I am new to gRPC and would like to do input validation of a gRPC service.
The testing would be carried out on a running server, and I would use grpcurl to invoke each of the method with dummy input within a JSON filed.
There are number of fields and nested fields on request message, I been searching for any tool to dynamically construct an example JSON based on the protobuf, but seems there is nothing out there.
The closest one I have found is protoc-gen-jsonschema which translate protobuf message to json schema and later construct an example JSON programatically.
This is an interesting question and I don’t have a definitive answer.
My hunch is that gRPCurl (an excellent tool) may be limited for this purpose:
- Automation;
- Default values;
- Type “mismatch” issues
- Field order issues
I think you would overcome these issues using a programming language (Python, Go, Rust etc.) instead.
Buf is doing interesting work w/ Protobufs and has created protovalidate as a mechanism that:
- Adds annotations to Protobuf sources to specify validation constraints
- Provides libraries that add validation to the generated stubs.
This solves part of your problem.
The other part is to test the result. Fuzzing (and see Google’s Fuzzing forum) is an increasingly popular testing tool.
Fuzzing protobufs has some differences but there are languages|tools that you can use to fuzz protobufs:
- Google’s Python atheris which includes Structure-aware Fuzzing with Protobufs
- Go fuzzing
- etc.