Blame for tests/api_fuzz.test.js

import test from 'node:test';
import assert from 'node:assert/strict';

import {
  generateMutationSuite,
  auditApiFuzzResilience,
  BOUNDARY_INTEGER_PAYLOADS,
  PROTOTYPE_POLLUTION_PAYLOADS
} from '../dist/fuzz/api_fuzz.js';
import { synthesizeAndInjectPatch, synthesizeAndVerifyPatch } from '../dist/patch/patch_engine.js';
import { runInCanarySandbox } from '../dist/sandbox/canary_sandbox.js';
import { executeCanaryVerification } from '../dist/sandbox/canary_runner.js';
import { createVulnForgeServer } from '../dist/mcp/server.js';
import { CallToolRequestSchema, ListToolsRequestSchema } from '@modelcontextprotocol/sdk/types.js';

test('Fuzz Generator: generateMutationSuite generates all strategy test cases', () => {
  const fields = { id: 'number', name: 'string', metadata: 'object' };
  const mutations = generateMutationSuite(fields, 'ALL', 5);

  assert.ok(mutations.length > 10, 'Should generate multiple mutation cases');
  assert.ok(
    mutations.some((m) => m.mutationType === 'BOUNDARY_INT'),
    'Should include boundary integer mutations'
  );
  assert.ok(
    mutations.some((m) => m.mutationType === 'TYPE_CONFUSION'),
    'Should include type confusion mutations'
  );
  assert.ok(
    mutations.some((m) => m.mutationType === 'PROTOTYPE_POLLUTION'),
    'Should include prototype pollution mutations'
  );
  assert.ok(
    mutations.some((m) => m.mutationType === 'OVERSIZED_PAYLOAD' || m.mutationType === 'MALFORMED_ENCODING'),
    'Should include encoding / oversized payload mutations'
  );
});

test('API Fuzz Auditor: Detects missing schema validation on request body (CWE-20)', () => {
  const code = `
    app.post('/api/checkout', (req, res) => {
      const { itemId, quantity, userToken } = req.body;
      res.json({ status: 'ok', itemId, quantity });
    });
  `;
  const result = auditApiFuzzResilience({ routeCode: code });

  assert.equal(result.complianceStatus, 'FAIL');
  assert.ok(
    result.findings.some((f) => f.id === 'API-FUZZ-MISSING-SCHEMA-VALIDATION'),
    'Should report missing schema validation finding'
  );
  assert.equal(result.summary.missingSchemaValidationCount, 1);
});

test('API Fuzz Auditor: Detects prototype pollution in unsafe object merge (CWE-1321)', () => {
  const code = `
    app.post('/api/settings', (req, res) => {
      const userSettings = {};
      Object.assign(userSettings, req.body);
      res.json({ updated: true });
    });
  `;
  const result = auditApiFuzzResilience({ routeCode: code });

  assert.equal(result.complianceStatus, 'FAIL');
  assert.ok(
    result.findings.some((f) => f.id === 'API-FUZZ-PROTOTYPE-POLLUTION'),
    'Should detect prototype pollution finding'
  );
  assert.equal(result.summary.prototypePollutionRisks, 1);
});

test('API Fuzz Auditor: Detects unhandled async exception in route handler (CWE-754)', () => {
  const code = `
    app.post('/api/transfer', async (req, res) => {
      const result = await bankService.sendMoney(req.body);
      res.json(result);
    });
  `;
  const result = auditApiFuzzResilience({ routeCode: code });

  assert.ok(
    result.findings.some((f) => f.id === 'API-FUZZ-UNHANDLED-ASYNC-EXCEPTION'),
    'Should detect unhandled async exception risk'
  );
  assert.equal(result.summary.unhandledExceptionRisks, 1);
});

test('API Fuzz Auditor: Detects unrestricted JSON body parser size (CWE-400)', () => {
  const code = `
    const app = express();
    app.use(express.json());
  `;
  const result = auditApiFuzzResilience({ routeCode: code });

  assert.ok(
    result.findings.some((f) => f.id === 'API-FUZZ-BODY-PARSER-UNRESTRICTED-SIZE'),
    'Should detect unrestricted body parser size'
  );
  assert.equal(result.summary.oversizedPayloadDosRisks, 1);
});

test('API Fuzz Auditor: Detects unbounded integer parsing (CWE-190)', () => {
  const code = `
    app.get('/api/items', (req, res) => {
      const offset = parseInt(req.query.offset);
      res.json({ offset });
    });
  `;
  const result = auditApiFuzzResilience({ routeCode: code });

  assert.ok(
    result.findings.some((f) => f.id === 'API-FUZZ-UNBOUNDED-INTEGER-PARSE'),
    'Should detect unbounded integer parse'
  );
  assert.equal(result.summary.typeConfusionRisks, 1);
});

test('API Fuzz Auditor: Fully hardened and validated API endpoint passes cleanly', () => {
  const hardenedCode = `
    import { z } from 'zod';
    const UserSchema = z.object({
      id: z.number().int().min(1).max(10000),
      username: z.string().min(3).max(50)
    }).strict();

    app.post('/api/user', async (req, res, next) => {
      try {
        const validated = UserSchema.parse(req.body);
        const safeTarget = JSON.parse(JSON.stringify(validated, (k, v) => (k === '__proto__' ? undefined : v)));
        res.json({ user: safeTarget });
      } catch (err) {
        next(err);
      }
    });
  `;
  const result = auditApiFuzzResilience({ routeCode: hardenedCode });

  assert.equal(result.complianceStatus, 'PASS');
  assert.equal(result.totalFindings, 0);
});

test('Patch Engine: Injects Zod schema validation guard into vulnerable handler', () => {
  const vulnerable = `
    const { username, email } = req.body;
  `;
  const patched = synthesizeAndInjectPatch({ sourceCode: vulnerable, filename: 'routes/user.ts' });

  assert.equal(patched.applied, true);
  assert.ok(patched.patchedCode.includes("import { z } from 'zod';"));
  assert.ok(patched.patchedCode.includes('BodySchema = z.object'));
  assert.ok(patched.findingsResolved.includes('API-FUZZ-MISSING-SCHEMA-VALIDATION'));
});

test('Patch Engine: Injects safe prototype pollution guard before Object.assign', () => {
  const vulnerable = `
    const target = {};
    Object.assign(target, req.body);
  `;
  const patched = synthesizeAndInjectPatch({ sourceCode: vulnerable, filename: 'routes/proto.ts' });

  assert.equal(patched.applied, true);
  assert.ok(patched.patchedCode.includes('const safeBody = JSON.parse'));
  assert.ok(patched.patchedCode.includes('__proto__'));
  assert.ok(patched.findingsResolved.includes('API-FUZZ-PROTOTYPE-POLLUTION'));
});

test('Patch Engine: Restricts body parser size limit to 100kb', () => {
  const vulnerable = `
    app.use(express.json());
  `;
  const patched = synthesizeAndInjectPatch({ sourceCode: vulnerable, filename: 'server.ts' });

  assert.equal(patched.applied, true);
  assert.ok(patched.patchedCode.includes("express.json({ limit: '100kb' })"));
  assert.ok(patched.findingsResolved.includes('API-FUZZ-BODY-PARSER-UNRESTRICTED-SIZE'));
});

test('Canary Sandbox: MockFuzzHarness records route invocations and validates prototype security', async () => {
  const code = `
    fuzzHarness.testRoute(() => {}, { body: { title: 'safe_post', __proto__: { polluted: false } } });
  `;
  const result = await runInCanarySandbox(code);

  assert.equal(result.success, true);
  assert.equal(result.fuzzHarness.executedRoutes.length, 1);
  assert.equal(result.fuzzHarness.executedRoutes[0].body.title, 'safe_post');
});

test('Canary Verification: Dual canary verifies API fuzzing patch mitigates vulnerability and preserves benign requests', async () => {
  const original = `
    const target = {};
    Object.assign(target, req.body);
  `;
  const patched = `
    const target = {};
    const safeBody = JSON.parse(JSON.stringify(req.body, (k, v) => (k === '__proto__' ? undefined : v)));
    Object.assign(target, safeBody);
  `;
  const canaryReport = await executeCanaryVerification({
    originalCode: original,
    patchedCode: patched,
    vulnType: 'API_FUZZ_RESILIENCE',
    attackPayload: '{"__proto__":{"polluted":true}}',
    benignPayload: '{"name":"valid_user"}'
  });

  assert.equal(canaryReport.canaryStatus, 'VERIFIED_SECURE');
  assert.equal(canaryReport.attackBlocked, true);
  assert.equal(canaryReport.benignPreserved, true);
});

test('MCP Server: Registers vulnforge_fuzz_api tool with comprehensive schema', async () => {
  const server = createVulnForgeServer();
  const listHandler = server._requestHandlers.get('tools/list');
  assert.ok(listHandler, 'ListTools handler must exist');

  const result = await listHandler({ method: 'tools/list', params: {} });
  const fuzzTool = result.tools.find((t) => t.name === 'vulnforge_fuzz_api');

  assert.ok(fuzzTool, 'vulnforge_fuzz_api tool must be registered');
  assert.ok(fuzzTool.inputSchema.properties.routeCode, 'routeCode property must be defined');
  assert.ok(fuzzTool.inputSchema.properties.fuzzStrategy, 'fuzzStrategy property must be defined');
});

test('MCP Server: vulnforge_fuzz_api executes and returns valid JSON security report', async () => {
  const server = createVulnForgeServer();
  const callHandler = server._requestHandlers.get('tools/call');
  assert.ok(callHandler, 'CallTool handler must exist');

  const sampleRoute = `app.post('/api/item', (req, res) => { const { name } = req.body; res.json({ name }); });`;
  const response = await callHandler(
    {
      method: 'tools/call',
      params: {
        name: 'vulnforge_fuzz_api',
        arguments: { routeCode: sampleRoute }
      }
    },
    {}
  );

  assert.ok(response.content && response.content[0].text);
  const parsed = JSON.parse(response.content[0].text);
  assert.equal(parsed.complianceStatus, 'FAIL');
  assert.ok(parsed.totalFindings > 0);
  assert.ok(parsed.summary.endpointsAudited >= 1);
});

test('MCP Server: vulnforge_full_scan processes fuzzRouteCode and attaches findings', async () => {
  const server = createVulnForgeServer();
  const callHandler = server._requestHandlers.get('tools/call');
  assert.ok(callHandler, 'CallTool handler must exist');

  const sampleRoute = `app.post('/api/order', (req, res) => { const { amount } = req.body; res.json({ amount }); });`;
  const response = await callHandler(
    {
      method: 'tools/call',
      params: {
        name: 'vulnforge_full_scan',
        arguments: { fuzzRouteCode: sampleRoute }
      }
    },
    {}
  );

  assert.ok(response.content && response.content[0].text);
  const summary = JSON.parse(response.content[0].text);
  assert.ok(summary.totalFindings > 0);
  assert.ok(summary.findings.some((f) => f.category === 'api_fuzzing'));
});