Fuzzing menyisipkan input aneh, rusak, besar, tidak lengkap, salah format, atau tidak terduga ke boundary sistem.

Sistem tidak boleh crash, hang, leak memory, corrupt state, melakukan side effect berbahaya, atau menerima data invalid sebagai valid hanya karena input tidak normal.

If external input can cross the boundary, fuzz the boundary.

random bytes
malformed JSON
truncated XML
invalid UTF-8
very large strings
nested objects
unexpected enum values
negative numbers
boundary numbers
NaN/Infinity
null-like values
control characters
recursive payloads
serialized objects
invalid protocol frames

Untuk semua input valid yang digenerate, apakah property benar?

Untuk input yang mungkin kacau, apakah program tetap aman dan terkendali?

Fuzzer generates JSON bytes.
Parser either rejects safely or produces command.
If command produced, property checks command invariant.

valid input diterima dengan benar
invalid input ditolak dengan jelas
malformed input tidak crash/hang
unknown input tidak corrupt state
large input dibatasi
partial input tidak menghasilkan side effect
error tidak membocorkan rahasia

Input boundary harus total function secara operational.
Untuk setiap input bytes, sistem harus punya outcome terkendali:
  accept valid input
  reject invalid input
  fail closed with safe error

B + C: parse + validate + canonicalize

Fuzz untrusted input boundary first.
Then fuzz canonical command handlers with generated valid/invalid commands.

<dependency>
    <groupId>com.code-intelligence</groupId>
    <artifactId>jazzer-junit</artifactId>
    <version>${jazzer.version}</version>
    <scope>test</scope>
</dependency>

import com.code_intelligence.jazzer.junit.FuzzTest;
import com.code_intelligence.jazzer.api.FuzzedDataProvider;

class CasePayloadFuzzTest {

    private final CasePayloadParser parser = new CasePayloadParser();

    @FuzzTest
    void parserNeverCrashesOnArbitraryInput(FuzzedDataProvider data) {
        String input = data.consumeRemainingAsString();

        try {
            ParseResult result = parser.parse(input);

            if (result.isAccepted()) {
                assertValidCanonicalCommand(result.command());
            }
        } catch (InvalidPayloadException expected) {
            // safe rejection
        }
    }

    private static void assertValidCanonicalCommand(CreateCaseCommand command) {
        assertThat(command.caseType()).isNotBlank();
        assertThat(command.requestId()).isNotNull();
        assertThat(command.subject()).isNotNull();
    }
}

Do not catch Throwable.
Do not hide NullPointerException, OutOfMemoryError, StackOverflowError, AssertionError, or security-relevant failures.

unexpected RuntimeException
AssertionError from invariant violation
StackOverflowError
OutOfMemoryError
hang/timeout
accepted invalid command
unsafe side effect
secret in error message
path traversal accepted
SSRF-protected URL accepted
malformed input stored as canonical state

InvalidPayloadException
ValidationException with safe message
ParseResult.rejected(...)
HTTP 400 equivalent
schema validation error

@FuzzTest
void fuzz(String input) {
    try {
        parser.parse(input);
    } catch (Exception ignored) {
    }
}

@FuzzTest
void parserEitherRejectsSafelyOrProducesValidCommand(String input) {
    try {
        CreateCaseCommand command = parser.parse(input);

        assertThat(command.requestId()).isNotNull();
        assertThat(command.caseType()).isIn(AllowedCaseTypes.values());
        assertThat(command.subject()).hasSizeBetween(1, 500);
    } catch (InvalidPayloadException expected) {
        assertThat(expected.getMessage()).doesNotContain("password", "secret", "token");
    }
}

@FuzzTest
void parseIsSafeForAllInputs(byte[] bytes) {
    ParseOutcome outcome = parser.parse(bytes);

    switch (outcome.kind()) {
        case ACCEPTED -> assertCanonical(outcome.value());
        case REJECTED -> assertSafeRejection(outcome.error());
    }
}

sealed interface ParseOutcome<T> permits Accepted, Rejected {
    boolean accepted();
}

record Accepted<T>(T value) implements ParseOutcome<T> {
    public boolean accepted() { return true; }
}

record Rejected<T>(String code, String safeMessage) implements ParseOutcome<T> {
    public boolean accepted() { return false; }
}

empty input
truncated object
huge nesting
huge arrays
duplicate fields
unknown fields
null for required field
number overflow
string where number expected
boolean where string expected
unicode normalization
control characters
large string fields
ambiguous enum values
case-sensitive enum mismatch

@FuzzTest
void createCaseJsonEitherRejectsOrProducesValidCommand(FuzzedDataProvider data) {
    String json = data.consumeRemainingAsString();

    try {
        CreateCaseCommand command = mapper.readValue(json, CreateCaseCommand.class);
        validator.validate(command).throwIfInvalid();

        assertThat(command.requestId()).isNotNull();
        assertThat(command.caseType()).isIn(CaseType.values());
        assertThat(command.description()).hasSizeLessThanOrEqualTo(4_000);
    } catch (JsonProcessingException | ValidationException expected) {
        // Safe rejection: parser/validator rejects invalid payload.
    }
}

external entity resolution
entity expansion
DTD handling
namespace confusion
XPath injection-like behavior
XSLT execution settings
large tree memory pressure
mixed content ambiguity
encoding confusion

@FuzzTest
void xmlImportRejectsMalformedOrUnsafeXml(byte[] bytes) {
    try {
        ImportedCase imported = xmlImporter.importCase(bytes);

        assertThat(imported.caseId()).isNotNull();
        assertThat(imported.events()).allSatisfy(event ->
            assertThat(event.timestamp()).isNotNull()
        );
    } catch (InvalidXmlException expected) {
        assertThat(expected.getSafeMessage()).doesNotContain("file:", "http:", "secret");
    }
}

Disable external entity resolution unless explicitly required.
Disable unsafe DTD behavior unless required.
Limit input size.
Limit parse depth where possible.
Treat XML import as untrusted.

quoted commas
escaped quotes
newlines inside fields
missing columns
extra columns
header mismatch
BOM/encoding
very long field
formula injection
invalid date format
numeric overflow
column shift
empty rows

@FuzzTest
void csvImportNeverPartiallyCommitsMalformedFile(String content) {
    InMemoryCaseRepository repository = new InMemoryCaseRepository();
    InMemoryOutbox outbox = new InMemoryOutbox();
    CaseCsvImporter importer = new CaseCsvImporter(repository, outbox);

    ImportResult result = importer.importCsv(content);

    if (result.isRejected()) {
        assertThat(repository.savedCases()).isEmpty();
        assertThat(outbox.events()).isEmpty();
        assertThat(result.error().safeMessage()).doesNotContain("Exception", "stacktrace");
    } else {
        assertThat(repository.savedCases())
            .allSatisfy(CaseAssertions::assertValidImportedCase);
    }
}

Malformed file must not partially commit state unless import mode explicitly supports partial acceptance.

localhost
127.0.0.1
0.0.0.0
::1
private IP ranges
DNS rebinding
userinfo syntax
encoded host
mixed case scheme
scheme confusion
redirect chains
trailing dots
IPv6 brackets
unicode confusables

@FuzzTest
void callbackUrlPolicyNeverAllowsInternalTargets(String raw) {
    UrlDecision decision = policy.evaluate(raw);

    if (decision.isAllowed()) {
        URI uri = decision.normalizedUri();

        assertThat(uri.getScheme()).isIn("https");
        assertThat(networkClassifier.classify(uri)).isEqualTo(NetworkZone.PUBLIC_INTERNET);
        assertThat(uri.getUserInfo()).isNull();
    }
}

Do not perform real network calls inside fuzz test.
Classify syntactically or with mocked deterministic resolver.

invalid dates
leap years
timezone offsets
DST gaps/overlaps
ambiguous local times
very old dates
far future dates
epoch millis overflow
locale-sensitive parsing
partial dates

@FuzzTest
void deadlineParserRejectsInvalidOrOutOfPolicyDates(String raw) {
    try {
        Deadline deadline = DeadlineParser.parse(raw, ZoneId.of("UTC"));

        assertThat(deadline.instant()).isAfter(Instant.parse("2000-01-01T00:00:00Z"));
        assertThat(deadline.instant()).isBefore(Instant.parse("2100-01-01T00:00:00Z"));
    } catch (InvalidDeadlineException expected) {
        assertThat(expected.code()).isIn("invalid_format", "out_of_range", "ambiguous_time");
    }
}

Do not fuzz date parsing without clear date policy.
Otherwise every weird date becomes debate instead of signal.

unexpected type resolution
resource explosion
recursive object graphs
class loading issue
unsafe gadget-like behavior
validation bypass
post-deserialization invariant violation

@FuzzTest
void serializedCommandDecoderFailsClosed(byte[] bytes) {
    DecodeResult result = decoder.decode(bytes);

    if (result.accepted()) {
        Command command = result.command();
        assertThat(command).satisfies(CommandAssertions::assertCanonical);
    } else {
        assertThat(result.errorCode()).isIn(
            "malformed_payload",
            "unsupported_type",
            "size_limit_exceeded",
            "validation_failed"
        );
    }
}

Decode into safe DTO/canonical command, then validate.
Never trust object graph just because deserialization succeeded.

consumer crash loop
message endlessly retried
DLQ missing
invalid event accepted
schema compatibility bug
out-of-order event corrupts projection
huge payload blocks partition

@FuzzTest
void consumerCoreHandlesArbitraryPayloadSafely(byte[] payload) {
    InMemoryDeadLetterQueue dlq = new InMemoryDeadLetterQueue();
    InMemoryProjection projection = new InMemoryProjection();
    CaseEventConsumerCore consumer = new CaseEventConsumerCore(projection, dlq);

    ConsumerOutcome outcome = consumer.handle(payload);

    switch (outcome.kind()) {
        case APPLIED -> assertThat(projection.records()).allSatisfy(ProjectionAssertions::assertValid);
        case REJECTED -> assertThat(dlq.messages()).hasSize(1);
        case IGNORED -> assertThat(projection.records()).isEmpty();
    }
}

Invalid message must not crash consumer and must not corrupt projection.

valid minimal payload
valid full payload
payload with optional fields
payload with max-size fields
payload with unknown field
payload with null field
payload with nested object
payload with array boundary

valid document
missing required element
unknown namespace
large repeated elements
encoded characters
empty document
DTD sample if parser policy rejects it

valid header only
one valid row
quoted comma
escaped quote
newline in field
extra column
missing column
large field

Seeds should represent structure. Fuzzer mutations explore variations.

{
}
[
]
:
,
"caseId"
"caseType"
"requestId"
"description"
null
true
false

<case>
</case>
<!DOCTYPE
<!ENTITY
xmlns
CDATA

http://
https://
localhost
127.0.0.1
%2f
@
:
//
[::1]

fuzzer finds crash
save reproducer input
minimize input if possible
write deterministic regression test
fix bug
keep reproducer in corpus

@Test
void regression_duplicateFieldWithNullDoesNotBypassValidation() {
    String payload = """
        {
          "requestId": "REQ-1",
          "caseType": "ENFORCEMENT",
          "caseType": null
        }
        """;

    assertThatThrownBy(() -> parser.parse(payload))
        .isInstanceOf(InvalidPayloadException.class)
        .hasMessageContaining("caseType");
}

unbounded input size
unbounded recursion
unbounded collection growth
unbounded regex backtracking
unbounded decompression
unbounded parse depth
unbounded thread creation
unbounded retry loop
real network calls
real database writes

No real network.
No real database.
No real filesystem writes except controlled temp dir.
No sleeps.
No background threads left running.
No infinite retries.
No production credentials.
No destructive side effects.

Pattern.compile("(a+)+$");

@FuzzTest
void caseReferenceRegexDoesNotHang(String input) {
    boolean matches = CaseReferencePattern.matches(input);

    if (matches) {
        assertThat(input).startsWith("CASE-");
        assertThat(input.length()).isLessThanOrEqualTo(32);
    }
}

parser.parse(bytes)
validator.validate(command)
policy.evaluate(rawUrl)
consumerCore.handle(payload)

fast
deterministic
good for CI
no network
precise reproducer

exercises real HTTP stack
finds binding/config issues
validates response safety

slower
harder to minimize
requires environment
side effect risk
more noise

Use in-process fuzzing for core boundary logic.
Use API fuzzing selectively for deployed boundary behavior.

Every request should produce one of:
  valid 2xx/4xx response with safe body
  never 5xx for client-controlled malformed input unless dependency failure is simulated

@FuzzTest
void httpRequestBinderRejectsMalformedCreateCasePayload(String body) {
    HttpRequest request = HttpRequestFixture.post("/cases")
        .contentType("application/json")
        .body(body);

    HttpResponse response = controller.handle(request);

    assertThat(response.status()).isIn(201, 400, 422);
    assertThat(response.body()).doesNotContain("Exception", "stacktrace", "password", "secret");
}

If input accepted, canonical output must satisfy domain constraints.

parse(serialize(x)) == x

Known invalid patterns must never be accepted.

Rejected input must not persist state, emit event, or write audit as success.

Error body must not contain stacktrace/secrets/internal path.

Input beyond configured size/depth must be rejected quickly.

private static void assertRejectedSafely(ImportResult result, FakeRepository repo, FakeOutbox outbox) {
    assertThat(result.isRejected()).isTrue();
    assertThat(repo.savedRecords()).isEmpty();
    assertThat(outbox.events()).isEmpty();
    assertThat(result.error().safeMessage())
        .doesNotContain("java.", "Exception", "stacktrace", "password", "token");
}

upload chunk 1
upload chunk 3
complete upload
retry chunk 1
cancel upload
complete again

@FuzzTest
void uploadSessionNeverViolatesStateInvariants(FuzzedDataProvider data) {
    UploadSession session = UploadSession.start(SessionId.newId());

    int steps = data.consumeInt(0, 50);
    for (int i = 0; i < steps; i++) {
        UploadCommand command = generateCommand(data);
        try {
            session = session.handle(command);
        } catch (InvalidTransitionException expected) {
            // safe rejection
        }

        assertUploadSessionInvariants(session);
    }
}

Write fuzz target.
Extract deterministic harness into normal test style.
Run mutation testing against parser/validator.
If mutants survive, fuzz oracle may be too weak.

Fuzz test catches crashes only.
PIT shows validation boundary mutants survive.
Improve fuzz oracle to assert accepted commands satisfy all invariants.

short duration
critical targets only
no network/database
fail on crash
store reproducer artifact

run selected fuzz tests for 30-120 seconds each

longer duration
larger corpus
more targets
coverage growth tracking
artifact retention

critical boundary fuzzing
known corpus replay
security-sensitive parser targets
regression corpus included

run one target while fixing parser/validator
replay known crash input
minimize failing input

failing input/reproducer
seed corpus version
target name
git commit
exception stacktrace
resource limit hit if any

src/test/resources/fuzz-corpus/
  create-case-json/
    valid-minimal.json
    valid-full.json
    missing-required.json
    null-required.json
    duplicate-field.json
  xml-import/
    valid.xml
    doctype-rejected.xml
    namespace-edge.xml
  csv-import/
    valid-one-row.csv
    quoted-newline.csv
    missing-column.csv

Keep corpus small and meaningful.
Add minimized regressions.
Do not commit huge generated corpus blindly.
Review corpus diffs.
Name seeds by behavior.
Separate seeds from generated crash artifacts.

{
  "error": "java.lang.NullPointerException at com.acme.SecretTokenValidator...",
  "debug": "databasePassword=..."
}

{
  "code": "invalid_payload",
  "message": "Request payload is invalid.",
  "correlationId": "..."
}

private static void assertSafeError(ApiResponse response) {
    assertThat(response.status()).isBetween(400, 499);
    assertThat(response.body()).doesNotContain(
        "NullPointerException",
        "SQLException",
        "stacktrace",
        "password",
        "secret",
        "token",
        "/home/",
        "C:\\"
    );
}

maximum input size
maximum nesting/depth
accepted encodings
unknown field policy
duplicate field policy
null policy
number range
string length
date range
allowed schemes/hosts
partial import behavior
error response format
side effect policy on rejection

Bug: implementation violates known policy.
Spec gap: no known policy exists.
Test issue: fuzz target hides or misclassifies outcome.
Tool issue: framework configuration mismatch.

catch (Throwable ignored) {}

POST /cases/intake
Content-Type: application/json

requestId required
caseType must be known
description length <= 4000
reportedAt must be within allowed range
subject must have at least one identifier
attachments optional but must have safe metadata
unknown fields rejected
invalid payload must not create case

@FuzzTest
void intakePayloadEitherRejectedSafelyOrCreatesCanonicalDraft(String body) {
    FakeCaseRepository repository = new FakeCaseRepository();
    FakeOutbox outbox = new FakeOutbox();
    IntakeController controller = TestIntakeControllerFactory.create(repository, outbox);

    ApiResponse response = controller.postIntake(body);

    if (response.status() == 201) {
        assertThat(repository.savedCases()).singleElement()
            .satisfies(saved -> {
                assertThat(saved.status()).isEqualTo(CaseStatus.DRAFT);
                assertThat(saved.requestId()).isNotNull();
                assertThat(saved.description()).hasSizeLessThanOrEqualTo(4_000);
            });

        assertThat(outbox.events()).singleElement()
            .satisfies(event -> assertThat(event.type()).isEqualTo("case.intake.accepted"));
    } else {
        assertThat(response.status()).isIn(400, 422);
        assertSafeError(response);
        assertThat(repository.savedCases()).isEmpty();
        assertThat(outbox.events()).isEmpty();
    }
}

no server crash
valid accepted output
safe rejected output
no partial side effect on rejection
safe error message

payload_rejected_total{reason="invalid_json"}
payload_rejected_total{reason="size_limit"}
payload_rejected_total{reason="unknown_case_type"}
intake_payload_size_bytes
intake_parse_duration_ms
intake_validation_failure_total

Do not label metrics with raw invalid value.
Do not label by requestId.
Do not label by user-controlled string.

Fuzzing finds malformed classes.
Production metrics show real malformed frequency.
Regression corpus includes representative production-safe samples.
Boundary policy improves.

[ ] Identify trust boundary.
[ ] Define valid vs invalid input.
[ ] Define safe rejection.
[ ] Define resource limits.
[ ] Replace side effects with fakes.
[ ] Build seed corpus.
[ ] Decide which exceptions are expected.
[ ] Add semantic assertions for accepted input.
[ ] Add no-side-effect assertions for rejected input.
[ ] Ensure failure reproducer is stored.

[ ] Does fuzz target catch only expected domain exceptions?
[ ] Does it avoid real network/database/filesystem side effects?
[ ] Does it assert canonical invariants?
[ ] Does it assert safe error messages?
[ ] Does it handle resource bounds?
[ ] Are seeds meaningful?
[ ] Are discovered crashes turned into regression tests?

requestId required
caseType enum required
description 1..4000 chars
unknown fields rejected
null required fields rejected

valid file imports all rows
invalid row rejects whole file
rejection must not persist partial state

only https
no localhost
no private IP
no userinfo
no empty host

1. Fuzz boundaries before internals.
2. Accepted malformed input is often worse than rejected valid input.
3. Invalid input must fail closed and leave no partial side effect.
4. A fuzz target without oracle is just crash fishing.
5. Crash finding is useful; semantic invariant checking is better.
6. Use structured seeds to unlock meaningful paths.
7. Always save and minimize reproducers.
8. Never fuzz with real external side effects.
9. Convert fuzz failures into deterministic regression tests.
10. Combine fuzzing, property testing, mutation testing, and contract testing for critical boundaries.

Can our tests detect wrong code?

Can our code survive hostile or malformed input?