Fuzz Testing Go HTTP Services
A guide on fuzz testing in Go.
As a developer, you can't envision all of the possible inputs your programs or functions could receive. Even though you can define the major edge cases, you still can't predict how your program will behave in the case of some weird unexpected input. In other words, you can only find bugs you expect to find.
That's where fuzz testing or fuzzing comes to the rescue.
What is Fuzz Testing
Fuzzing is an automated software testing technique that involves inputting a large amount of valid, nearly-valid or invalid random data into a computer program and observing its behavior and output. So the goal of fuzzing is to reveal bugs, crashes and security vulnerabilities in source code you might not find through traditional testing methods.
The Fuzz Testing in Go video which I made a few years ago shows a very simple example of the Go code that may work well unless you provide a certain input:
func Equal(a []byte, b []byte) bool {
for i := range a {
// can panic with runtime error: index out of range.
if a[i] != b[i] {
return false
}
}
return true
}Fuzzing technique would easily spot this bug by bombarding this function with various inputs.
It's a good practice to integrate fuzzing into your team’s software development lifecycle (SDLC) as well. For example, Microsoft uses fuzzing as one of the stages in its SDLC, to find potential bugs and vulnerabilities.
