Merge pull request #136 from OWASP/add-path-regex-flag

add -pr flag path regex filtering

src/cmd/offat/flag.go

@@ -24,6 +24,9 @@ type FlagConfig struct {
 	QueryParams         KeyValueMap
 	Proxy               *string
 
+	// API test filter
+	PathRegex *string
+
 	// SSRF Test
 	SsrfUrl *string
 

src/cmd/offat/main.go

@@ -33,6 +33,8 @@ func main() {
 	config.DisableSchemaDefaultsValidation = flag.Bool("ds", false, "disable schema defaults validation for OAS files")
 	config.DisableSchemaPatternValidation = flag.Bool("dp", false, "disable schema patterns validation for OAS files")
 
+	config.PathRegex = flag.String("pr", "", "run tests for paths matching given regex pattern")
+
 	config.SsrfUrl = flag.String("ssrf", "", "injects user defined SSRF url payload in http request components")
 
 	config.RequestsPerSecond = flag.Int("r", 60, "number of requests per second")
@@ -124,8 +126,15 @@ func main() {
 		SsrfUrl: *config.SsrfUrl,
 	}
 
-	// generate and run api tests
+	// generate api tests
 	apiTests := apiTestHandler.GenerateTests()
+
+	// filter api tests
+	if *config.PathRegex != "" {
+		apiTests = apiTestHandler.FilterTests(apiTests, *config.PathRegex)
+	}
+
+	// run api tests
 	trunner.RunApiTests(&apiTestHandler, hc, hc.Client.FHClient, apiTests)
 	log.Info().Msgf("Total Requests: %d", len(apiTests))
 

src/pkg/tgen/tgen.go

@@ -1,6 +1,8 @@
 package tgen
 
 import (
+	"regexp"
+
 	_ "github.com/OWASP/OFFAT/src/pkg/logging"
 	"github.com/OWASP/OFFAT/src/pkg/parser"
 	"github.com/OWASP/OFFAT/src/pkg/utils"
@@ -27,6 +29,23 @@ type TGenHandler struct {
 	SsrfUrl string
 }
 
+func (t *TGenHandler) FilterTests(apiTests []*ApiTest, pathRegex string) []*ApiTest {
+	var filteredTests []*ApiTest
+	for _, apiTest := range apiTests {
+		match, err := regexp.MatchString(pathRegex, apiTest.Path)
+		if err != nil {
+			log.Error().Err(err).Msgf("Failed to match %v regex with endpoint path %v", pathRegex, apiTest.Path)
+			continue
+		}
+
+		if match {
+			filteredTests = append(filteredTests, apiTest)
+		}
+	}
+
+	return filteredTests
+}
+
 func (t *TGenHandler) GenerateTests() []*ApiTest {
 	tests := []*ApiTest{}