Fuzz create and update requests
Automatically probe validation with missing fields and out-of-range values.
fuzzingvariationvalidation
What it does
Generates fuzzed requests for the create and update operations based on the OpenAPI constraints: required fields removed, numbers outside minimum and maximum, and strings outside minLength and maxLength. Every fuzzed request is checked against the 422 response in the spec.
portman-config.json
{ "version": 1, "tests": { "variationTests": [ { "openApiOperationIds": [ "leadsAdd", "leadsUpdate" ], "openApiResponse": "422", "variations": [ { "name": "Unprocessable", "fuzzing": [ { "requestBody": [ { "requiredFields": { "enabled": true }, "minimumNumberFields": { "enabled": true }, "maximumNumberFields": { "enabled": true }, "minLengthFields": { "enabled": true }, "maxLengthFields": { "enabled": true } } ] } ], "tests": { "contractTests": [ { "statusCode": { "enabled": true }, "contentType": { "enabled": true }, "jsonBody": { "enabled": true }, "schemaValidation": { "enabled": true } } ] } } ] } ] }, "globals": { "stripResponseExamples": true }}Run it
terminal
$ npx @apideck/portman -l ./openapi.yaml -c ./portman-config.json -b http://localhost:3050 -n trueNotes
- Request body fuzzing only applies to application/json request bodies.
- Add requestQueryParams and requestHeaders blocks with the same options to fuzz those inputs too.
- Fuzzing only works as well as your constraints, so add minimum, maximum, minLength, maxLength and required to the spec.