Add in OSS fuzzing

.github/workflows/sast.yml

@@ -1,10 +1,11 @@
 name: 'CodeQL'
 
 on:
-  push:
   pull_request:
+  push:
   schedule:
     - cron: '43 3 * * 5'
+  workflow_dispatch:
 
 permissions:
   contents: read

.github/workflows/tests.yml

@@ -14,7 +14,7 @@ permissions:
 
 jobs:
   tests:
-    name: Tests
+    name: Tests (unit & fuzz)
     runs-on: ubuntu-latest
 
     strategy:
@@ -34,4 +34,4 @@ jobs:
 
       - name: Unit tests
         run: |
-          npm run test:packages:unit
+          npm run test:packages:all

package.json

@@ -16,8 +16,10 @@
     "test:lint:ci": "ts-standard",
     "test:unit": "cd packages/$PACKAGE && npm run test:unit",
     "test:benchmark": "cd packages/$PACKAGE && npm run test:benchmark",
-    "test:packages": "npm run test:packages:typings && npm run test:packages:unit",
-    "test:packages:unit": "node --test --experimental-test-coverage ./packages/**/__tests__/*.js",
+    "test:packages": "npm run test:packages:typings && npm run test:packages:all",
+    "test:packages:all": "node --test --experimental-test-coverage ./packages/**/__tests__/*.js",
+    "test:packages:unit": "node --test --experimental-test-coverage ./packages/**/__tests__/index.js",
+    "test:packages:fuzz": "node --test --experimental-test-coverage ./packages/**/__tests__/fuzz.js",
     "test:packages:benchmark": "npm run test:benchmark --workspaces",
     "test:packages:typings": "ls packages | xargs -I {} tsd packages/{}",
     "test:llrt": "cd llrt && npm test",
@@ -58,13 +60,14 @@
     "@commitlint/cli": "^19.0.0",
     "@commitlint/config-conventional": "^19.0.0",
     "aws-sdk-client-mock": "^4.0.0",
+    "fast-check": "^3.0.0",
     "husky": "^9.0.0",
     "lint-staged": "^15.0.0",
     "prettier": "^3.0.0",
     "tinybench": "^3.0.0",
     "ts-standard": "^12.0.0",
     "tsd": "^0.31.0",
-    "typescript": "^5.4.3"
+    "typescript": "^5.0.0"
   },
   "workspaces": [
     "packages/*"

packages/appconfig/__tests__/fuzz.js

@@ -0,0 +1,23 @@
+import { test } from 'node:test'
+import fc from 'fast-check'
+import middy from '../../core/index.js'
+import middleware from '../index.js'
+
+const handler = middy((event) => event).use(middleware())
+const context = {
+  getRemainingTimeInMillis: () => 1000
+}
+
+test('fuzz `event` w/ `object`', async () => {
+  fc.assert(
+    fc.asyncProperty(fc.object(), async (event) => {
+      await handler(event, context)
+    }),
+    {
+      numRuns: 100_000,
+      verbose: 2,
+
+      examples: []
+    }
+  )
+})

packages/appconfig/package.json

@@ -28,8 +28,9 @@
     "index.d.ts"
   ],
   "scripts": {
-    "test": "npm run test:unit",
+    "test": "npm run test:unit && npm run test:fuzz",
     "test:unit": "node --test __tests__/index.js",
+    "test:fuzz": "node --test __tests__/fuzz.js",
     "test:benchmark": "node __benchmarks__/index.js"
   },
   "license": "MIT",

packages/cloudwatch-metrics/__tests__/fuzz.js

@@ -0,0 +1,23 @@
+import { test } from 'node:test'
+import fc from 'fast-check'
+import middy from '../../core/index.js'
+// import middleware from '../index.js' // TODO needs mocking
+
+const handler = middy((event) => event) // .use(middleware())
+const context = {
+  getRemainingTimeInMillis: () => 1000
+}
+
+test('fuzz `event` w/ `object`', async () => {
+  fc.assert(
+    fc.asyncProperty(fc.object(), async (event) => {
+      await handler(event, context)
+    }),
+    {
+      numRuns: 100_000,
+      verbose: 2,
+
+      examples: []
+    }
+  )
+})

packages/cloudwatch-metrics/package.json

@@ -28,8 +28,9 @@
     "index.d.ts"
   ],
   "scripts": {
-    "test": "npm run test:unit",
+    "test": "npm run test:unit && npm run test:fuzz",
     "test:unit": "node --test __tests__/index.js",
+    "test:fuzz": "node --test __tests__/fuzz.js",
     "test:benchmark": "node __benchmarks__/index.js"
   },
   "license": "MIT",

packages/core/__tests__/fuzz.js

@@ -0,0 +1,22 @@
+import { test } from 'node:test'
+import fc from 'fast-check'
+import middy from '../index.js'
+
+const handler = middy((event) => event)
+const context = {
+  getRemainingTimeInMillis: () => 1000
+}
+
+test('fuzz `event` w/ `object`', async () => {
+  fc.assert(
+    fc.asyncProperty(fc.object(), async (event) => {
+      await handler(event, context)
+    }),
+    {
+      numRuns: 100_000,
+      verbose: 2,
+
+      examples: []
+    }
+  )
+})

packages/core/package.json

@@ -28,8 +28,9 @@
     "index.d.ts"
   ],
   "scripts": {
-    "test": "npm run test:unit",
+    "test": "npm run test:unit && npm run test:fuzz",
     "test:unit": "node --test __tests__/index.js",
+    "test:fuzz": "node --test __tests__/fuzz.js",
     "test:benchmark": "node __benchmarks__/index.js",
     "test:profile": "node --prof __benchmarks__/index.js && node --prof-process --preprocess -j isolate*.log | speedscope -"
   },

packages/do-not-wait-for-empty-event-loop/__tests__/fuzz.js

@@ -0,0 +1,23 @@
+import { test } from 'node:test'
+import fc from 'fast-check'
+import middy from '../../core/index.js'
+import middleware from '../index.js'
+
+const handler = middy((event) => event).use(middleware())
+const context = {
+  getRemainingTimeInMillis: () => 1000
+}
+
+test('fuzz `event` w/ `object`', async () => {
+  fc.assert(
+    fc.asyncProperty(fc.object(), async (event) => {
+      await handler(event, context)
+    }),
+    {
+      numRuns: 100_000,
+      verbose: 2,
+
+      examples: []
+    }
+  )
+})

packages/do-not-wait-for-empty-event-loop/package.json

@@ -28,8 +28,9 @@
     "index.d.ts"
   ],
   "scripts": {
-    "test": "npm run test:unit",
+    "test": "npm run test:unit && npm run test:fuzz",
     "test:unit": "node --test __tests__/index.js",
+    "test:fuzz": "node --test __tests__/fuzz.js",
     "test:benchmark": "node __benchmarks__/index.js"
   },
   "license": "MIT",

packages/dynamodb/__tests__/fuzz.js

@@ -0,0 +1,23 @@
+import { test } from 'node:test'
+import fc from 'fast-check'
+import middy from '../../core/index.js'
+import middleware from '../index.js'
+
+const handler = middy((event) => event).use(middleware())
+const context = {
+  getRemainingTimeInMillis: () => 1000
+}
+
+test('fuzz `event` w/ `object`', async () => {
+  fc.assert(
+    fc.asyncProperty(fc.object(), async (event) => {
+      await handler(event, context)
+    }),
+    {
+      numRuns: 100_000,
+      verbose: 2,
+
+      examples: []
+    }
+  )
+})

packages/dynamodb/package.json

@@ -28,8 +28,9 @@
     "index.d.ts"
   ],
   "scripts": {
-    "test": "npm run test:unit",
+    "test": "npm run test:unit && npm run test:fuzz",
     "test:unit": "node --test __tests__/index.js",
+    "test:fuzz": "node --test __tests__/fuzz.js",
     "test:benchmark": "node __benchmarks__/index.js"
   },
   "license": "MIT",

packages/error-logger/__tests__/fuzz.js

@@ -0,0 +1,23 @@
+import { test } from 'node:test'
+import fc from 'fast-check'
+import middy from '../../core/index.js'
+import middleware from '../index.js'
+
+const handler = middy((event) => event).use(middleware())
+const context = {
+  getRemainingTimeInMillis: () => 1000
+}
+
+test('fuzz `event` w/ `object`', async () => {
+  fc.assert(
+    fc.asyncProperty(fc.object(), async (event) => {
+      await handler(event, context)
+    }),
+    {
+      numRuns: 100_000,
+      verbose: 2,
+
+      examples: []
+    }
+  )
+})

packages/error-logger/package.json

@@ -28,8 +28,9 @@
     "index.d.ts"
   ],
   "scripts": {
-    "test": "npm run test:unit",
+    "test": "npm run test:unit && npm run test:fuzz",
     "test:unit": "node --test __tests__/index.js",
+    "test:fuzz": "node --test __tests__/fuzz.js",
     "test:benchmark": "node __benchmarks__/index.js"
   },
   "license": "MIT",

packages/event-normalizer/__tests__/fuzz.js

@@ -0,0 +1,23 @@
+import { test } from 'node:test'
+import fc from 'fast-check'
+import middy from '../../core/index.js'
+import middleware from '../index.js'
+
+const handler = middy((event) => event).use(middleware())
+const context = {
+  getRemainingTimeInMillis: () => 1000
+}
+
+test('fuzz `event` w/ `object`', async () => {
+  fc.assert(
+    fc.asyncProperty(fc.object(), async (event) => {
+      await handler(event, context)
+    }),
+    {
+      numRuns: 100_000,
+      verbose: 2,
+
+      examples: []
+    }
+  )
+})

packages/event-normalizer/package.json

@@ -28,8 +28,9 @@
     "index.d.ts"
   ],
   "scripts": {
-    "test": "npm run test:unit",
+    "test": "npm run test:unit && npm run test:fuzz",
     "test:unit": "node --test __tests__/index.js",
+    "test:fuzz": "node --test __tests__/fuzz.js",
     "test:benchmark": "node __benchmarks__/index.js"
   },
   "license": "MIT",

packages/http-content-encoding/__tests__/fuzz.js

@@ -0,0 +1,43 @@
+import { test } from 'node:test'
+import fc from 'fast-check'
+import middy from '../../core/index.js'
+import middleware from '../index.js'
+
+const handler = middy((event) => event).use(middleware())
+const context = {
+  getRemainingTimeInMillis: () => 1000,
+  preferredEncoding: 'br'
+}
+
+test('fuzz `event` w/ `object`', async () => {
+  fc.assert(
+    fc.asyncProperty(fc.object(), async (event) => {
+      await handler(event, context)
+    }),
+    {
+      numRuns: 100_000,
+      verbose: 2,
+
+      examples: []
+    }
+  )
+})
+
+test('fuzz `event` w/ `record`', async () => {
+  fc.assert(
+    fc.asyncProperty(
+      fc.record({
+        body: fc.anything()
+      }),
+      async (event) => {
+        await handler(event, context)
+      }
+    ),
+    {
+      numRuns: 100_000,
+      verbose: 2,
+
+      examples: []
+    }
+  )
+})

packages/http-content-encoding/index.js

@@ -45,8 +45,8 @@ const httpContentEncodingMiddleware = (opts) => {
 
     // Encoding not supported, already encoded, or doesn't need to'
     const eventCacheControl =
-      request.event.headers['cache-control'] ??
-      request.event.headers['Cache-Control']
+      request.event?.headers?.['cache-control'] ??
+      request.event?.headers?.['Cache-Control']
     if (eventCacheControl?.includes('no-transform')) {
       addHeaderPart(response, 'Cache-Control', 'no-transform')
     }
@@ -57,6 +57,9 @@ const httpContentEncodingMiddleware = (opts) => {
       !preferredEncoding ||
       !supportedContentEncodings.includes(preferredEncoding) ||
       !response.body ||
+      (typeof response.body !== 'string' &&
+        !Buffer.isBuffer(response.body) &&
+        !response.body?._readableState) ||
       responseCacheControl?.includes('no-transform')
     ) {
       return

packages/http-content-encoding/package.json

@@ -28,8 +28,9 @@
     "index.d.ts"
   ],
   "scripts": {
-    "test": "npm run test:unit",
+    "test": "npm run test:unit && npm run test:fuzz",
     "test:unit": "node --test __tests__/index.js",
+    "test:fuzz": "node --test __tests__/fuzz.js",
     "test:benchmark": "node __benchmarks__/index.js"
   },
   "license": "MIT",