一句话：提出 RestCT，仅依据 Swagger 规约自动建模并生成组合测试用例，覆盖操作间与参数间交互，发现 8 个新缺陷。
该文针对 RESTful API 测试中操作间交互与单个操作内输入参数交互难以系统覆盖、测试建模依赖人工的问题，提出系统且全自动的组合测试方法 RestCT。其核心是两阶段测试用例生成：首先生成受约束的序列覆盖数组，以确定可执行操作的执行顺序；随后采用自适应策略生成并精化若干受约束覆盖数组，具体化每个操作的输入参数。整个流程——包括组合测试模型的构建、操作间与参数间依赖关系的推断，以及测试用例的生成与执行——仅需给定 RESTful API 的 Swagger 规约即可完成，无需人工干预。作者在 11 个真实 RESTful API 上开展实验，验证了 RestCT 的有效性与效率，其共发现 8 个新缺陷，而当前最先进的 RESTful API 测试工具仅能触发其中 1 个。
This paper presents RestCT, a systematic and fully automatic approach that adopts Combinatorial Testing (CT) to test RESTful APIs. RestCT is systematic in that it covers and tests not only the interactions of a certain number of operations in RESTful APIs, but also the interactions of particular input-parameters in every single operation. This is realised by a novel two-phase test case generation approach, which first generates a constrained sequence covering array to determine the execution orders of available operations, and then applies an adaptive strategy to generate and refine several constrained covering arrays to concretise input-parameters of each operation. RestCT is also automatic in that its application relies on only a given Swagger specification of RESTful APIs. The creation of CT test models (especially, the inferring of dependency relationships in both operations and input-parameters), and the generation and execution of test cases are performed without any human intervention. Experimental results on 11 real-world RESTful APIs demonstrate the effectiveness and efficiency of RestCT. In particular, RestCT can find eight new bugs, where only one of them can be triggered by the state-of-the-art testing tool of RESTful APIs.
DOI 原文 ·
@inproceedings{paperbot6928,
title = {Combinatorial testing of RESTful APIs},
author = {Huayao Wu and Lixin Xu and Xintao Niu and Changhai Nie},
booktitle = {ICSE},
year = {2022},
doi = {10.1145/3510003.3510151}
}