Method _fuzz_parameter

modules/apisec/fuzzer.py:249–309

Fuzz a single parameter.

(
        self,
        client: httpx.AsyncClient,
        base_url: str,
        endpoint: APIEndpoint,
        param: APIParameter,
        payload: any,
        headers: dict,
        baseline: Optional[httpx.Response],
    )

            return builtin + extra

    async def _fuzz_parameter(
        self,
        client: httpx.AsyncClient,
        base_url: str,
        endpoint: APIEndpoint,
        param: APIParameter,
        payload: any,
        headers: dict,
        baseline: httpx.Response | None,
    ) -> FuzzResult:
        """Fuzz a single parameter."""
        url = urljoin(base_url, endpoint.path.replace("{", "1").replace("}", ""))

        result = FuzzResult(
            endpoint=endpoint.path,
            method=endpoint.method,
            parameter=param.name,
            payload=str(payload)[:100],  # Truncate for logging
            status_code=0,
            response_time=0.0,
        )

        try:
            # Build request based on parameter location
            kwargs = {"headers": headers}

            if param.location == "query":
                kwargs["params"] = {param.name: payload}
            elif param.location == "path":
                url = url.replace("1", str(payload))
            elif param.location == "header":
                kwargs["headers"] = {**headers, param.name: str(payload)}

            response = await client.request(
                method=endpoint.method,
                url=url,
                **kwargs,
            )

            result.status_code = response.status_code
            result.response_time = response.elapsed.total_seconds()

            # Check for anomalies
            finding = self._check_anomaly(endpoint, param, payload, response, baseline)
            if finding:
                result.anomaly = True
                result.finding = finding

        except httpx.TimeoutException:
            result.anomaly = True
            result.finding = Finding(
                title="Request Timeout on Fuzz Input",
                description=f"{endpoint.method} {endpoint.path} timed out with payload in {param.name}",
                severity=Severity.LOW,
                source="apisec.fuzzer",
                data={"parameter": param.name, "payload": str(payload)[:100]},
            )
        except Exception as e: