Stack Overflow occurs with cyclic component links in OpenAPI Spec

[kranonetka]

Describe the bug

thread 'main' has overflowed its stack
fatal runtime error: stack overflow
[1]    13195 abort      ./wuppiefuzz output-corpus --openapi-spec openapi_cyclic.json

When trying to generate the initial corpus for openapi with cyclic links li in request body

Versions:

• OS: MacOS
• rustc: rustc 1.82.0 (f6e511eec 2024-10-15)
• Wuppiefuzz: v1.1.0 (2024-09-17)

To Reproduce
Given an OpenAPI specification with cyclic links in the request body:

{
  "openapi": "3.0.0",
  "info": {
    "title": "Cyclic API Example",
    "version": "1.0.0"
  },
  "servers": [
    {
      "url": "http://localhost:80"
    }
  ],
  "paths": {
    "/categories": {
      "post": {
        "summary": "Create a category with subcategories",
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/Category"
              }
            }
          }
        },
        "responses": {
          "201": {
            "description": "Category created successfully"
          }
        }
      }
    }
  },
  "components": {
    "schemas": {
      "Category": {
        "type": "object",
        "properties": {
          "id": {
            "type": "integer",
            "example": 1
          },
          "name": {
            "type": "string",
            "example": "Electronics"
          },
          "subcategories": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/Category"
            }
          }
        }
      }
    }
  }
}

To reproduce the error, run:

./wuppiefuzz output-corpus --openapi-spec openapi_cyclic.json corpus_directory

Expected behavior
Proper handling of cyclic links in request bodies or guidance on how to manage cyclic links in the corpus generation process.

[grebnetiew]

Thanks! This is indeed a bug / design problem - it did not occur to us that people would express 'infinite nesting' of schemas, so we eagerly generate example array items for the corpus.

Since this is probably not a very quickly-fixable thing, my guidance for now would be to express the depth limit as part of the API specification (assuming arbitrarily deep subsubsub(...)subcategories are not a use case you actually use). So you could define schemas for Subcategory and Subsubcategory, where the latter does not have the 'subcategories' field, and it would work.

  "components": {
    "schemas": {
      "Category": {
        "type": "object",
        "properties": {
          "id": {
            "type": "integer",
            "example": 1
          },
          "name": {
            "type": "string",
            "example": "Electronics"
          },
          "subcategories": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/Subcategory"
            }
          }
        }
      }
      "Subcategory": {
        "type": "object",
        "properties": {
          "id": {
            "type": "integer",
            "example": 1
          },
          "name": {
            "type": "string",
            "example": "Electronics"
          },
          "subcategories": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/Subsubcategory"
            }
          }
        }
      }
      "Subsubcategory": {
        "type": "object",
        "properties": {
          "id": {
            "type": "integer",
            "example": 1
          },
          "name": {
            "type": "string",
            "example": "Electronics"
          }
        }
      }
    }
  }

[kranonetka]

Yea, i already did that. The problem is that I encountered it on a project with 12k lines :) I think until this is fixed it is worth writing about it at least in the documentation.