vpk | Visual parsed Kubernetes | AWS library

Extracting parameters from HTTP message and getting resource URLs could be vulnerable to injection attacks that may change the semantics of the intended resource. Two classes of attacks are relevant here: HTTP parameter/path pollution (HPPP) and Server-Side Request Forgery (SSRF). Remember that our attacker has full control over the HTTP request or the HTTP response.

In an HPPP (HTTP parameter/path pollution attack), a parameter is used to compose the resource URL to be used to prepare a REST request for a resource (or generate an embedded link). The problem is that the attacker may either alter the path or add/overwrite unexpected parameters in the “query string”. Additionally, REST frameworks may use a parameter (like _method) to allow the specification of a REST verb different from the incoming HTTP method, so a GET request could be interpreted as a PUT operation. An attacker may change the semantics of the REST resource URL.

find more info here

Example :

For example: if testing the search_string parameter in the query string, the request URL would include that parameter name and value.

I want to start a Docker-container with Oracle XE and then run an SQL script (ddl.sql) to create some tables.

If I execute all the steps separately, everything works: