Skip to content

Add API fuzz test pipeline#106

Open
yukicoder0509 wants to merge 6 commits into
mainfrom
test/add-api-fuzz-test
Open

Add API fuzz test pipeline#106
yukicoder0509 wants to merge 6 commits into
mainfrom
test/add-api-fuzz-test

Conversation

@yukicoder0509

Copy link
Copy Markdown
Member

Type of changes

  • Test

Purpose

  • Add API fuzz test pipeline and script
  • Add Docker Compose to start the backend service and run the RESTler fuzzer
  • Add make command make fuzz to run fuzz testing and generate a report

Additional Information

  • RESTler is an API fuzzing tool developed by Microsoft https://github.com/microsoft/restler-fuzzer
  • How to test this PR: run make fuzz in terminal, fuzz testing will start automatically. Then check is there is a report generated in test/fuzzing/reports folder.
  • The pipeline of running fuzz test is as bellow
  1. Run command make fuzz
  2. Trigger prepare script test/fuzzing/prepare.sh, this will build a backend binary.
  3. Trigger execution script test/fuzzing/run.sh
    3-1. Run docker compose test/fuzzing/compose.yaml: postgres -> ldap -> redis -> backend -> data seeder (inject test user data) -> restler
    3-2. restler start compile and fuzzing
    3-3. fuzz finish
    3-4. run restler report parser to parse restler output into HTML report
    3-5. static HTML report generated to test/fuzzing/reports/dist
  4. Fuzz testing finish

…report' directory in run.sh before accessing it
@yukicoder0509 yukicoder0509 self-assigned this Dec 3, 2025

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since the page is already deployed on GitHub, I think we can just fetch the YAML file from there instead of hardcoding it locally.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, you are right about it.
But there is a problem:
We often update the API before updating the backend implementation.

I think we can discuss how to control the API version so we keep track of the API spec of the backend version.

Comment thread test/fuzzing/restler_workspace/auth.log Outdated
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants