mirror of
https://github.com/hanzo-fi/go-libs.git
synced 2026-10-30 20:53:44 +00:00
Maxence MaireauxandGitHub
f2abd7cf53
* test(currency): add fuzz tests for amount parsing and serialization Add three fuzz targets: GetAmountWithPrecisionFromString, AmountRoundTrip, and GetStringAmountFromBigIntWithPrecision. Includes regression corpus for a negative number serialization bug found during fuzzing. * fix(currency): handle negative numbers in GetStringAmountFromBigIntWithPrecision The sign was placed after the decimal point for negative amounts (e.g. -1 with precision 26 produced "0.-00...001"). Extract the sign before formatting and prepend it to the result. * test(query): add fuzz test for ParseJSON with round-trip verification Fuzzes the query DSL parser with random JSON inputs. Verifies no panics, successful Build calls, and marshal/re-parse round-trip consistency. Includes regression corpus for empty $and set serialization. * fix(query): marshal empty $and/$or sets as [] instead of null set.MarshalJSON serialized a nil items slice as null, which could not be re-parsed by ParseJSON. Initialize to an empty slice when nil so the round-trip produces valid JSON. * test(oidc): add fuzz tests for Audience, Time, SpaceDelimitedArray, and Locales Fuzz JSON unmarshaling for security-critical OIDC types. Includes round-trip verification for Audience and SpaceDelimitedArray, and panic-safety checks for Time and Locales. * test: add fuzz tests for JWT scopes, licence validation, and pagination - jwt: fuzz checkScopes and ClaimsFromRequest header parsing - licence: fuzz JWT token validation against embedded RSA key - paginate: fuzz UnmarshalCursor (base64->JSON) and BigInt.FromString in a separate subpackage to avoid Docker-dependent TestMain * test(time): add fuzz tests for ParseTime, UnmarshalJSON, and Scan Three fuzz targets covering time parsing, JSON unmarshaling, and database scanning with round-trip verification. Includes regression corpus for year 0000 with timezone offset producing negative years that cannot be re-parsed (Go stdlib limitation). * test(metadata): add fuzz tests for Scan, Merge, and UnmarshalValue Fuzz JSON scanning from database, metadata merging invariants, and the generic UnmarshalValue function with panic recovery. * test(currency): add fuzz tests for GetCurrencyAndPrecisionFromAsset and FormatAsset Fuzz asset string parsing (EUR/2 format) and currency formatting against the ISO4217 currency map. * test(oidc): add fuzz tests for JWTTokenRequest and mergeAndMarshalClaims Fuzz JWT token request round-trip and claims merging. Includes regression corpus for null Audience round-trip failure. * fix(oidc): handle null JSON value in Audience.UnmarshalJSON Audience marshals as null when empty, but UnmarshalJSON did not accept null back, breaking round-trip consistency. Add nil case to the type switch. * fix(time): skip round-trip check for negative years in FuzzParseTime Negative years produced by UTC conversion are not representable in RFC3339, causing the round-trip reparse to fail. * fix: address CodeRabbit review comments on fuzz tests - query/fuzz_test.go: fail on marshal error instead of silently returning - paginate/fuzz_test.go: add semantic validation with base64+JSON oracle - currency/amount.go: guard against nil *big.Int to prevent panic - time/fuzz_test.go: also skip year 0 and year > 9999 in round-trip check * fix(metadata): avoid masking unexpected panics in FuzzUnmarshalValue Skip invalid JSON inputs instead of catching all panics with defer/recover, so genuine unexpected panics surface properly.
29 lines
681 B
Go
29 lines
681 B
Go
package licence
|
|
|
|
import (
|
|
"testing"
|
|
)
|
|
|
|
func FuzzLicenceValidate(f *testing.F) {
|
|
// Various JWT-like strings
|
|
f.Add("eyJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJ0ZXN0Iiwic3ViIjoiY2x1c3RlciIsImF1ZCI6InNlcnZpY2UiLCJleHAiOjk5OTk5OTk5OTl9.invalid-sig")
|
|
f.Add("not.a.jwt")
|
|
f.Add("")
|
|
f.Add("eyJhbGciOiJIUzI1NiJ9.eyJ0ZXN0IjoxfQ.sig")
|
|
f.Add("a]b.c.d")
|
|
f.Add("...")
|
|
f.Add("eyJhbGciOiJub25lIn0.eyJ0ZXN0IjoxfQ.")
|
|
|
|
f.Fuzz(func(t *testing.T, token string) {
|
|
l := &Licence{
|
|
jwtToken: token,
|
|
serviceName: "test-service",
|
|
clusterID: "test-cluster",
|
|
expectedIssuer: "test-issuer",
|
|
}
|
|
|
|
// Must not panic — errors are expected for invalid tokens
|
|
_ = l.validate()
|
|
})
|
|
}
|