/rest/service/SecurityRest.kt

+                if(!anySuccess){
+                    continue
+                }
+                actionCopy.baseResponseTime = responseTime


this approach is hacky, and would not work if test is re-evaluated for any reason. i think we need a singleton, in which we keep track, for each action, the min/mean/max exection time during the search (and NOT during security phase). then, when we need a baseline, we query the singleton.

arcuri82 · 2025-12-09T09:45:35Z

core/src/main/kotlin/org/evomaster/core/EMConfig.kt

+
+    @Experimental
+    @Cfg("Injected sleep duration (in seconds) used inside the malicious payload to detect time-based vulnerabilities.")
+    var sqliInjectedSleepDuration = 5


be consistent with time units

arcuri82 · 2025-12-09T09:48:30Z

docs/options.md

 |`saveMockedResponseAsSeparatedFile`| __Boolean__. Whether to save mocked responses as separated files. *Default value*: `false`.|
 |`saveScheduleTaskInvocationAsSeparatedFile`| __Boolean__. Whether to save schedule task invocation as separated files. *Default value*: `false`.|
 |`saveTargetHeuristicsPrefixes`| __String__. Prefix specifying which targets to record. Each target can be separated by a comma, such as 'Branch,Line,Success, etc'. It is only used when processFormat is TARGET_HEURISTIC. *Default value*: `Branch`.|
 |`seedTestCases`| __Boolean__. Whether to seed EvoMaster with some initial test cases. These test cases will be used and evolved throughout the search process. *Default value*: `false`.|


let's not forget about generated test cases (in Java/Kotlin/Python/Javascript) need to then log the execution time (eg startTime-endTime) and assert it is more than N. but best to do it in a new PR after this one is merged

omursahin and others added 8 commits November 16, 2025 14:05

sqli starter application

6104b9c

sqli payload

3852b06

time record

06e9d5b

sqli-mysql

74617b3

Merge branch 'master' into sqli-starter

aebc334

postgres

7729b7c

Merge branch 'master' into sqli-starter

671ba90

import fix

09142fc

omursahin requested a review from arcuri82 November 26, 2025 19:19

arcuri82 requested changes Dec 1, 2025

View reviewed changes

omursahin and others added 10 commits December 2, 2025 20:38

Merge branch 'master' into sqli-starter

edf9a0a

sqli updates

b0b178a

doc

712c89c

new config parameters for sqli

f0a82ac

n-k update

a60108e

doc

e0536c3

doc fix

b8db90b

remove h2 payloads

a7237cd

update payloads

0a2f389

remove h2

01c4a99

omursahin requested a review from arcuri82 December 9, 2025 07:57

arcuri82 requested changes Dec 9, 2025

View reviewed changes

Sqli starter #1391

Are you sure you want to change the base?

Sqli starter #1391

Uh oh!

Conversation

omursahin commented Nov 23, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants