feat: added tests for multiple coupon redemptions and ratings race condition by Kaustavoffx · Pull Request #302 · akto-api-security/tests-library

Kaustavoffx · 2026-04-27T17:24:36Z

No description provided.

…st to detect multiple ratings via race condition (akto-api-security#174) Introduced a new test for multiple ratings submission via race condition, assessing if an attacker can exploit concurrency issues to submit multiple ratings.

Copilot

Pull request overview

Adds two new Akto test definitions intended to detect race-condition vulnerabilities that allow repeated coupon redemption and repeated ratings/likes submissions.

Changes:

Introduces a new BOLA test for detecting multiple coupon redemptions via race conditions.
Introduces a new (currently miscategorized) test for detecting multiple ratings/likes submissions via race conditions.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 12 comments.

File	Description
Broken-Object-Level-Authorization/coupon_race_condition.yaml	New test template targeting concurrent coupon redemption behavior.
Broken-Function-Level-Authorization/multiple_ratings_race_condition.yaml	New test template targeting concurrent ratings/likes submission behavior.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-27T17:30:09Z

+    name: BOLA
+    shortName: BOLA
+    displayName: Business Logic
+  subCategory: MULTIPLE_RATINGS


subCategory should match the test id (convention used across the repo, e.g. BFLAwithGETMethod.yml:15). Here id is MULTIPLE_RATINGS_RACE_CONDITION but subCategory is MULTIPLE_RATINGS, which can break lookups/deduping. Rename subCategory to MULTIPLE_RATINGS_RACE_CONDITION.

Suggested change

subCategory: MULTIPLE_RATINGS

subCategory: MULTIPLE_RATINGS_RACE_CONDITION

Copilot · 2026-04-27T17:30:09Z

+    gte: 200
+    lt: 300
+  method:
+    neq: "GET"


api_selection_filters.method uses neq: "GET", which will still include OPTIONS endpoints (commonly 204/2xx) and can cause this test to run against preflight routes that don't accept bodies/ratings. In this repo, tests consistently exclude OPTIONS (e.g. BFLAwithGETMethod.yml:40-43). Consider changing this filter to exclude OPTIONS (and optionally exclude GET as well if needed).

Suggested change

neq: "GET"

not_in:

- "GET"

- "OPTIONS"

Copilot · 2026-04-27T17:30:09Z

+execute:
+  type: single
+  requests:
+    - req:
+        - modify_body_param:
+            couponParam: "AKTO_FREE_100"
+    - req:
+        - modify_body_param:
+            couponParam: "AKTO_FREE_100"
+


execute.type is single but requests contains multiple req entries. In this repo, type: single tests use exactly one request, and multiple requests are modeled with type: multiple (see BFLAInsertAdminURLPaths.yml:56-76). If the intent is to fire multiple requests for a race-condition simulation, please switch to the supported execution type for multiple requests (or confirm the engine supports multiple req blocks under single).

Copilot · 2026-04-27T17:30:10Z

+    gte: 200
+    lt: 300
+  method:
+    neq: "GET"


api_selection_filters.method uses neq: "GET", which will still allow OPTIONS (commonly 2xx/204) and can cause this test to be selected for preflight routes where modifying the body doesn’t apply. Other BOLA templates exclude OPTIONS (e.g. AddUserId.yaml:46-48). Consider excluding OPTIONS (and, if desired, also excluding GET).

Suggested change

neq: "GET"

regex: "^(?!(GET|OPTIONS)$).+"

Copilot · 2026-04-27T17:30:10Z

+    - Business Logic
+    - OWASP API3
+    - E-commerce
+    - Race Condition


The info section is missing standard metadata that all other BOLA tests include (references, cwe, cve, and attributes; see Broken-Object-Level-Authorization/AddUserId.yaml:20-37). Adding these fields improves consistency and makes findings easier to triage.

Suggested change

- Race Condition

- Race Condition

references:

- "https://owasp.org/API-Security/editions/2023/en/0x11-t10/"

- "https://cwe.mitre.org/data/definitions/362.html"

cwe:

- "CWE-362"

cve: []

attributes: {}

Copilot · 2026-04-27T17:30:11Z

+  tags:
+    - Business Logic
+    - OWASP API3
+    - Race Condition


The info block is missing standard metadata present in other tests in this category (e.g. references, cwe, cve, and attributes in Broken-Function-Level-Authorization/BFLAInsertAdminURLPaths.yml:21-32). Adding these fields keeps the test library consistent and makes the generated report more actionable.

Suggested change

- Race Condition

- Race Condition

references:

- "https://owasp.org/API-Security/editions/2019/en/0xa6-mass-assignment/"

- "https://cwe.mitre.org/data/definitions/362.html"

cwe:

- "CWE-362"

cve: []

attributes:

race-condition: true

authenticated: true

business-logic: true

Copilot · 2026-04-27T17:30:11Z

+  category:
+    name: BOLA
+    shortName: BOLA
+    displayName: Business Logic


category.displayName is set to Business Logic, but in the BOLA library it is consistently Broken Object Level Authorization (BOLA) (e.g. Broken-Object-Level-Authorization/AddUserId.yaml:10-14). Using a different display name can break category grouping in the UI/reports; align the category fields with the existing BOLA templates.

Suggested change

displayName: Business Logic

displayName: Broken Object Level Authorization (BOLA)

Copilot · 2026-04-27T17:30:11Z

+    - Business Logic
+    - OWASP API3
+    - E-commerce
+    - Race Condition


tags values here don’t follow the repository’s established tagging conventions (Business logic, OWASP top 10, HackerOne top 10 etc.; see AddUserId.yaml:16-20). Inconsistent tag casing/labels (e.g. Business Logic, OWASP API3) can fragment filtering and reporting; please align tags with existing patterns or add the new taxonomy consistently across the library.

Suggested change

- Business Logic

- OWASP API3

- E-commerce

- Race Condition

- Business logic

- OWASP top 10

- E-commerce

Copilot · 2026-04-27T17:30:11Z

+    - Business Logic
+    - OWASP API3


tags uses Business Logic / OWASP API3, which differs from the tag set used elsewhere in this repo (Business logic, OWASP top 10, HackerOne top 10; e.g. BFLAwithGETMethod.yml:17-20). If tags are used for grouping/filtering, please align these values to the existing convention or introduce the new tag taxonomy consistently across all tests.

Suggested change

- Business Logic

- OWASP API3

- Business logic

- OWASP top 10

Copilot · 2026-04-27T17:30:12Z

+api_selection_filters:
+  response_code:
+    gte: 200
+    lt: 300
+  method:
+    neq: "GET"
+  request_payload:
+    for_one:
+      key:
+        regex: "^(coupon|promo|discount|voucher|code)$"
+        extract: "couponParam"
+


api_selection_filters here is much less restrictive than other tests in this repo (typically they also constrain method to exclude OPTIONS and filter on response_payload/response_headers to avoid selecting error/HTML responses; e.g. Broken-Object-Level-Authorization/AddUserId.yaml:42-76). Without similar filters, this test is more likely to be applied to irrelevant endpoints and generate noisy results. Consider adding the same baseline response/header guards used elsewhere.

Kaustavoffx added 2 commits April 27, 2026 22:24

feat: added test to detect multiple coupon redemptions via race condi…

9110d1d

…tion (akto-api-security#175)

Copilot AI review requested due to automatic review settings April 27, 2026 17:24

Copilot started reviewing on behalf of Kaustavoffx April 27, 2026 17:25 View session

Copilot AI reviewed Apr 27, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: added tests for multiple coupon redemptions and ratings race condition - #302

feat: added tests for multiple coupon redemptions and ratings race condition#302
Kaustavoffx wants to merge 2 commits into
akto-api-security:masterfrom
Kaustavoffx:master

Kaustavoffx commented Apr 27, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 27, 2026

Uh oh!

Copilot AI Apr 27, 2026

Uh oh!

Copilot AI Apr 27, 2026

Uh oh!

Copilot AI Apr 27, 2026

Uh oh!

Copilot AI Apr 27, 2026

Uh oh!

Copilot AI Apr 27, 2026

Uh oh!

Copilot AI Apr 27, 2026

Uh oh!

Copilot AI Apr 27, 2026

Uh oh!

Copilot AI Apr 27, 2026

Uh oh!

Copilot AI Apr 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	subCategory: MULTIPLE_RATINGS
	subCategory: MULTIPLE_RATINGS_RACE_CONDITION

-    - Race Condition
+    - Race Condition
+  references:
+    - "https://owasp.org/API-Security/editions/2023/en/0x11-t10/"
+    - "https://cwe.mitre.org/data/definitions/362.html"
+  cwe:
+    - "CWE-362"
+  cve: []
+  attributes: {}

	displayName: Business Logic
	displayName: Broken Object Level Authorization (BOLA)

Uh oh!

Conversation

Kaustavoffx commented Apr 27, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants