Search-Based Fuzzing For RESTful APIs That Use MongoDB

2025-07-28

AI Summary

To address insufficient database state awareness, low code coverage, and difficulty in detecting deep-seated defects in fuzz testing of MongoDB-backed RESTful APIs, this paper proposes a database-state-aware search-based fuzzing approach. Our method dynamically analyzes the real-time state of NoSQL databases during test generation and supports direct data injection from test cases—eliminating reliance on predefined operation sequences typical of conventional white-box testing. Built upon the EvoMaster framework, it integrates automated code instrumentation with white-box fuzzing to enable real-time perception and controllable manipulation of database state. Evaluation across six real-world APIs demonstrates that our approach achieves an average 18% improvement in branch coverage, significantly outperforming existing white-box and four state-of-the-art black-box fuzzers. It is particularly effective in microservice scenarios where database initialization is challenging or read-heavy/write-light workloads dominate.

Technology Category

• Search and Optimization: Sampling/Simulation-based Search
• Intelligent Robots: State Estimation
• Data Mining & Knowledge Management: Anomaly/Outlier Detection

Application Category

• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications
• Web Mining and Content Analysis: Web data generation and simulation
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

In RESTful APIs, interactions with a database are a common and crucial aspect. When generating whitebox tests, it is essential to consider the database's state (i.e., the data contained in the database) to achieve higher code coverage and uncover more hidden faults. This article presents novel techniques to enhance search-based software test generation for RESTful APIs interacting with NoSQL databases. Specifically, we target the popular MongoDB database, by dynamically analyzing (via automated code instrumentation) the state of the database during the test generation process. Additionally, to achieve better results, our novel approach allows inserting NoSQL data directly from test cases. This is particularly beneficial when generating the correct sequence of events to set the NoSQL database in an appropriate state is challenging or time-consuming. This method is also advantageous for testing read-only microservices. Our novel techniques are implemented as an extension of EvoMaster, the only open-source tool for white-box fuzzing RESTful APIs. Experiments conducted on six RESTful APIs demonstrated significant improvements in code coverage, with increases of up to 18% compared to existing white-box approaches. To better highlight the improvements of our novel techniques, comparisons are also carried out with four state-of-the-art black-box fuzzers.

Problem

• Enhancing test generation for RESTful APIs using MongoDB
• Improving code coverage by analyzing database state dynamically
• Enabling direct NoSQL data insertion from test cases

Innovation

• Dynamic analysis of MongoDB state via code instrumentation
• Direct NoSQL data insertion from test cases
• Extension of EvoMaster for enhanced code coverage