1+ $schema : " https://json-schema.org/draft/2020-12/schema"
2+ # https://www.learnjsonschema.com/2020-12/core/id/
3+ $id : " TODO"
4+ title : " Web Fuzzing Report"
5+ description : " Schema Definition for Web Fuzzing Commons Reports"
6+ type : object
7+ properties :
8+ # REQUIRED
9+ schema_version :
10+ type : string
11+ description : " The schema version of WFC needed to use to validate and process this document."
12+ tool_name :
13+ type : string
14+ description : " The name of the tool used to create the test cases reported in this document."
15+ tool_version :
16+ type : string
17+ description : " The version number of the used tool, e.g., 1.0.0."
18+ creation_time :
19+ type : string
20+ format : date-time
21+ description : " The timestamp of when this report file was created."
22+ faults :
23+ $ref : " #/$def/Faults"
24+ # ### Unfortunately, there is no support for oneOf in jsonschema2pojo
25+ # problem_details:
26+ # type: object
27+ # oneOf:
28+ # - $ref: "#/$def/RESTReport"
29+ # # TODO GraphQL, RPC and Web
30+ problem_details :
31+ type : object
32+ properties :
33+ rest :
34+ $ref : " #/$def/RESTReport"
35+ # TODO GraphQL, RPC and Web
36+ # expressing that only 1 should be present is possible, but super-verbose and convoluted
37+ total_tests :
38+ type : integer
39+ minimum : 0
40+ description : " The total number of test cases generated by the tool."
41+ test_file_paths :
42+ type : array
43+ items :
44+ $ref : " #/$def/TestFilePath"
45+ uniqueItems : true
46+ description : " The list of relative paths (compared to this document) of all the generated test suite files."
47+ test_cases :
48+ description : " Information on each generated test case."
49+ type : array
50+ items :
51+ $ref : " #/$def/TestCase"
52+ # OPTIONAL
53+ extra :
54+ description : " Extra, optional coverage information, collected by different tools."
55+ type : array
56+ items :
57+ $ref : " #/$def/Coverage"
58+
59+ required : ["schema_version","tool_name","tool_version","creation_time","faults","problem_details","total_tests","test_file_paths","test_cases"]
60+
61+ $def :
62+ OperationId :
63+ description : " A unique identifier for an operation. For example, in REST, it would be a HTTP endpoint, including
64+ verb, e.g., 'GET:/users/{id}'."
65+ type : string
66+ TestCaseId :
67+ description : " A unique identifier for a test case. It could include its name and file location."
68+ type : string
69+ FaultCategoryId :
70+ description : " A unique identifier for a fault type."
71+ type : object
72+ properties :
73+ code :
74+ description : " Identifying fault 'code', based on WFC classification."
75+ type : integer
76+ context :
77+ description : " An optional context for the fault. The same fault type could be manifested in different ways, and we
78+ use this property to differentiate among them."
79+ type : string
80+ required : ["code"]
81+ TestFilePath :
82+ description : " A relative path used to unique locate a test suite file."
83+ type : string
84+ CoveredEndpoint :
85+ description : " Data-structure to represent which HTTP status code where covered on an endpoint by any of the generated tests."
86+ type : object
87+ properties :
88+ endpoint_id :
89+ $ref : " #/$def/OperationId"
90+ test_case_id :
91+ $ref : " #/$def/TestCaseId"
92+ http_status :
93+ description : " As in a test case the same endpoint could be called more than once, here we report all of the
94+ obtained HTTP status codes"
95+ type : array
96+ items :
97+ $ref : " #/$def/HttpStatus"
98+ minItems : 1
99+ uniqueItems : true
100+ required : ["endpoint_id","test_case_id","http_status"]
101+ HttpStatus :
102+ type : integer
103+ minimum : 0
104+ maximum : 599
105+ FoundFault :
106+ description : " Data-structure to represent found faults, based on operations (e.g., HTTP endpoints in REST, and methods
107+ in GraphQL and RPC) and which tests find faults in them."
108+ type : object
109+ properties :
110+ operation_id :
111+ $ref : " #/$def/OperationId"
112+ test_case_id :
113+ $ref : " #/$def/TestCaseId"
114+ fault_categories :
115+ type : array
116+ items :
117+ $ref : " #/$def/FaultCategoryId"
118+ minItems : 1
119+ uniqueItems : true
120+ required : ["endpoint_id","test_case_id","fault_categories"]
121+
122+ RESTReport :
123+ type : object
124+ properties :
125+ total_http_calls :
126+ description : " Total number of HTTP calls made in all the test cases. A test case could contain several HTTP calls,
127+ e.g., a POST followed by a GET and then a DELETE."
128+ type : integer
129+ minimum : 0
130+ endpoint_ids :
131+ description : " Unique ids of all the endpoints in the tested API."
132+ type : array
133+ items :
134+ $ref : " #/$def/OperationId"
135+ uniqueItems : true
136+ covered_http_status :
137+ description : " List of which HTTP status codes were covered, based on endpoints."
138+ type : array
139+ items :
140+ $ref : " #/$def/CoveredEndpoint"
141+ required : ["total_http_calls","endpoint_ids","covered_http_status"]
142+
143+ TestCase :
144+ type : object
145+ properties :
146+ id :
147+ $ref : " #/$def/TestCaseId"
148+ file_path :
149+ $ref : " #/$def/TestFilePath"
150+ name :
151+ description : " The name of the test case, as it appears in the generated test file."
152+ type : string
153+ start_line :
154+ description : " The line number in the generated test suite file where the code of this test case starts."
155+ type : integer
156+ minimum : 0
157+ end_line :
158+ description : " The line number in the generated test suite file where the code of this test case ends."
159+ type : integer
160+ minimum : 0
161+
162+ Faults :
163+ type : object
164+ properties :
165+ total_number :
166+ description : " The total number of potential faults identified in the generated test suites."
167+ type : integer
168+ minimum : 0
169+ found_faults :
170+ description : " Information on all the identified potential faults."
171+ type : array
172+ items :
173+ $ref : " #/$def/FoundFault"
174+ required : ["total_number","found_faults"]
175+
176+ Coverage :
177+ type : object
178+ properties :
179+ tool_name :
180+ description : " The name of the tool used to collect and compute the coverage criteria."
181+ type : string
182+ criteria :
183+ type : array
184+ items :
185+ $ref : " #/$def/CoverageCriterion"
186+ required : ["tool_name","criteria"]
187+
188+ CoverageCriterion :
189+ type : object
190+ properties :
191+ name :
192+ description : " The name of this coverage criterion."
193+ type : string
194+ covered :
195+ description : " The number of testing targets for this criterion that were covered."
196+ type : integer
197+ minimum : 0
198+ total :
199+ description : " Optional number of all testing targets for this criterion. For some criteria, this number can be unknown."
200+ type : integer
201+ minimum : 0
202+ required : ["name","covered"]
0 commit comments