@testsmith/api-spector 0.5.5 → 0.5.6

package/out/main/chunks/{snapshots-CN8g7lqA.js → snapshots-CcvHHTnQ.js}

@@ -1432,6 +1432,37 @@ const ADVERSARIAL_STRINGS = [
   ["unicode", "𝔘🙈\0�"],
   ["whitespace", "   "]
 ];
+const INJECTION_PAYLOADS = [
+  ["sql", "or-1-1", "' OR '1'='1"],
+  ["sql", "comment", "'--"],
+  ["nosql", "ne-null", '{"$ne": null}'],
+  ["nosql", "gt-empty", '{"$gt": ""}'],
+  ["command", "semicolon", "; id"],
+  ["command", "subshell", "$(id)"],
+  ["xss", "script", "<script>alert(1)<\/script>"],
+  ["xss", "img-onerror", '"><img src=x onerror=alert(1)>'],
+  ["traversal", "etc-passwd", "../../../../etc/passwd"],
+  ["template", "mustache", "{{7*7}}"],
+  ["template", "dollar", "${7*7}"],
+  ["ldap", "wildcard", "*)(uid=*"],
+  ["crlf", "header", "x\r\nX-Injected: 1"],
+  ["xxe", "entity", '<!DOCTYPE t [<!ENTITY e SYSTEM "file:///etc/passwd">]><t>&e;</t>']
+];
+const NAUGHTY_STRINGS = [
+  ["emoji", "😍👩🏽‍💻🏳️‍🌈"],
+  ["rtl-override", "‮txet desrever"],
+  ["zalgo", "Z͢͡a̴͈l͖g̴o"],
+  ["zero-width", "a​b‌c‍d\uFEFF"],
+  ["format-string", "%s%s%s%n%x%x"],
+  ["fullwidth", "１２３４５"],
+  ["reserved-word", "NaN"],
+  ["bignum-string", "9".repeat(300)],
+  ["null-char", "a\0b"],
+  ["mixed-newlines", "a\r\nb\nc\rd"],
+  ["quotes", "'\"`"],
+  ["brace-soup", "${{{}}}[]()"],
+  ["huge", "A".repeat(5e4)]
+];
 function clone(v) {
   return JSON.parse(JSON.stringify(v));
 }
@@ -1450,7 +1481,7 @@ function deleteAtPath(root, path2) {
   delete cur[path2[path2.length - 1]];
   return copy;
 }
-function mutate(baseline, schema, label) {
+function mutate(baseline, schema, label, level = "standard") {
   const cases = [];
   const walk = (schemaNode, path2) => {
     const target = [label, ...path2].join(".");
@@ -1467,9 +1498,14 @@ function mutate(baseline, schema, label) {
           });
         }
       }
-      if (schemaNode["additionalProperties"] === false && current) {
+      if (current) {
+        const forbidden = schemaNode["additionalProperties"] === false;
         cases.push({
-          mutation: { target: `${target}.__fuzz_extra`, kind: "unexpected-field", description: "add a field the schema forbids" },
+          mutation: {
+            target: `${target}.__fuzz_extra`,
+            kind: forbidden ? "unexpected-field" : "extra-property",
+            description: forbidden ? "add a field the schema forbids" : "add an unexpected extra field"
+          },
           value: setAtPath(baseline, [...path2, "__fuzz_extra"], "unexpected")
         });
       }
@@ -1513,9 +1549,25 @@ function mutate(baseline, schema, label) {
           value: setAtPath(baseline, path2, "x".repeat(maxLen + 1))
         });
       }
-      for (const [name, str] of ADVERSARIAL_STRINGS) {
+      if (level !== "basic") {
+        for (const [name, str] of ADVERSARIAL_STRINGS) {
+          cases.push({
+            mutation: { target, kind: `adversarial:${name}`, description: `inject a ${name} string` },
+            value: setAtPath(baseline, path2, str)
+          });
+        }
+      }
+      if (level === "aggressive") {
+        for (const [cat, name, payload] of INJECTION_PAYLOADS) {
+          cases.push({
+            mutation: { target, kind: `injection:${cat}:${name}`, description: `inject a ${cat} probe` },
+            value: setAtPath(baseline, path2, payload)
+          });
+        }
+      }
+      if (level !== "basic") for (const [name, str] of NAUGHTY_STRINGS) {
         cases.push({
-          mutation: { target, kind: `adversarial:${name}`, description: `inject a ${name} string` },
+          mutation: { target, kind: `naughty:${name}`, description: `inject a naughty string (${name})` },
           value: setAtPath(baseline, path2, str)
         });
       }
@@ -1583,10 +1635,11 @@ function setParam(base, key, value) {
 function dropParam(base, key) {
   return base.filter((p) => p.key !== key);
 }
-function mutateQueryParams(base, schemas = [], label = "query") {
+function mutateQueryParams(base, schemas = [], label = "query", level = "standard") {
   const cases = [];
   const schemaByName = new Map(schemas.map((s) => [s.name, s]));
   const target = (name) => `${label}.${name}`;
+  const injectionProbes = /* @__PURE__ */ new Set(["sql", "xss", "traversal", "null-byte"]);
   for (const s of schemas) {
     if (s.required && base.some((p) => p.enabled && p.key === s.name)) {
       cases.push({
@@ -1614,8 +1667,11 @@ function mutateQueryParams(base, schemas = [], label = "query") {
       if (typeof min === "number") cases.push({ mutation: { target: t, kind: "below-minimum", description: `value below minimum (${min})` }, params: setParam(base, p.key, String(min - 1)) });
       if (typeof max === "number") cases.push({ mutation: { target: t, kind: "above-maximum", description: `value above maximum (${max})` }, params: setParam(base, p.key, String(max + 1)) });
     }
-    for (const [name, val] of QUERY_ADVERSARIAL) {
-      cases.push({ mutation: { target: t, kind: `adversarial:${name}`, description: `inject a ${name} value` }, params: setParam(base, p.key, val) });
+    if (level !== "basic") {
+      for (const [name, val] of QUERY_ADVERSARIAL) {
+        if (injectionProbes.has(name) && level !== "aggressive") continue;
+        cases.push({ mutation: { target: t, kind: `adversarial:${name}`, description: `inject a ${name} value` }, params: setParam(base, p.key, val) });
+      }
     }
   }
   cases.push({
@@ -1647,6 +1703,46 @@ function inferSchema(value) {
       return { type: "string" };
   }
 }
+function duplicateKeyBody(baseline) {
+  if (!baseline || typeof baseline !== "object" || Array.isArray(baseline)) return null;
+  const entries = Object.entries(baseline);
+  if (entries.length === 0) return null;
+  const parts = entries.map(([k, v]) => `${JSON.stringify(k)}:${JSON.stringify(v)}`);
+  const [firstKey, firstVal] = entries[0];
+  const dupVal = typeof firstVal === "string" ? `${firstVal}-dup` : "__duplicate__";
+  parts.push(`${JSON.stringify(firstKey)}:${JSON.stringify(dupVal)}`);
+  return `{${parts.join(",")}}`;
+}
+function mutateHeaders(base, label = "header") {
+  const withHeader = (key, value) => [
+    ...base.filter((h) => h.key.toLowerCase() !== key.toLowerCase()),
+    { key, value, enabled: true }
+  ];
+  const cases = [];
+  const contentTypes = [
+    ["multipart-mixed", "multipart/mixed"],
+    ["text-plain", "text/plain"],
+    ["xml", "application/xml"],
+    ["empty", ""],
+    ["wildcard", "*/*"],
+    ["bad-charset", "application/json; charset=not-a-charset"]
+  ];
+  for (const [name, ct] of contentTypes) {
+    cases.push({
+      mutation: { target: `${label}.Content-Type`, kind: `header:content-type:${name}`, description: `tamper Content-Type (${ct || "empty"})` },
+      headers: withHeader("Content-Type", ct)
+    });
+  }
+  cases.push({
+    mutation: { target: `${label}.Accept`, kind: "header:accept-unsatisfiable", description: "demand an unsatisfiable Accept" },
+    headers: withHeader("Accept", "application/x-does-not-exist")
+  });
+  cases.push({
+    mutation: { target: `${label}.X-Fuzz-Overflow`, kind: "header:oversized", description: "send an oversized header value" },
+    headers: [...base, { key: "X-Fuzz-Overflow", value: "A".repeat(8192), enabled: true }]
+  });
+  return cases;
+}
 function sampleApplied(arr, n, rng) {
   if (arr.length <= n) return arr;
   const a = [...arr];
@@ -1723,6 +1819,7 @@ async function runFuzz(opts) {
   const spec = opts.specUrl || opts.specPath ? await loadSpec(opts.specUrl, opts.specPath) : null;
   const seed = opts.seed ?? 1;
   const casesPerOp = opts.casesPerOperation ?? 40;
+  const level = opts.level ?? "standard";
   const vars = requestExec.mergeVars(opts.envVars, opts.collectionVars ?? {}, {}, {}, await requestExec.buildDynamicVars());
   const dispatcher = await requestExec.buildDispatcher(void 0, void 0);
   const start = Date.now();
@@ -1767,13 +1864,30 @@ async function runFuzz(opts) {
     }
     const applied = [];
     if (hasBody) {
-      for (const c of mutate(baselineBody, bodySchema, "body")) {
+      for (const c of mutate(baselineBody, bodySchema, "body", level)) {
         applied.push({ mutation: c.mutation, bodyJson: JSON.stringify(c.value), bodyValue: c.value, params: baselineParams, isBody: true });
       }
+      if (level !== "basic") {
+        const dupRaw = duplicateKeyBody(baselineBody);
+        if (dupRaw) {
+          applied.push({
+            mutation: { target: "body", kind: "duplicate-key", description: "send the same JSON key twice" },
+            bodyJson: dupRaw,
+            bodyValue: baselineBody,
+            params: baselineParams,
+            isBody: true
+          });
+        }
+      }
     }
-    for (const c of mutateQueryParams(baselineParams, specCtx?.queryParams ?? [], "query")) {
+    for (const c of mutateQueryParams(baselineParams, specCtx?.queryParams ?? [], "query", level)) {
       applied.push({ mutation: c.mutation, bodyJson: baselineBodyJson, params: c.params, isBody: false });
     }
+    if (level === "aggressive") {
+      for (const hc of mutateHeaders(req.headers ?? [], "header")) {
+        applied.push({ mutation: hc.mutation, bodyJson: baselineBodyJson, params: baselineParams, isBody: false, headers: hc.headers });
+      }
+    }
     const cases = sampleApplied(applied, casesPerOp, makeRng(seed + 1));
     const findings = [];
     const trace = opts.trace ? [] : void 0;
@@ -1788,6 +1902,7 @@ async function runFuzz(opts) {
       const fuzzReq = {
         ...req,
         params: c.params,
+        ...c.headers ? { headers: c.headers } : {},
         body: c.bodyJson !== void 0 ? { mode: "json", json: c.bodyJson } : req.body
       };
       const resolvedUrl = requestExec.rebaseUrl(requestExec.buildUrl(fuzzReq.url, fuzzReq.params, vars), opts.providerBaseUrl);

package/out/main/contract.js

@@ -2,7 +2,7 @@
 "use strict";
 const promises = require("fs/promises");
 const path = require("path");
-const snapshots = require("./chunks/snapshots-CN8g7lqA.js");
+const snapshots = require("./chunks/snapshots-CcvHHTnQ.js");
 const crypto = require("crypto");
 const undici = require("undici");
 const os = require("os");
@@ -602,9 +602,13 @@ async function cmdFuzz(args) {
     process.exit(2);
   }
   const includeWrites = Boolean(args["include-writes"]);
-  console.log(`  Fuzzing ${allRequests.length} request(s)${specUrl || specPath ? " against the spec" : " from request bodies"}...`);
+  const levelArg = typeof args["level"] === "string" ? args["level"].toLowerCase() : "standard";
+  const level = ["basic", "standard", "aggressive"].includes(levelArg) ? levelArg : "standard";
+  console.log(`  Fuzzing ${allRequests.length} request(s)${specUrl || specPath ? " against the spec" : " from request bodies"} at the ${level} level...`);
+  if (level === "aggressive") console.log("  Aggressive: includes injection probes (SQL/NoSQL/…) and header tampering. Only run against systems you own.");
   if (!includeWrites) console.log("  Write methods (POST/PUT/PATCH/DELETE) are skipped. Add --include-writes to fuzz them (sends malformed writes; target staging or a mock).");
   const report = await snapshots.runFuzz({
+    level,
     requests: allRequests,
     envVars,
     collectionVars,
@@ -931,7 +935,7 @@ async function main() {
   api-spector contract record-deployment --workspace <path> --pacticipant <name> --app-version <ver> --env <name>
   api-spector contract environments  --workspace <path>
   api-spector contract webhooks      --workspace <path> [--test]
-  api-spector contract fuzz          --workspace <path> --provider-base-url <url> [--snapshot <id> | --spec-url <url>] [--cases <n>] [--seed <n>] [--include-writes] [--trace] [--html <path>]
+  api-spector contract fuzz          --workspace <path> --provider-base-url <url> [--snapshot <id> | --spec-url <url>] [--level basic|standard|aggressive] [--cases <n>] [--seed <n>] [--include-writes] [--trace] [--html <path>]
   api-spector contract pact-import   --file <pact.json> [--out <collection.json>]
   api-spector contract pact-export   --workspace <path> --out <pact.json> [--consumer <name> --provider <name> --collection <name>]
 

package/out/main/index.js

@@ -45,7 +45,7 @@ const protoLoader = require("@grpc/proto-loader");
 const soapHandler = require("./chunks/soap-handler-DCCE344x.js");
 const promises$1 = require("node:fs/promises");
 const os$1 = require("os");
-const snapshots = require("./chunks/snapshots-CN8g7lqA.js");
+const snapshots = require("./chunks/snapshots-CcvHHTnQ.js");
 const simpleGit = require("simple-git");
 const recorder = require("./chunks/recorder-0Ij921El.js");
 require("tls");
@@ -5941,7 +5941,7 @@ function isNewer(a, b) {
   return a2 > b2;
 }
 async function checkForUpdate() {
-  const current = "0.5.5";
+  const current = "0.5.6";
   try {
     const res = await fetch(REGISTRY_URL, { signal: AbortSignal.timeout(4e3) });
     if (!res.ok) return null;

package/out/main/runner.js

@@ -402,7 +402,7 @@ async function main() {
   } else if (!envName && workspace.settings?.defaultEnvironment && !env) {
     console.warn(cliCommon.color(`Warning: default environment "${workspace.settings.defaultEnvironment}" not found. Running without environment.`, cliCommon.C.yellow));
   }
-  const version = `v${"0.5.5"}`;
+  const version = `v${"0.5.6"}`;
   console.log("");
   console.log(cliCommon.color("  API Test Runner" + (version ? ` ${version}` : ""), cliCommon.C.bold, cliCommon.C.white));
   console.log(cliCommon.color(`  Workspace:   ${wsPath}`, cliCommon.C.gray));

package/out/renderer/assets/{GraphQLEditor-CegyHBoY.js → GraphQLEditor-Caafu60-.js}

@@ -1,4 +1,4 @@
-import { l as linter, E as EditorView, L as LanguageSupport, a as LRLanguage, s as styleTags, i as indentNodeProp, d as delimitedIndent, f as foldNodeProp, b as foldInside, S as StateField, c as LRParser, e as StateEffect, t as tags, u as useT, r as reactExports, g as useStore, h as useActiveEnvironment, j as jsxRuntimeExports, R as ReactCodeMirror, o as oneDark, k as json } from "./index-e3ZM7oe9.js";
+import { l as linter, E as EditorView, L as LanguageSupport, a as LRLanguage, s as styleTags, i as indentNodeProp, d as delimitedIndent, f as foldNodeProp, b as foldInside, S as StateField, c as LRParser, e as StateEffect, t as tags, u as useT, r as reactExports, g as useStore, h as useActiveEnvironment, j as jsxRuntimeExports, R as ReactCodeMirror, o as oneDark, k as json } from "./index-BKJHj4_d.js";
 function devAssert(condition, message) {
   const booleanCondition = Boolean(condition);
   if (!booleanCondition) {

package/out/renderer/assets/{SoapEditor-BjZHo7Xf.js → SoapEditor-uTnyfTVp.js}

@@ -1,4 +1,4 @@
-import { u as useT, r as reactExports, j as jsxRuntimeExports, R as ReactCodeMirror, m as commentKeymap, o as oneDark, x as xml } from "./index-e3ZM7oe9.js";
+import { u as useT, r as reactExports, j as jsxRuntimeExports, R as ReactCodeMirror, m as commentKeymap, o as oneDark, x as xml } from "./index-BKJHj4_d.js";
 const SOAP_11_CONTENT_TYPE = "text/xml; charset=utf-8";
 const SOAP_12_CONTENT_TYPE = "application/soap+xml; charset=utf-8";
 function contentTypeForSoap(version) {