search

Endava / cats

CATS is a REST API Fuzzer and negative testing tool for OpenAPI endpoints. CATS automatically generates, runs and reports tests with minimum configuration and no coding effort. Tests are self-healing and do not require maintenance.
Apache License 2.0
1.19k stars 73 forks source link

High maxLength throws IllegalArgumentException #11

Closed jamesfulford closed 3 years ago

jamesfulford commented 3 years ago

Stacktrace when attempting to generate a string when schema says maxLength: 2147483647. (Including this value is the default behavior of springdoc if minLength is specified). Ideally a warning instead. I can update my API doc to be a more reasonable number, but opening so can be handled more gracefully and/or others can know how to fix.

java.lang.IllegalArgumentException: bound must be positive
        at java.base/java.util.Random.nextInt(Random.java:388)
        at com.github.curiousoddman.rgxgen.visitors.GenerationVisitor.visit(GenerationVisitor.java:67)
        at com.github.curiousoddman.rgxgen.nodes.Repeat.visit(Repeat.java:43)
        at com.github.curiousoddman.rgxgen.RgxGen.generate(RgxGen.java:161)
        at com.github.curiousoddman.rgxgen.RgxGen.generate(RgxGen.java:146)
        at com.endava.cats.generator.simple.StringGenerator.generateRightBoundString(StringGenerator.java:59)
        at com.endava.cats.fuzzer.fields.StringFieldsRightBoundaryFuzzer.getBoundaryValue(StringFieldsRightBoundaryFuzzer.java:37)
        at com.endava.cats.fuzzer.fields.base.BaseBoundaryFieldFuzzer.fuzzerGeneratedBoundaryValue(BaseBoundaryFieldFuzzer.java:57)
        at com.endava.cats.fuzzer.fields.base.BaseBoundaryFieldFuzzer.getFieldFuzzingStrategy(BaseBoundaryFieldFuzzer.java:40)
        at com.endava.cats.fuzzer.fields.base.BaseFieldsFuzzer.fuzz(BaseFieldsFuzzer.java:57)
        at com.endava.cats.fuzzer.fields.base.BaseFieldsFuzzer$$FastClassBySpringCGLIB$$3055f71f.invoke(<generated>)
        at org.springframework.cglib.proxy.MethodProxy.invoke(MethodProxy.java:218)
        at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.invokeJoinpoint(CglibAopProxy.java:779)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:163)
        at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.proceed(CglibAopProxy.java:750)
        at org.springframework.aop.aspectj.MethodInvocationProceedingJoinPoint.proceed(MethodInvocationProceedingJoinPoint.java:89)
        at com.endava.cats.aop.FuzzerLogAspect.logExecutionTime(FuzzerLogAspect.java:31)
        at jdk.internal.reflect.GeneratedMethodAccessor34.invoke(Unknown Source)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base/java.lang.reflect.Method.invoke(Method.java:566)
        at org.springframework.aop.aspectj.AbstractAspectJAdvice.invokeAdviceMethodWithGivenArgs(AbstractAspectJAdvice.java:634)
        at org.springframework.aop.aspectj.AbstractAspectJAdvice.invokeAdviceMethod(AbstractAspectJAdvice.java:624)
        at org.springframework.aop.aspectj.AspectJAroundAdvice.invoke(AspectJAroundAdvice.java:72)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186)
        at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.proceed(CglibAopProxy.java:750)
        at org.springframework.aop.interceptor.ExposeInvocationInterceptor.invoke(ExposeInvocationInterceptor.java:97)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186)
        at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.proceed(CglibAopProxy.java:750)
        at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:692)
        at com.endava.cats.fuzzer.fields.StringFieldsRightBoundaryFuzzer$$EnhancerBySpringCGLIB$$d847ce3b.fuzz(<generated>)
        at com.endava.cats.CatsMain.lambda$fuzzPath$14(CatsMain.java:385)
        at java.base/java.util.ArrayList.forEach(ArrayList.java:1541)
        at com.endava.cats.CatsMain.fuzzPath(CatsMain.java:383)
        at com.endava.cats.CatsMain.startFuzzing(CatsMain.java:174)
        at com.endava.cats.CatsMain.doLogic(CatsMain.java:165)
        at com.endava.cats.CatsMain.run(CatsMain.java:143)
        at org.springframework.boot.SpringApplication.callRunner(SpringApplication.java:819)
        at org.springframework.boot.SpringApplication.callRunners(SpringApplication.java:803)
        at org.springframework.boot.SpringApplication.run(SpringApplication.java:346)
        at com.endava.cats.CatsMain.main(CatsMain.java:102)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base/java.lang.reflect.Method.invoke(Method.java:566)
        at org.springframework.boot.loader.MainMethodRunner.run(MainMethodRunner.java:49)
        at org.springframework.boot.loader.Launcher.launch(Launcher.java:108)
        at org.springframework.boot.loader.Launcher.launch(Launcher.java:58)
        at org.springframework.boot.loader.PropertiesLauncher.main(PropertiesLauncher.java:467)
en-milie commented 3 years ago

This is now fixed/addressed under: https://github.com/Endava/cats/commit/16e9456f608bafb36b3571964fde6eb25db4988f. Documentation updated to explain behaviour and encourage setting reasonable maxLength values: https://github.com/Endava/cats#stringfieldsrightboundaryfuzzer

jamesfulford commented 3 years ago

If you put out another release, I'll download the jar and test it out

en-milie commented 3 years ago

Try this one: https://github.com/Endava/cats/releases/tag/cats-6.0.3 Also, it will be helpful to have a complete request schema definition for #10

jamesfulford commented 3 years ago

Tried out 6.0.3, seems to be fixed. Thanks!