mirror of
https://github.com/hanzo-fi/go-libs.git
synced 2026-10-30 20:53:44 +00:00
Maxence MaireauxandGitHub
f2abd7cf53
* test(currency): add fuzz tests for amount parsing and serialization Add three fuzz targets: GetAmountWithPrecisionFromString, AmountRoundTrip, and GetStringAmountFromBigIntWithPrecision. Includes regression corpus for a negative number serialization bug found during fuzzing. * fix(currency): handle negative numbers in GetStringAmountFromBigIntWithPrecision The sign was placed after the decimal point for negative amounts (e.g. -1 with precision 26 produced "0.-00...001"). Extract the sign before formatting and prepend it to the result. * test(query): add fuzz test for ParseJSON with round-trip verification Fuzzes the query DSL parser with random JSON inputs. Verifies no panics, successful Build calls, and marshal/re-parse round-trip consistency. Includes regression corpus for empty $and set serialization. * fix(query): marshal empty $and/$or sets as [] instead of null set.MarshalJSON serialized a nil items slice as null, which could not be re-parsed by ParseJSON. Initialize to an empty slice when nil so the round-trip produces valid JSON. * test(oidc): add fuzz tests for Audience, Time, SpaceDelimitedArray, and Locales Fuzz JSON unmarshaling for security-critical OIDC types. Includes round-trip verification for Audience and SpaceDelimitedArray, and panic-safety checks for Time and Locales. * test: add fuzz tests for JWT scopes, licence validation, and pagination - jwt: fuzz checkScopes and ClaimsFromRequest header parsing - licence: fuzz JWT token validation against embedded RSA key - paginate: fuzz UnmarshalCursor (base64->JSON) and BigInt.FromString in a separate subpackage to avoid Docker-dependent TestMain * test(time): add fuzz tests for ParseTime, UnmarshalJSON, and Scan Three fuzz targets covering time parsing, JSON unmarshaling, and database scanning with round-trip verification. Includes regression corpus for year 0000 with timezone offset producing negative years that cannot be re-parsed (Go stdlib limitation). * test(metadata): add fuzz tests for Scan, Merge, and UnmarshalValue Fuzz JSON scanning from database, metadata merging invariants, and the generic UnmarshalValue function with panic recovery. * test(currency): add fuzz tests for GetCurrencyAndPrecisionFromAsset and FormatAsset Fuzz asset string parsing (EUR/2 format) and currency formatting against the ISO4217 currency map. * test(oidc): add fuzz tests for JWTTokenRequest and mergeAndMarshalClaims Fuzz JWT token request round-trip and claims merging. Includes regression corpus for null Audience round-trip failure. * fix(oidc): handle null JSON value in Audience.UnmarshalJSON Audience marshals as null when empty, but UnmarshalJSON did not accept null back, breaking round-trip consistency. Add nil case to the type switch. * fix(time): skip round-trip check for negative years in FuzzParseTime Negative years produced by UTC conversion are not representable in RFC3339, causing the round-trip reparse to fail. * fix: address CodeRabbit review comments on fuzz tests - query/fuzz_test.go: fail on marshal error instead of silently returning - paginate/fuzz_test.go: add semantic validation with base64+JSON oracle - currency/amount.go: guard against nil *big.Int to prevent panic - time/fuzz_test.go: also skip year 0 and year > 9999 in round-trip check * fix(metadata): avoid masking unexpected panics in FuzzUnmarshalValue Skip invalid JSON inputs instead of catching all panics with defer/recover, so genuine unexpected panics surface properly.
74 lines
1.8 KiB
Go
74 lines
1.8 KiB
Go
package oidc
|
|
|
|
import (
|
|
"encoding/json"
|
|
"testing"
|
|
)
|
|
|
|
func FuzzJWTTokenRequestUnmarshalJSON(f *testing.F) {
|
|
f.Add([]byte(`{"iss":"issuer","sub":"subject","aud":"audience","iat":1609459200,"exp":1609459200}`))
|
|
f.Add([]byte(`{"iss":"issuer","sub":"subject","aud":["aud1","aud2"],"iat":0,"exp":0}`))
|
|
f.Add([]byte(`{}`))
|
|
f.Add([]byte(`{"custom_claim":"value","iss":"test"}`))
|
|
|
|
// Edge cases
|
|
f.Add([]byte(`null`))
|
|
f.Add([]byte(`[]`))
|
|
f.Add([]byte(`"string"`))
|
|
f.Add([]byte(`{`))
|
|
f.Add([]byte(`{"iss":123}`))
|
|
f.Add([]byte(`{"aud":42}`))
|
|
|
|
f.Fuzz(func(t *testing.T, data []byte) {
|
|
var req JWTTokenRequest
|
|
err := req.UnmarshalJSON(data)
|
|
if err != nil {
|
|
return
|
|
}
|
|
|
|
// Round-trip
|
|
marshaled, err := req.MarshalJSON()
|
|
if err != nil {
|
|
t.Fatalf("marshal failed after successful unmarshal: %v", err)
|
|
}
|
|
|
|
var reparsed JWTTokenRequest
|
|
if err := reparsed.UnmarshalJSON(marshaled); err != nil {
|
|
t.Fatalf("round-trip failed: %q -> %v", string(marshaled), err)
|
|
}
|
|
})
|
|
}
|
|
|
|
func FuzzMergeAndMarshalClaims(f *testing.F) {
|
|
f.Add(`{"iss":"test","sub":"user"}`, `{"custom":"value"}`)
|
|
f.Add(`{}`, `{}`)
|
|
f.Add(`{"iss":"test"}`, `{"iss":"override"}`)
|
|
f.Add(`{"a":"1"}`, ``)
|
|
|
|
f.Fuzz(func(t *testing.T, registeredJSON string, extraJSON string) {
|
|
var registered map[string]any
|
|
if err := json.Unmarshal([]byte(registeredJSON), ®istered); err != nil {
|
|
return
|
|
}
|
|
|
|
var extra map[string]any
|
|
if extraJSON != "" {
|
|
if err := json.Unmarshal([]byte(extraJSON), &extra); err != nil {
|
|
return
|
|
}
|
|
}
|
|
|
|
// Must not panic
|
|
result, err := mergeAndMarshalClaims(registered, extra)
|
|
if err != nil {
|
|
return
|
|
}
|
|
|
|
// Result must be valid JSON
|
|
var check map[string]any
|
|
if err := json.Unmarshal(result, &check); err != nil {
|
|
t.Fatalf("mergeAndMarshalClaims produced invalid JSON: %q -> %v", string(result), err)
|
|
}
|
|
})
|
|
}
|