This document describes the property-based and fuzz testing strategy for security-critical code in nself-chat. These tests use the fast-check library to generate random inputs and verify security invariants.

Property-based tests verify that certain properties (invariants) hold true for all possible inputs:

• Determinism: Same input always produces same output
• Idempotence: Running operation multiple times has same effect as once
• Reversibility: Encrypt/decrypt roundtrips preserve original data
• Boundary Conditions: Edge cases are handled correctly
• No Exceptions: Functions never throw on valid input types

Fuzz tests use malformed, unexpected, or malicious inputs to find vulnerabilities:

• Injection Attempts: SQL, XSS, command injection patterns
• Protocol Bypasses: URL manipulation, encoding tricks
• Unicode Edge Cases: Emoji, RTL, zero-width characters
• Binary Edge Cases: Empty data, all zeros, very large inputs

Tests: 40+ property tests, 1000+ assertions

• ✅ Accepts valid alphanumeric + underscore + hyphen (3-30 chars)
• ✅ Rejects invalid characters
• ✅ Rejects too short/long usernames
• ✅ Never throws on any string input

• ✅ Accepts valid email formats
• ✅ Rejects emails without @ symbol
• ✅ Rejects overly long emails (>255 chars)
• ✅ Never throws on any string input

• ✅ Enforces uppercase requirement
• ✅ Enforces lowercase requirement
• ✅ Enforces number requirement
• ✅ Enforces special character requirement
• ✅ Never throws on any string input

• ✅ Always returns a string
• ✅ Removes all <script> tags
• ✅ Removes onclick handlers
• ✅ Preserves safe HTML tags
• ✅ Never throws on any input

• ✅ Escapes all HTML entities (<, >, &, etc.)
• ✅ Never contains unescaped < or >
• ✅ Always returns a string

• ✅ Removes path traversal attempts (..)
• ✅ Removes all forward/backslashes
• ✅ Removes invalid filename characters (<>:"|?*)

• ✅ Accepts HTTP/HTTPS URLs
• ✅ Rejects javascript: protocol
• ✅ Rejects data: protocol
• ✅ Blocks localhost in production

• ✅ Escapes LIKE pattern wildcards (%, _)
• ✅ Validates SQL identifiers (no special chars)
• ✅ Never allows unescaped wildcards

• ✅ Removes all $operator keys
• ✅ Preserves non-operator keys
• ✅ Recursively sanitizes nested objects

• ✅ Validates shell arguments (alphanumeric only)
• ✅ Rejects shell metacharacters (&|;<>$`())
• ✅ Escapes arguments with single quotes

• ✅ Handles zero-width characters
• ✅ Handles emoji and unicode symbols
• ✅ Handles RTL override characters
• ✅ Handles combining characters

Tests: 35+ property tests, 800+ assertions

• ✅ Accepts HTTP and HTTPS
• ✅ Rejects javascript: protocol
• ✅ Rejects data: protocol
• ✅ Rejects file: protocol
• ✅ Rejects ftp: protocol

• ✅ Blocks "localhost" hostname
• ✅ Blocks 127.0.0.1
• ✅ Blocks IPv6 localhost (::1)
• ✅ Blocks all 127.x.x.x range

• ✅ Blocks 10.x.x.x range
• ✅ Blocks 192.168.x.x range
• ✅ Blocks 172.16-31.x.x range
• ✅ Blocks 169.254.x.x link-local range

• ✅ Blocks 169.254.169.254 (AWS/GCP/Azure)
• ✅ Blocks 100.100.100.200 (Alibaba Cloud)
• ✅ Blocks metadata hostnames

• ✅ Handles IPv6 addresses with brackets
• ✅ Blocks private IPv6 ranges
• ✅ Blocks IPv4-mapped IPv6 localhost
• ✅ Blocks IPv4-mapped IPv6 private IPs

• ✅ Detects IP in decimal format
• ✅ Detects IP in octal format
• ✅ Detects IP in hex format
• ✅ Handles @ symbol tricks
• ✅ Handles backslash tricks

• ✅ Never throws on any string input
• ✅ Always returns result object with valid field
• ✅ Provides reason when validation fails
• ✅ Consistent results on repeated calls

Tests: 30+ property tests, 700+ assertions

• ✅ Always returns an array
• ✅ Preserves quoted strings
• ✅ Handles escaped quotes
• ✅ Splits on spaces outside quotes

• ✅ Returns null for non-commands
• ✅ Extracts simple commands (/cmd)
• ✅ Extracts namespaced commands (app:cmd)
• ✅ Handles commands with arguments

• ✅ Validates string arguments (minLength, maxLength, pattern)
• ✅ Validates number arguments (min, max, type)
• ✅ Validates boolean arguments (true/false/yes/no/1/0)
• ✅ Validates user mentions (@username)
• ✅ Validates channel references (#channel)
• ✅ Validates choices constraints

• ✅ Handles command injection attempts (; && | `` $())
• ✅ Handles SQL injection attempts (' OR '1'='1)
• ✅ Handles XSS attempts (<script>, )
• ✅ Handles path traversal attempts (../)

• ✅ Handles unicode in command names
• ✅ Handles emoji in arguments
• ✅ Handles RTL override characters
• ✅ Handles zero-width characters

Tests: 25+ property tests, 500+ assertions

• ✅ Generates bytes of requested length
• ✅ Generates different bytes each call
• ✅ Device IDs are 32 hex characters
• ✅ Device IDs are unique
• ✅ Registration IDs within 14-bit range (0-16383)

• ✅ SHA-256 produces deterministic hashes
• ✅ SHA-256 produces 32-byte hashes
• ✅ Different inputs produce different hashes
• ✅ SHA-512 produces 64-byte hashes
• ✅ Fingerprints are consistent

• ✅ Consistent keys from same password+salt
• ✅ Keys are correct length (32 bytes)
• ✅ Different passwords produce different keys
• ✅ Different salts produce different keys
• ✅ Verifies correct master keys
• ✅ Rejects incorrect master keys

• ✅ Encrypts to different ciphertext each time (random IV)
• ✅ IVs are correct length (12 bytes)
• ✅ Encoded data includes IV + ciphertext

• ✅ Handles empty byte arrays
• ✅ Handles very large byte arrays (1MB+)
• ✅ Handles all-zero byte arrays
• ✅ Handles all-ones byte arrays
• ✅ Handles repeating patterns

• ✅ Handles weak passwords
• ✅ Handles very long passwords (10KB+)
• ✅ Handles special characters
• ✅ Handles null bytes
• ✅ Handles emoji passwords

Tests: 35+ property tests, 900+ assertions

• ✅ Masking preserves prefix/suffix
• ✅ Email masking preserves domain
• ✅ Phone masking preserves last 4 digits
• ✅ Truncation respects max length

• ✅ Detects high-entropy strings
• ✅ Detects secret prefixes (sk_, pk_, ghp_, AKIA)
• ✅ Does not flag normal words

• ✅ Always returns result object
• ✅ Never throws on any log entry
• ✅ Redacts password fields
• ✅ Hashes session IDs
• ✅ Masks email addresses
• ✅ Preserves user IDs

• ✅ Detects JWT tokens
• ✅ Detects Bearer tokens
• ✅ Detects IPv4 addresses
• ✅ Detects AWS access keys
• ✅ Detects credit card numbers

• ✅ Recursively sanitizes nested objects
• ✅ Sanitizes arrays of objects
• ✅ Handles circular references

• ✅ Handles emoji in messages
• ✅ Handles RTL characters
• ✅ Handles zero-width characters
• ✅ Handles mixed scripts

# Run all property-based tests
pnpm jest --testNamePattern="Property Tests|Fuzz Tests"

# Run with coverage
pnpm jest --coverage --testNamePattern="Property Tests|Fuzz Tests"

# Input validation
pnpm jest src/lib/security/__tests__/input-validation.property.test.ts

# SSRF protection
pnpm jest src/lib/security/__tests__/ssrf-protection.property.test.ts

# Command parser
pnpm jest src/lib/plugins/slash-commands/__tests__/command-parser.property.test.ts

# E2EE crypto
pnpm jest src/lib/e2ee/__tests__/crypto.property.test.ts

# Log sanitizer
pnpm jest src/lib/privacy/__tests__/log-sanitizer.property.test.ts

Property tests are configured with different numRuns based on complexity:

• Simple properties: 2000 runs (e.g., "never throws")
• Standard properties: 1000 runs (e.g., determinism)
• Complex properties: 500 runs (e.g., nested validation)
• Expensive properties: 100 runs (e.g., async crypto operations)
• Very expensive: 10-20 runs (e.g., large data crypto)

• ✅ No SQL injection via user input
• ✅ No XSS via HTML sanitization
• ✅ No command injection via shell escaping
• ✅ No NoSQL injection via operator filtering
• ✅ No path traversal via filename sanitization

• ✅ No localhost access
• ✅ No private IP access
• ✅ No cloud metadata access
• ✅ No protocol bypasses
• ✅ No DNS rebinding

• ✅ Passwords always hashed with salt
• ✅ Secrets detected and redacted in logs
• ✅ PII masked or hashed
• ✅ Session IDs hashed
• ✅ Encryption uses random IVs

• ✅ Keys derived with PBKDF2 (100K iterations)
• ✅ Random generation uses crypto-secure PRNG
• ✅ Hash functions are deterministic
• ✅ Different inputs produce different hashes
• ✅ Key verification uses constant-time comparison

• ✅ All user input validated
• ✅ Type coercion is safe
• ✅ Length limits enforced
• ✅ Pattern matching works correctly
• ✅ Unicode handled safely

These property-based tests are run:

1. On every commit (CI pipeline)
2. Before every merge (PR checks)
3. Nightly (extended runs with higher iteration counts)
4. Before releases (full security audit)

1. Increase test coverage:

   • Add property tests for more parsers
   • Test more crypto operations
   • Add fuzzing for API endpoints

2. Performance testing:

   • Add property tests for time complexity
   • Verify no ReDoS vulnerabilities in regex
   • Test memory usage under load

3. Integration testing:

   • Property tests across module boundaries
   • End-to-end security flows
   • Real-world attack scenarios

4. Continuous fuzzing:

   • Integrate with OSS-Fuzz
   • Run fuzzing on CI infrastructure
   • Automated security regression testing

• fast-check Documentation
• Property-Based Testing
• OWASP Input Validation
• OWASP SSRF Prevention