S3-Fuzzer: add objects to decision graph

Add objects to the fuzzer's attack surface description

diff --git a/request_decision_graph.yml b/request_decision_graph.yml
index fa13eb5e99bd1d8f86d57e958655a5ffc78d28e5..6b2fab3ad114421dc3d5945f8d8b32624698de11 100644 (file)
--- a/request_decision_graph.yml
+++ b/request_decision_graph.yml
@@ -6,8 +6,18 @@ start:
         garbage_no_whitespace:
             - '{random 10-3000 printable_no_whitespace}'
             - '{random 10-1000 binary_no_whitespace}'
+        acl_header:
+            - 'private'
+            - 'public-read'
+            - 'public-read-write'
+            - 'authenticated-read'
+            - 'bucket-owner-read'
+            - 'bucket-owner-full-control'
+            - '{random 3000 letters}'
+            - '{random 100-1000 binary_no_whitespace}'
     choices:
         - bucket
+        - object
 
 bucket:
     set:
@@ -144,17 +154,8 @@ bucket_put_create:
         body:
             - '2 {garbage}'
             - '<CreateBucketConfiguration><LocationConstraint>{random 2-10 binary}</LocationConstraint></CreateBucketConfiguration>'
-        acl:
-            - 'private'
-            - 'public-read'
-            - 'public-read-write'
-            - 'authenticated-read'
-            - 'bucket-owner-read'
-            - 'bucket-owner-full-control'
-            - '{random 3000 letters}'
-            - '{random 100-1000 binary_no_whitespace}'
     headers:
-        - ['0-1', 'x-amz-acl', '{acl}']
+        - ['0-5', 'x-amz-acl', '{acl_header}']
     choices: []
 
 bucket_put_versioning:
@@ -260,3 +261,231 @@ bucket_put_simple:
             - '<ErrorDocument><Key>{suffix}</Key></ErrorDocument>'
     choices: []
 
+object:
+    set:
+        urlpath: '/{bucket}/{object}'
+
+        range_header:
+            - null
+            - 'bytes={random 1-2 digits}-{random 1-4 digits}'
+            - 'bytes={random 1-1000 binary_no_whitespace}'
+        if_modified_since_header:
+            - null
+            - '2 {garbage_no_whitespace}'
+        if_match_header:
+            - null
+            - '2 {garbage_no_whitespace}'
+        if_none_match_header:
+            - null
+            - '2 {garbage_no_whitespace}'
+    choices:
+        - object_delete
+        - object_get
+        - object_put
+        - object_head
+        - object_garbage_method
+
+object_garbage_method:
+    set:
+        method:
+            - '{random 1-100 printable}'
+            - '{random 10-100 binary}'
+        bucket:
+            - '{bucket_readable}'
+            - '{bucket_not_readable}'
+            - '{bucket_writable}'
+            - '{bucket_not_writable}'
+            - '2 {garbage_no_whitespace}'
+        object:
+            - '{object_readable}'
+            - '{object_not_readable}'
+            - '{object_writable}'
+            - '{object_not_writable}'
+            - '2 {garbage_no_whitespace}'
+    choices:
+        - object_get_query
+        - object_get_head_simple
+
+object_delete:
+    set:
+        method: DELETE
+        bucket:
+            - '5 {bucket_writable}'
+            - '{bucket_not_writable}'
+            - '{garbage_no_whitespace}'
+        object:
+            - '{object_writable}'
+            - '{object_not_writable}'
+            - '2 {garbage_no_whitespace}'
+    choices: []
+
+object_get:
+    set:
+        method: GET
+        bucket:
+            - '5 {bucket_readable}'
+            - '{bucket_not_readable}'
+            - '{garbage_no_whitespace}'
+        object:
+            - '{object_readable}'
+            - '{object_not_readable}'
+            - '{garbage_no_whitespace}'
+    choices:
+        - 5 object_get_head_simple
+        - 2 object_get_query
+
+object_get_query:
+    set:
+        query: 
+            - 'torrent'
+            - 'acl'
+    choices: []
+
+object_get_head_simple:
+    set: {}
+    headers:
+        - ['0-1', 'range', '{range_header}']
+        - ['0-1', 'if-modified-since', '{if_modified_since_header}']
+        - ['0-1', 'if-unmodified-since', '{if_modified_since_header}']
+        - ['0-1', 'if-match', '{if_match_header}']
+        - ['0-1', 'if-none-match', '{if_none_match_header}']
+    choices: []
+
+object_head:
+    set:
+        method: HEAD
+        bucket:
+            - '5 {bucket_readable}'
+            - '{bucket_not_readable}'
+            - '{garbage_no_whitespace}'
+        object:
+            - '{object_readable}'
+            - '{object_not_readable}'
+            - '{garbage_no_whitespace}'
+    choices:
+        - object_get_head_simple
+
+object_put:
+    set:
+        method: PUT
+        bucket:
+            - '5 {bucket_writable}'
+            - '{bucket_not_writable}'
+            - '{garbage_no_whitespace}'
+        object:
+            - '{object_writable}'
+            - '{object_not_writable}'
+            - '{garbage_no_whitespace}'
+        cache_control:
+            - null
+            - '{garbage_no_whitespace}'
+            - 'no-cache'
+        content_disposition:
+            - null
+            - '{garbage_no_whitespace}'
+        content_encoding:
+            - null
+            - '{garbage_no_whitespace}'
+        content_length:
+            - '{random 1-20 digits}'
+            - '{garbage_no_whitespace}'
+        content_md5:
+            - null
+            - '{garbage_no_whitespace}'
+        content_type:
+            - null
+            - 'binary/octet-stream'
+            - '{garbage_no_whitespace}'
+        expect:
+            - null
+            - '100-continue'
+            - '{garbage_no_whitespace}'
+        expires:
+            - null
+            - '{random 1-10000000 digits}'
+            - '{garbage_no_whitespace}'
+        meta_key:
+            - null
+            - 'foo'
+            - '{garbage_no_whitespace}'
+        meta_value:
+            - null
+            - '{garbage_no_whitespace}'
+    choices:
+        - object_put_simple
+        - object_put_acl
+        - object_put_copy
+
+object_put_simple:
+    set: {}
+    headers:
+        - ['0-1', 'cache-control', '{cache_control}']
+        - ['0-1', 'content-disposition', '{content_disposition}']
+        - ['0-1', 'content-encoding', '{content_encoding}']
+        - ['0-1', 'content-length', '{content_length}']
+        - ['0-1', 'content-md5', '{content_md5}']
+        - ['0-1', 'content-type', '{content_type}']
+        - ['0-1', 'expect', '{expect}']
+        - ['0-1', 'expires', '{expires}']
+        - ['0-1', 'x-amz-acl', '{acl_header}']
+        - ['0-6', 'x-amz-meta-{meta_key}', '{meta_value}']
+    choices: []
+
+object_put_acl:
+    set:
+        query: 'acl'
+        body:
+            - null
+            - '2 {garbage}'
+            - '<AccessControlPolicy>{owner}{acl}</AccessControlPolicy>'
+        owner:
+            - null
+            - '7 <Owner>{id}{display_name}</Owner>'
+        id:
+            - null
+            - '<ID>{random 10-200 binary}</ID>'
+            - '<ID>{random 1000-3000 printable}</ID>'
+        display_name:
+            - null
+            - '2 <DisplayName>{random 10-200 binary}</DisplayName>'
+            - '2 <DisplayName>{random 1000-3000 printable}</DisplayName>'
+            - '2 <DisplayName>{random 10-300 letters}@{random 10-300 letters}.{random 2-4 letters}</DisplayName>'
+        acl:
+            - null
+            - '10 <AccessControlList><Grant>{grantee}{permission}</Grant></AccessControlList>'
+        grantee:
+            - null
+            - '7 <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">{id}{display_name}</Grantee>'
+        permission:
+            - null
+            - '7 <Permission>{permission_value}</Permission>'
+        permission_value:
+            - '2 {garbage}'
+            - FULL_CONTROL
+            - WRITE
+            - WRITE_ACP
+            - READ
+            - READ_ACP
+    headers:
+        - ['0-1', 'cache-control', '{cache_control}']
+        - ['0-1', 'content-disposition', '{content_disposition}']
+        - ['0-1', 'content-encoding', '{content_encoding}']
+        - ['0-1', 'content-length', '{content_length}']
+        - ['0-1', 'content-md5', '{content_md5}']
+        - ['0-1', 'content-type', '{content_type}']
+        - ['0-1', 'expect', '{expect}']
+        - ['0-1', 'expires', '{expires}']
+        - ['0-1', 'x-amz-acl', '{acl_header}']
+    choices: []
+
+object_put_copy:
+    set: {}
+    headers:
+        - ['1-1', 'x-amz-copy-source', '{source_object}']
+        - ['0-1', 'x-amz-acl', '{acl_header}']
+        - ['0-1', 'x-amz-metadata-directive', '{metadata_directive}']
+        - ['0-1', 'x-amz-copy-source-if-match', '{if_match_header}']
+        - ['0-1', 'x-amz-copy-source-if-none-match', '{if_none_match_header}']
+        - ['0-1', 'x-amz-copy-source-if-modified-since', '{if_modified_since_header}']
+        - ['0-1', 'x-amz-copy-source-if-unmodified-since', '{if_modified_since_header}']
+    choices: []