Web services often impose constraintsthat restrict the way in which
two or more input parameters can be combined to form valid calls
to the service, i.e. inter-parameter dependencies. Current web API
specification languages like the OpenAPI Specification (OAS) pro vide no support for the formal description of such dependencies,
making it hardly possible to interact with the services without
human intervention. We propose specifying and automatically ana lyzing inter-parameter dependencies in web APIs. To this end, we
propose a domain-specific language to describe these dependencies,
a constraint programming-aided tool supporting their automated
analysis, and an OAS extension integrating our approach and eas ing its adoption. Together, these contributions open a new range of
possibilities in areas such as source code generation and testin

Atlidakis V.

Cacciagrano D.

Gao C.

Koster De

Martin-Lopez A.

Xu L.

English

Crossref

Automated analysis of inter-parameter dependencies in web APIs

Martín López, Alberto

idUS. Depósito de Investigación Universidad de Sevilla

Automated Analysis of Inter-Parameter        Dependencies in Web APIs Alberto Martin-LopezUniversidad de SevillaABSTRACTWeb services often impose constraints that restrict the way in whichtwo or more input parameters can be combined to form valid callsto the service, i.e. inter-parameter dependencies. Current web APIspecification languages like the OpenAPI Specification (OAS) pro-vide no support for the formal description of such dependencies,making it hardly possible to interact with the services withouthuman intervention. We propose specifying and automatically ana-lyzing inter-parameter dependencies in web APIs. To this end, wepropose a domain-specific language to describe these dependencies,a constraint programming-aided tool supporting their automatedanalysis, and an OAS extension integrating our approach and eas-ing its adoption. Together, these contributions open a new range ofpossibilities in areas such as source code generation and testing.KEYWORDS:Web service,DSL,interdependency,CSP,automated analysis1 RESEARCH PROBLEM AND MOTIVATIONWeb APIs enable the consumption of services and data over thenetwork, and they are heavily used nowadays for integrating dis-tributed and heterogeneous systems. This is reflected in the sizeof popular API directories such as ProgrammableWeb [11], whichcurrently indexes over 22K web APIs. Modern web APIs usually fol-low the REST architectural style [20], being referred to as RESTfulweb APIs. RESTful APIs can be described using languages such asthe OpenAPI Specification (OAS) [9], which has arguably become∗Work supported by the European Commission (FEDER) and Spanish Government under projects BELI (TIN2015-70560-R) and HORATIO (RTI2018-101204-B-C21), andby the Spanish Ministry of Education under FPU scholarship (FPU17/04077).an industry standard. An OAS document describes a RESTful APIin terms of the elements it consists of, namely paths, operations,resources, request parameters and API responses. It is both human-and machine-readable, making it possible to automatically generate,for instance, documentation, source code or even basic test cases.Web APIs often present inter-parameter dependencies, i.e. con-straints that restrict the way in which two or more input parameterscan be combined to form valid calls to the service. For instance, inthe YouTube API [15], when using the parameter videoDefinition(e.g. to search videos in high definition) the type parameter mustbe set to ‘video’, otherwise a HTTP 400 code (bad request) is re-turned. Current API specification languages such as OAS or RAML[12] provide no support for the description of these dependencies.For example, the OAS documentation states [10]: “OpenAPI 3.0does not support parameter dependencies and mutually exclusive pa-rameters. (...) What you can do is document the restrictions in theparameter description and define the logic in the 400 Bad Requestresponse”. This makes it hardly possible to interact with the serviceswithout human intervention. For example, it would be extremelydifficult, possibly infeasible, to automatically generate test casesfor the YouTube API without an explicit and machine-readable def-inition of its dependencies. We recently conducted an exhaustivereview of 40 web APIs and more than 2.5K operations [22], andfound that inter-parameter dependencies are extremely common inpractice, being present in 85% of the APIs analyzed. In addition, weclassified all the dependencies into a catalogue of seven differentpatterns. Industry has shown great interest in this issue, as reflectedin an open feature request in OAS entitled “Support interdependen-cies between query parameters”, created in January 2015. To date,it has received 250 votes and 51 comments from 32 participants [4].In this paper, we present an approach to automatically analyzeinter-parameter dependencies in web APIs. We propose a set oftools, including a domain-specific language (DSL) for the specifi-cation of dependencies, an extension for the OAS language, anda constraint programming-aided tool supporting the automatedanalysis of dependencies. We have a prototype of the tool and haveevaluated its usefulness with a case study on the YouTube web API:we automatically generated 100 times more valid test cases than arandom approach, thanks to the management of dependencies.2 BACKGROUND AND RELATEDWORKWu et al. [25] presented an approach for the automated inference ofinter-parameter dependencies in web services. Oostvogels et al. [23]proposed a DSL for the description of inter-parameter dependen-cies in OAS. Other authors [18, 21, 26] have partially addressed thisissue in other type of web services such as WSDL [2] or OWL-S [1],technologies in disuse nowadays. In the context of testing, currentapproaches [16, 17, 19, 24] do not handle inter-parameter depen-dencies and therefore show limited applicability in practice. Ourwork is the first to attack the root of the problem, with a thoroughstudy of 40 web APIs, and so the conclusions derived from it differfrom others (e.g. the DSL from [23] does not support all depen-dency types from our catalogue). More importantly, our solutionis the first to fully address both the specification and automatedanalysis of inter-parameter dependencies. It is also technology- andspecification-independent, meaning that it can be integrated intoany web API design framework or specification language.3 APPROACHFigure 1 depicts the proposed approach. First, dependencies are de-scribed using Inter-parameter Dependency Language (IDL), a novelDSL designed for the specification of inter-parameter dependenciesin web APIs. Then, IDL dependencies are mapped to a constraintsatisfaction problem (CSP), using a constraint modeling languagesuch as MiniZinc [8]. The CSP must also contain the informationabout the parameters and their domains, this is extracted fromthe API specification (e.g. an OAS document). Finally, a catalogueof analysis operations can be run on the resulting CSP, therebyallowing the automated analysis of dependencies.Our proposal opens a new range of specification-driven applica-tions in web APIs. For example, API gateways could automaticallyreject requests violating dependencies, without even redirecting thecall to the corresponding service, saving time and user quota. Testcase generators could automatically generate valid test cases (thosesatisfying all inter-parameter dependencies) rather than using bruteforce or writing specific input grammars for each API under test.Source code generators could generate web API clients includingbuilt-in assertions to deal with invalid input combinations. Therange of new applications is promising.4 RESULTS AND CONTRIBUTIONSNext, we describe the current results and expected contributions.State of practice. Fully understanding how dependencies arisein practice is essential for the design of a DSL that can be used toformally express all types of dependencies. To address this issue, weperformed a survey on 2,557 operations from 40 APIs, constitutingthe largest systematic review on the presence of inter-parameterdependencies in web APIs [22]. As a result, we managed to classifyall dependencies identified (over 600) into seven general patterns.Domain-specific language. We propose IDL [7], a DSL for thespecification of dependencies among input parameters in web APIs.IDL has been designed to express the seven types of dependencypatterns found in our review of industrial APIs. It is specification-independent, meaning that it can be integrated into any existingAPI specification language (e.g. OAS, RAML and WSDL). This hasenabled the creation of IDL4OAS, an OAS extension supporting thedescription of dependencies in this language. A sample IDL4OASdocument is available on [3]. IDL is implemented with Xtext [14], apopular framework for the development of programming languagesand DSLs. We have also developed an editor and a parser for IDL,facilitating its integration in other tools. The IDL grammar is avail-able on [3]. As an example, Listing 1 depicts the IDL specificationof the dependencies in the Google Maps Places API [5].Automated analysis. We propose translating IDL specifica-tions to CSPs. The proposed IDL-to-CSP mapping is available onFigure 1: Proposed approach.[3]. Then, the CSP can be leveraged to automatically extract in-formation from IDL specifications through a catalogue of analysisoperations using state-of-the-art CSP solvers. So far, we have iden-tified eight operations (see Figure 1), and these are implementedin IDLReasoner (available on GitHub [6]), a MiniZinc-based Javalibrary supporting the integration of our approach in any exter-nal project. Among others, IDLReasoner can automatically checkwhether a given API request satisfies all dependencies (operationisValidRequest), whether a given parameter is dead and thereforecannot be selected due to inconsistencies in the specification (op-eration isDeadParameter), or it can even generate random validrequests satisfying all dependencies (operation randomRequest).For example, consider the following request to the Search opera-tion of the Google Maps API (Listing 1, lines 2-4): {location=0,0;rankby=distance}. IDLReasoner identified the request as invalidin 71 milliseconds, since it violates dependency in line 3, i.e. ifrankby equals ‘distance’, then keyword, name or type must beset. An API gateway supporting this operation could reject requestslike this (and much more complex ones) without even calling the ac-tual service, saving time and user quota, and making service-basedapplications more reliable.1 // Operation 1: Search for places within specified area:2 ZeroOrOne(radius , rankby =='distance ');3 IF rankby =='distance ' THEN keyword OR name OR type;4 maxprice >= minprice;5 // Operation 2: Query information about places:6 AllOrNone(location , radius);7 Or(query , type);8 maxprice >= minprice;9 // Operation 3: Get photo of place:10 OnlyOne(maxheight , maxwidth);11 // Operation 4: Automcomplete place name:12 IF strictbounds THEN location AND radius;Listing 1: IDL dependencies in the Google Maps Places API.Evaluation. Our current efforts focus on evaluating the devel-oped tools in terms of correctness, expressiveness and performance.In order to show the potential of our approach, we assessed theusefulness of the tool for testing purposes with a case study on theYouTube web API. Its search operation [13] presents dependenciesin 25 out of 31 parameters. We generated test cases using 26 of them,discarding others that are still unsupported by our tool (e.g. datescomparison). Two test suites of 100 test cases each were automati-cally generated, the first with a random approach and the secondwith IDLReasoner. The random approach generated only one validrequest (i.e. a request obtaining a 200 status code in the response),while with IDLReasoner all requests were valid. Both test suitesand the execution results are available on [3]. Additionally, we suc-ceeded to find conformance errors in the form of dependencies notdescribed in the documentation (e.g. if the parameter channelTypeis used, the type parameter must be set to ‘channel’).REFERENCES[1] 2004. Semantic Markup for Web Services (OWL-S). https://www.w3.org/Submission/OWL-S/[2] 2007. Web Services Description Language (WSDL) Version 2.0. https://www.w3.org/TR/wsdl20/[3] 2019. Additional material of the paper. https://github.com/isa-group/ICSE-2020-SRC---Supplementary-material[4] 2019. GitHub issue in the OpenAPI repository: “Support interdependencies betweenquery parameters”. https://github.com/OAI/OpenAPI-Specification/issues/256[5] 2019. Google Maps Places API. https://developers.google.com/places/web-service/intro[6] 2019. IDLReasoner. https://github.com/isa-group/IDLReasoner[7] 2019. Inter-parameter Dependency Language (IDL). https://github.com/isa-group/IDL[8] 2019. MiniZinc: Constraint Modeling Language. https://www.minizinc.org/[9] 2019. OpenAPI Specification. https://www.openapis.org[10] 2019. Parameter dependencies in OAS. https://swagger.io/docs/specification/describing-parameters/#dependencies[11] 2019. ProgrammableWeb. https://www.programmableweb.com[12] 2019. RESTful API Modeling Language (RAML). https://raml.org[13] 2019. Search operation of the YouTube API. https://developers.google.com/youtube/v3/docs/search/list[14] 2019. Xtext. https://www.eclipse.org/Xtext/[15] 2019. YouTube API. https://developers.google.com/youtube/v3/docs[16] A. Arcuri. 2019. RESTful API Automated Test Case Generation with EvoMaster.ACM Trans. on Software Engineering and Methodology 28, 1 (2019), 3.[17] V. Atlidakis, P. Godefroid, and M. Polishchuk. 2019. RESTler: Stateful REST APIFuzzing. In Intern. Conference on Software Engineering. 748–758.[18] D. Cacciagrano, F. Corradini, R. Culmone, and L. Vito. 2006. Dynamic Constraint-based Invocation of Web Services. In 3rd Intern. Workshop on Web Services andFormal Methods. 138–147.[19] H. Ed-douibi, J.L.C. Izquierdo, and J. Cabot. 2018. Automatic Generation ofTest Cases for REST APIs: A Specification-Based Approach. In IEEE 22nd Intern.Enterprise Distributed Object Computing Conference. 181–190.[20] R. T. Fielding. 2000. Architectural Styles and the Design of Network-based SoftwareArchitectures. Ph.D. Dissertation.[21] C. Gao, J. Wei, H. Zhong, and T. Huang. 2014. Inferring Data Contract forWeb-based API. In IEEE Intern. Conference on Web Services. 65–72.[22] A. Martin-Lopez, S. Segura, and A. Ruiz-Cortés. 2019. A Catalogue of Inter-Parameter Dependencies in RESTful Web APIs. In Intern. Conference on Service-Oriented Computing. 399–414.[23] Oostvogels, N., De Koster, J., De Meuter, W. 2017. Inter-parameter Constraints inContemporaryWeb APIs. In 17th Intern. Conference onWeb Engineering. 323–335.[24] S. Segura, J.A. Parejo, J. Troya, and A. Ruiz-Cortés. 2018. Metamorphic Testing ofRESTful Web APIs. IEEE Trans. on Software Engineering 44, 11 (2018), 1083–1099.[25] Qian Wu, Ling Wu, Guangtai Liang, Qianxiang Wang, Tao Xie, and Hong Mei.2013. Inferring Dependency Constraints on Parameters for Web Services. InProceedings of the 22nd Intern. Conference on World Wide Web. 1421–1432.[26] L. Xu, Q. Yuan, J. Wu, and C. Liu. 2009. Ontology-based Web Service RobustnessTest Generation. In IEEE Intern. Symp. on Web Systems Evolution. 59–68.

https://idus.us.es/bitstream/11441/133636/1/Automated%20Analysis%20of%20Inter-Parameter%20Dependencies%20in%20Web%20APIs.pdf

Automated analysis of inter-parameter dependencies in web APIs

Abstract

Similar works

Full text

Available Versions

Crossref

idUS. Depósito de Investigación Universidad de Sevilla