Description
backend/src/validators/invoices.ts, bids.ts, settlements.ts, and shared.ts use Zod to validate input. Existing tests are example-based. We need property-based fuzz tests that generate malformed payloads (unicode classes, very large ints, deeply nested objects, prototype-pollution attempts) and assert that the validator either accepts or rejects each — never throws an unhandled error.
Requirements and context
- Use
fast-check arbitraries.
- Cover every exported schema in
backend/src/validators/*.ts.
- Specifically assert prototype-pollution attempts (
__proto__, constructor) cannot mutate validated output.
- Document the fuzz strategy in
backend/docs/security-checklist.md.
Suggested execution
Create branch feature/validator-fuzz:
- Add
backend/src/tests/validators.fuzz.test.ts.
- Update
backend/tests/validators.test.ts if it has overlapping fixtures.
- Update
backend/docs/security-checklist.md.
Test and commit
Run npm test -- validators.fuzz. Cover: extremely long strings, NaN/Infinity in numeric fields, ISO date edge cases, integer overflow, nested arrays at depth >100, prototype-pollution payloads, type confusion (amount: { toString: () => "1" }). Confirm no input crashes the process.
Example commit message
test: add property-based fuzz coverage for Zod validators
Guidelines
- Minimum 95% test coverage
- Document the fuzz strategy in
backend/docs/security-checklist.md
- Timeframe: 96 hours
Description
backend/src/validators/invoices.ts,bids.ts,settlements.ts, andshared.tsuse Zod to validate input. Existing tests are example-based. We need property-based fuzz tests that generate malformed payloads (unicode classes, very large ints, deeply nested objects, prototype-pollution attempts) and assert that the validator either accepts or rejects each — never throws an unhandled error.Requirements and context
fast-checkarbitraries.backend/src/validators/*.ts.__proto__,constructor) cannot mutate validated output.backend/docs/security-checklist.md.Suggested execution
Create branch
feature/validator-fuzz:backend/src/tests/validators.fuzz.test.ts.backend/tests/validators.test.tsif it has overlapping fixtures.backend/docs/security-checklist.md.Test and commit
Run
npm test -- validators.fuzz. Cover: extremely long strings, NaN/Infinity in numeric fields, ISO date edge cases, integer overflow, nested arrays at depth >100, prototype-pollution payloads, type confusion (amount: { toString: () => "1" }). Confirm no input crashes the process.Example commit message
test: add property-based fuzz coverage for Zod validatorsGuidelines
backend/docs/security-checklist.md