test: add property-based fuzz coverage for Zod validators

[Yasir-TechGuy]

📝 Description

This PR adds property-based fuzz tests for all Zod validators in the backend. The tests use fast-check to generate malformed payloads and verify that validators never throw unhandled exceptions, preventing crashes from malicious or malformed input.

🎯 Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• Performance improvement
• Security enhancement
• Other (please describe):

🔧 Changes Made

Files Modified

• backend/src/tests/validators.fuzz.test.ts - Added fuzz tests for all Zod schemas
• backend/tests/validators.fuzz.test.ts - Fuzz tests (existing, verified passing)
• backend/docs/security-checklist.md - Already has Section 12 documenting fuzz strategy

New Files Added

• backend/src/tests/validators.fuzz.test.ts

Key Changes

• Added 31 fuzz tests covering 11 Zod schemas
• Tests generate malformed payloads: unicode, very large ints, NaN/Infinity, deeply nested objects
• Tests verify prototype-pollution attempts (__proto__, constructor) cannot mutate Object.prototype
• Assert all validators return safeParse result (never throw unhandled errors)

🧪 Testing

• Unit tests pass
• Integration tests pass
• Manual testing completed
• No breaking changes introduced
• Cross-platform compatibility verified
• Edge cases tested

Test Coverage

All 11 exported schemas are covered:

• hexStringSchema
• stellarAddressSchema
• positiveAmountSchema
• paginationSchema
• createInvoiceBodySchema
• createBidBodySchema
• transitionInputSchema
• getSettlementsQuerySchema
• getInvoicesQuerySchema
• getBidsQuerySchema
• invoiceIdParamSchema

Test categories covered:

• Extremely long strings and unicode characters
• NaN/Infinity in numeric fields
• ISO date edge cases (leap days, month 13, year 9999)
• Integer overflow (values at/beyond Number.MAX_SAFE_INTEGER)
• Nested arrays at depth >100
• Prototype-pollution payloads
• Type confusion (objects with toString overrides)

📋 Contract-Specific Checks

• Soroban contract builds successfully
• WASM compilation works
• Gas usage optimized
• Security considerations reviewed
• Events properly emitted
• Contract functions tested
• Error handling implemented
• Access control verified

Contract Testing Details

N/A - This is a backend validator test, not a contract change.

📋 Review Checklist

• Code follows project style guidelines
• Documentation updated if needed
• No sensitive data exposed
• Error handling implemented
• Edge cases considered
• Code is self-documenting
• No hardcoded values
• Proper logging implemented

🔍 Code Quality

• Clippy warnings addressed
• Code formatting follows standards
• No unused imports or variables
• Functions are properly documented
• Complex logic is commented

🚀 Performance & Security

• Gas optimization reviewed
• No potential security vulnerabilities
• Input validation implemented
• Access controls properly configured
• No sensitive information in logs

📚 Documentation

• README updated if needed
• Code comments added for complex logic
• API documentation updated
• Changelog updated (if applicable)

🔗 Related Issues

Closes #2356

📋 Additional Notes

The fuzz strategy is already documented in backend/docs/security-checklist.md (Section 12). No new documentation was needed as it was already complete and comprehensive.

🧪 How to Test

1. cd backend
2. npm install
3. npm test -- validators.fuzz

Expected result: All 31 tests pass.

📸 Screenshots (if applicable)

N/A - This is a test addition, no UI changes.

⚠️ Breaking Changes

None.

🔄 Migration Steps

None.

closes #2356

[Yasir-TechGuy]

Hi @Baskarayelu Please check it out!

[Yasir-TechGuy]

Hi @Baskarayelu,

The CI is failing on the Dependency Vulnerability Scan due to 22 high severity vulnerabilities in the existing dependencies. These vulnerabilities are pre-existing in the codebase and are not related to my changes (I only added fuzz test files for Zod validators).

The vulnerabilities are in:

• brace-expansion (DoS vulnerability)
• minimatch, glob, rimraf (depending on the above)
• Various jest and @jest/* packages

I tried npm audit fix, but it requires --force which would introduce breaking changes by upgrading major versions of jest and ts-jest.

Since these vulnerabilities are pre-existing and not introduced by my PR, I recommend:

1. Option A: Merge this PR as-is (the tests pass, and the vulnerabilities are not related to my changes)
2. Option B: Fix the vulnerabilities in a separate PR (I can help with this if needed)

Please let me know how you'd like to proceed.

Also, I've reached out on Discord as well.

Thanks! 🙏