Fuzzing checks don't handle MultiPartBody correctly resulting in an exception
Problem
When fuzzing an API request with a multi-part body that contains a part with a body of TextBody<StringBody> the GenericFuzzingCheck is incorrectly performing work.
This results in an invalid cast exception which in turn terminates the testing job.
04:48:37.662 [DBG] <Peach.Web.Core.Services.WebRunnerMachine> Fatal error while processing work items
System.AggregateException: One or more errors occurred. (Unable to cast object of type 'System.Byte[]' to type 'System.String'.)
---> System.InvalidCastException: Unable to cast object of type 'System.Byte[]' to type 'System.String'.
at Peach.Web.Core.Models.Variant.op_Implicit(Variant v) in /builds/gitlab-org/security-products/analyzers/api-fuzzing-src/web/PeachWeb/Core/Models/Variant.cs:line 50
at Peach.Web.Core.Services.StringBody.StringElement.set_MutatedValue(Variant value) in /builds/gitlab-org/security-products/analyzers/api-fuzzing-src/web/PeachWeb/Core/Services/StringBody.cs:line 27
at Peach.Pro.Core.Mutators.Utility.StringBomLength.performMutation(DataElement obj, Int64 value) in /builds/gitlab-org/security-products/analyzers/api-fuzzing-src/pro/Core/Mutators/Utility/StringBomLength.cs:line 43
at Peach.Web.Core.Checks.FuzzingCheck`1.<>c__DisplayClass40_0.<MutationCheck>b__4(WebContext ctx, Int32 index) in /builds/gitlab-org/security-products/analyzers/api-fuzzing-src/web/PeachWeb/Core/Checks/FuzzingCheck.cs:line 309
at Peach.Web.Core.Services.WebRunnerCheckStrategy.ApplyMutation(String testCaseName, PrivateExchange exchange) in /builds/gitlab-org/security-products/analyzers/api-fuzzing-src/web/PeachWeb/Core/Services/WebRunnerCheckStrategy.cs:line 1100
at Peach.Web.Core.Services.WebRunnerCheckStrategy.PerformSingleMutationOnRequest(String testName, Exchange recordedExchange, Operation operation, Request request, RouteWithChecks routeWithChecks, Func`3 sendRequest, MutationContext mutationContext, Action`1 collectHttpMessageStats, CancellationToken token) in /builds/gitlab-org/security-products/analyzers/api-fuzzing-src/web/PeachWeb/Core/Services/WebRunnerCheckStrategy.cs:line 574
at Peach.Web.Core.Services.WebRunnerCheckStrategy.PerformMutationCheckWork(Object stateObject, CancellationToken token) in /builds/gitlab-org/security-products/analyzers/api-fuzzing-src/web/PeachWeb/Core/Services/WebRunnerCheckStrategy.cs:line 495
--- End of inner exception stack trace ---
at System.Threading.Tasks.Task.ThrowIfExceptional(Boolean includeTaskCanceledExceptions)
at System.Threading.Tasks.Task.Wait(Int32 millisecondsTimeout, CancellationToken cancellationToken)
at Peach.Web.Core.Services.WebRunnerMachine.Run(IRunnerOptions runnerOptions, CancellationToken token)
04:48:37.670 [ERR] <Peach.Web.Core.Services.WebRunnerMachine> * Session failed: Unable to cast object of type 'System.Byte[]' to type 'System.String'.
This is a customer reported issue.
Proposal
Update all of the fuzzing checks IsSupported methods to properly handle multi-part bodies. When a multi-part body if found, the part's body that corresponds with the parameter should be checked instead of the operation body.
All of the fuzzing checks, with the exception of formdata, are affected.
Edited by Michael Eddington