view release on metacpan or  search on metacpan

README.md  view on Meta::CPAN

An optional hashref of args to pass to the module's constructor.

    new:
      api_key: ABC123
      verbose: true

To ensure `new()` is called with no arguments, you still need to define new, thus:

    module: MyModule
    function: my_function

    new:

### `%cases`

An optional Perl static corpus, when the output is a simple string (expected => \[ args... \]).

Maps the expected output string to the input and \_STATUS

    cases:
      ok:
        input: ping
        _STATUS: OK
      error:
        input: ""
        _STATUS: DIES

### `$yaml_cases` - optional path to a YAML file with the same shape as `%cases`.

### `$seed`

An optional integer.
When provided, the generated `t/fuzz.t` will call `srand($seed)` so fuzz runs are reproducible.

### `$iterations`

An optional integer controlling how many fuzz iterations to perform (default 30).

### `%edge_cases`

An optional hash mapping of extra values to inject.

        # Two named parameters
        edge_cases:
                name: [ '', 'a' x 1024, \"\x{263A}" ]
                age: [ -1, 0, 99999999 ]

        # Takes a string input
        edge_cases: [ 'foo', 'bar' ]

Values can be strings or numbers; strings will be properly quoted.
Note that this only works with routines that take named parameters.

### `%type_edge_cases`

An optional hash mapping types to arrayrefs of extra values to try for any field of that type:

        type_edge_cases:
                string: [ '', ' ', "\t", "\n", "\0", 'long' x 1024, chr(0x1F600) ]
                number: [ 0, 1.0, -1.0, 1e308, -1e308, 1e-308, -1e-308, 'NaN', 'Infinity' ]
                integer: [ 0, 1, -1, 2**31-1, -(2**31), 2**63-1, -(2**63) ]

### `%edge_case_array`

Specify edge case values for routines that accept a single unnamed parameter.
This is specifically designed for simple functions that take one argument without a parameter name.
These edge cases supplement the normal random string generation, ensuring specific problematic values are always tested.
During fuzzing iterations, there's a 40% probability that a test case will use a value from edge\_case\_array instead of randomly generated data.

    ---
    module: Text::Processor
    function: sanitize

    input:
      type: string
      min: 1
      max: 1000

    edge_case_array:
      - "<script>alert('xss')</script>"
      - "'; DROP TABLE users; --"
      - "\0null\0byte"
      - "emoji😊test"
      - ""
      - " "

    seed: 42
    iterations: 30

### Semantic Data Generators

For property-based testing with [Test::LectroTest](https://metacpan.org/pod/Test%3A%3ALectroTest),
you can use semantic generators to create realistic test data.

`unix_timestamp` is currently fully supported,
other fuzz testing support for `semantic` entries is being developed.

    input:
      email:
        type: string
        semantic: email

      user_id:
        type: string
        semantic: uuid

      phone:
        type: string
        semantic: phone_us

#### Available Semantic Types

- `email` - Valid email addresses (user@domain.tld)
- `url` - HTTP/HTTPS URLs
- `uuid` - UUIDv4 identifiers
- `phone_us` - US phone numbers (XXX-XXX-XXXX)
- `phone_e164` - International E.164 format (+XXXXXXXXXXXX)
- `ipv4` - IPv4 addresses (0.0.0.0 - 255.255.255.255)
- `ipv6` - IPv6 addresses
- `username` - Alphanumeric usernames with \_ and -