I've fuzzed parts of the GitHub API. Here are my findings

Re:I've fuzzed parts of the GitHub API. Here are my findings by dtech on Wednesday November 30, 2022 @01:19PM (#33805077)

> The InvalidValuesInEnumsFieldsFuzzer will send invalid values in enum fields. It expects a validation error in return. The GitHub API does not seem to reject invalid values, but rather convert them to a default value and respond successfully to the request. This is in contradiction with the OWASP recommendation around strong input validation and data type enforcing.

Doing this is incredibly good practice for compatibility, because otherwise you can never add or remove enum values because older clients will break on the unknown values. I also fail to see how it violates the recommendation, invalid data doesn't enter the system.

Imagine all webservers and browsers would need to be updated for every new HTTP header or status code is specified or web pages don't work anymore...

[ Parent | on HN ]

Re:I've fuzzed parts of the GitHub API. Here are my findings by ludovicianul on Wednesday November 30, 2022 @01:55PM (#33805733)

As long as an API rejects invalid values if they are not part of an agreed list (but not enum), the same logic should apply for fields explicitly marked as enums. HTTP headers are not meant to be a limited set. As for the HTTP methods, it's a clear recommendation from OWASP to explicitly reject methods not supported by your API. It's like converting everything not known to POST...

[ Parent | on HN ]