test: add fuzz test for file handler error paths by taeyoung0823 · Pull Request #5539 · litmuschaos/litmus

taeyoung0823 · 2026-06-01T13:38:00Z

Summary

This PR adds fuzz test coverage for the file handler manifest endpoint and ensures the handler returns immediately after writing error responses.

Changes

Added early returns after error responses in FileHandler
Added fuzz tests for file handler key and Referer inputs
Covered malformed keys, empty keys, path-like inputs, and invalid Referer values
Ensured the handler does not panic on unexpected inputs

Testing

go test ./pkg/handlers/...
go test ./pkg/handlers/... -run=FuzzFileHandler -fuzz=FuzzFileHandler -fuzztime=30s

PriteshKiri · 2026-06-09T11:41:36Z

Hey @taeyoung0823
Could you please check the CI failures?

Copilot

Pull request overview

This PR aims to harden the /file/:key manifest endpoint by ensuring FileHandler stops execution immediately after writing error responses, and adds a fuzz test to exercise error paths and prevent panics on unexpected inputs.

Changes:

Added return statements after multiple error responses in FileHandler.
Added a new fuzz test targeting FileHandler with varied key and Referer inputs.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
`chaoscenter/graphql/server/pkg/handlers/file_handler.go`	Adds early returns after error writes to prevent continued execution after an error response.
`chaoscenter/graphql/server/pkg/handlers/file_handler_fuzz_test.go`	Introduces fuzzing for the file handler to catch panics and unexpected behavior on malformed inputs.

Comments suppressed due to low confidence (1)

chaoscenter/graphql/server/pkg/handlers/file_handler.go:48

/file/:key is registered without the authorization middleware that injects request-header into the request context (see server.go), so relying on c.Value("request-header") is unlikely to work for real requests and will force the handler into the 500 path. In a gin handler you can read headers directly from c.Request.Header / c.GetHeader(...).

		reqHeader, ok := c.Value("request-header").(http.Header)
		if !ok {
			logrus.Error("unable to parse referer header")
			utils.WriteHeaders(&c.Writer, 500)
			c.Writer.Write([]byte("unable to parse referer header"))
			return
		}

		referrer := reqHeader.Get("Referer")
		if referrer == "" {

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+			},
+		}
+
+		ctx.Set("request-header", req.Header)


+		gin.SetMode(gin.TestMode)
+


PriteshKiri · 2026-06-09T11:57:28Z

Hey @taeyoung0823
Could you please check the Co-Pilot review comments?

taeyoung0823 · 2026-06-09T13:30:39Z

Thanks for the review @PriteshKiri

I addressed the Copilot review comments by updating FileHandler to read the Referer header directly from the Gin request using c.GetHeader("Referer").

I also updated the fuzz test by removing the request-header context setup, moving gin.SetMode(gin.TestMode) outside the fuzz loop, and skipping JWT-shaped keys that can trigger auth configuration / Mongo access during fuzzing.

The changes have been pushed. Could you please approve the pending workflows when you get a chance?

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

@@ -0,0 +1,66 @@
+**package handlers**


+		w := httptest.NewRecorder()
+		ctx, _ := gin.CreateTestContext(w)
+
+		req := httptest.NewRequest(http.MethodGet, "/file/"+url.PathEscape(key), nil)
+		req.Header.Set("Referer", referer)
+		ctx.Request = req
+
+		ctx.Params = gin.Params{
+			{
+				Key:   "key",
+				Value: key,
+			},
+		}
+
+		mockOp := new(mocks.MongoOperator)
+
+		defer func() {
+			if r := recover(); r != nil {
+				t.Fatalf("FileHandler panicked with key=%q referer=%q: %v", key, referer, r)
+			}
+		}()
+
+		FileHandler(mockOp)(ctx)


@@ -5,6 +5,7 @@ import (
 	"net/http"
 	"net/url"
 	"strings"
+	"html"


PriteshKiri · 2026-06-30T10:32:23Z

@taeyoung0823 could you please resolve the conflicts?

Signed-off-by: taeyoung0823 <kimxodud0823@naver.com>

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

+		mockOp := new(mocks.MongoOperator)
+
+		defer func() {
+			if r := recover(); r != nil {
+				t.Fatalf("FileHandler panicked with key=%q referer=%q: %v", key, referer, r)
+			}
+		}()
+
+		FileHandler(mockOp)(ctx)


+		req.Header.Set("Referer", referer)
+		ctx.Request = req


PriteshKiri · 2026-07-14T10:50:19Z

Hey @taeyoung0823
Could you please review the comments by Co-Pilot?

Also, some CI checks are failing. Could you please address those?

PriteshKiri · 2026-07-21T10:01:33Z

@taeyoung0823 any updates?

Validate and escape Referer-derived endpoints before embedding them in generated manifests, and return the manifest with safe YAML download headers. Keep fuzz coverage deterministic by isolating Referer parsing from Mongo-backed JWT validation. Signed-off-by: taeyoung0823 <kimxodud0823@naver.com>

taeyoung0823 · 2026-07-30T14:19:52Z

@PriteshKiri Please take a look when you have a chance.

taeyoung0823 · 2026-08-06T06:27:38Z

@PriteshKiri Could you please review this?

PriteshKiri · 2026-08-25T08:53:47Z

Hey @taeyoung0823
Could you please look into the CI failures?

Signed-off-by: taeyoung0823 <kimxodud0823@naver.com>

taeyoung0823 · 2026-08-25T12:06:20Z

@PriteshKiri Please take a look when you have a chance.

taeyoung0823 force-pushed the test/add-file-handler-fuzz-tests branch from 9b5a9e9 to 7ca3bad Compare June 1, 2026 14:21

This was referenced Jun 2, 2026

test: add unit coverage for image registry service responses #5541

Closed

test: add unit coverage for image registry service responses #5542

Merged

suhyenim assigned taeyoung0823 Jun 3, 2026

suhyenim added the mentorship-kr label Jun 3, 2026

PriteshKiri requested a review from Copilot June 9, 2026 11:41

Copilot started reviewing on behalf of PriteshKiri June 9, 2026 11:41 View session

Copilot AI reviewed Jun 9, 2026

View reviewed changes

Comment thread chaoscenter/graphql/server/pkg/handlers/file_handler_fuzz_test.go Outdated

},

}

ctx.Set("request-header", req.Header)

Comment thread chaoscenter/graphql/server/pkg/handlers/file_handler_fuzz_test.go Outdated

Comment on lines +32 to +33

gin.SetMode(gin.TestMode)

taeyoung0823 force-pushed the test/add-file-handler-fuzz-tests branch 2 times, most recently from 3928e3f to 3c2dbbc Compare June 18, 2026 00:44

PriteshKiri requested a review from Copilot June 30, 2026 09:26

Copilot started reviewing on behalf of PriteshKiri June 30, 2026 09:26 View session

Copilot AI reviewed Jun 30, 2026

View reviewed changes

fix: stop FileHandler after error responses

8366840

Signed-off-by: taeyoung0823 <kimxodud0823@naver.com>

taeyoung0823 force-pushed the test/add-file-handler-fuzz-tests branch from 72e0f66 to 8366840 Compare July 6, 2026 22:25

github-advanced-security Bot found potential problems Jul 7, 2026

View reviewed changes

Comment thread chaoscenter/graphql/server/pkg/handlers/file_handler.go Fixed

fix: avoid echoing FileHandler errors

f4c96b2

Signed-off-by: taeyoung0823 <kimxodud0823@naver.com>

taeyoung0823 force-pushed the test/add-file-handler-fuzz-tests branch from f8b889e to f4c96b2 Compare July 7, 2026 12:23

Merge branch 'master' into test/add-file-handler-fuzz-tests

3ff0cde

PriteshKiri requested a review from Copilot July 14, 2026 02:37

Copilot started reviewing on behalf of PriteshKiri July 14, 2026 02:37 View session

Copilot AI reviewed Jul 14, 2026

View reviewed changes

Merge branch 'master' into test/add-file-handler-fuzz-tests

de9d71a

Merge branch 'master' into test/add-file-handler-fuzz-tests

0bcc7e3

fix: resolve GraphQL server security checks

1c6752c

Signed-off-by: taeyoung0823 <kimxodud0823@naver.com>

Merge branch 'master' into test/add-file-handler-fuzz-tests

b5b35d8

Uh oh!

Conversation

taeyoung0823 commented Jun 1, 2026

Summary

Changes

Testing

Uh oh!

PriteshKiri commented Jun 9, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

PriteshKiri commented Jun 9, 2026

Uh oh!

taeyoung0823 commented Jun 9, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

PriteshKiri commented Jun 30, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

PriteshKiri commented Jul 14, 2026

Uh oh!

PriteshKiri commented Jul 21, 2026

Uh oh!

taeyoung0823 commented Jul 30, 2026

Uh oh!

taeyoung0823 commented Aug 6, 2026

Uh oh!

PriteshKiri commented Aug 25, 2026

Uh oh!

taeyoung0823 commented Aug 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants