Function test_batch_abuse

tests/security/test_api_vulnerabilities.py:310–353

Test batch command abuse

(tester)

def test_batch_abuse(tester):
    """Test batch command abuse"""
    print("\n[*] Testing batch command abuse...")

    with SerialStudioClient() as client:
        # Test 1: Huge batch request
        print("  - Testing oversized batch (10000 commands)...")
        huge_batch = [{"command": "api.getCommands"} for _ in range(10000)]

        try:
            start = time.time()
            results = client.batch(huge_batch, timeout=30.0)
            elapsed = time.time() - start

            # Check if server rejected the batch (error dict returned)
            if isinstance(results, dict) and results.get("error"):
                print(f"    Server rejected batch: {results.get('message')} (GOOD)")
            elif isinstance(results, list) and len(results) > 0:
                tester.log_vulnerability(
                    "MEDIUM",
                    "Batch Processing",
                    f"Server processed {len(results)} commands in {elapsed:.2f}s without limit",
                    f"{len(huge_batch)} commands",
                )
            else:
                print("    Server rejected batch (GOOD)")
        except (APIError, TimeoutError) as e:
            print(f"    Server rejected or timed out: {e} (GOOD)")

        # Test 2: Nested batch requests (if possible)
        print("  - Testing recursive batch commands...")
        try:
            # Try to create recursive structure
            recursive_batch = [
                {
                    "command": "project.loadJson",
                    "params": {"config": {"title": f"Level-{i}"}},
                }
                for i in range(100)
            ]
            results = client.batch(recursive_batch)
            print(f"    Processed {len(results)} nested commands")
        except (APIError, TimeoutError):
            print("    Rejected (GOOD)")


def test_connection_exhaustion(tester):