Function FuzzAtomicLevelServeHTTP

http_handler_test.go:241–259

(f *testing.F)

}

func FuzzAtomicLevelServeHTTP(f *testing.F) {
	f.Add(`{"level":"info"}`)
	f.Add(`{"level":"warn"}`)
	f.Add(`{"level":"<script>alert(\"malicious\")</script>"}`)
	f.Fuzz(func(t *testing.T, input string) {
		lvl := zap.NewAtomicLevel()

		resw := httptest.NewRecorder()
		req, err := http.NewRequest(http.MethodPut, "http://localhost:9999/log/level", strings.NewReader(input))
		require.NoError(t, err, "Error constructing request.")

		lvl.ServeHTTP(resw, req)

		require.NotEqual(t, http.StatusInternalServerError, resw.Code, "Unexpected status code.")

		// Response body must never contain HTML tags.
		assert.NotRegexp(t, `<[^>]+>`, resw.Body.String(), "Unexpected HTML tag in response body.")
	})
}