nextcloud / nextcloud/server

Use OpenAPI fuzzing to find mistakes in specifications and general errors in the code

Open
#47,825 4 comments 0 reactions 1 assignee View on GitHub

@provokateurin is already working on this.

Since Sep 7, 2024.

2. developing enhancement
Dominant language
PHP
Stars
36.9k
Forks
5.2k
Avg merge
2d 3h
Merged PRs (30d)
713

Description

How to use GitHub
  • Please use the 👍 reaction to show that you are interested into the same feature.
  • Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
  • Subscribe to receive notifications on status change and new comments.

Is your feature request related to a problem? Please describe.
Bugs exist ;)

Describe the solution you'd like
An OpenAPI fuzzer can generate inputs and execute requests against API endpoints as described by the specification.
This can both find problems in the specifications as well as errors in the application code itself.
I already ran a small experiment against https://github.com/matusf/openapi-fuzzer which resulted in a few issues found in the core specification and code.
There is also https://github.com/microsoft/restler-fuzzer which is a lot more complex but also does more advanced mutations and checks for problems in the application logic. I haven't been able to get it properly working yet though.
One major thing I'm interested in is validation of response bodies as I often find problems myself (by hand basically), so an automation there would be great. I haven't yet found a fuzzer that seems to do that, but maybe restler can do it and they just don't mention it anywhere (the other one definitely only checks the status code, i read that part of the code).

A small script to run tests against the specifications in server can be found here: https://gist.github.com/provokateurin/3150b1c98049368bb6f00e7b7f76b1c6 (can be adapted to work with restler later)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.