---
title: "Fuzz every parser of untrusted input · Agent Wranglers"
url: https://agentwranglers.se/playbook/testing/security-and-robustness/fuzz-parsers
id: TST-39
level: Recommended
updated: 2026-10-22
build: a2a6bdfed830
tokens: 967
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Fuzz every parser of untrusted input

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Security and robustness](https://agentwranglers.se/playbook/testing/security-and-robustness.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22.

- ID: TST-39
- Level: Recommended
- Chapter: [Security and robustness](https://agentwranglers.se/playbook/testing/security-and-robustness.md)
- Rule: Feed generated and random input to every parser of outside data, and turn every crash into a regular test.
- Check: The fuzz job runs in CI for its set time and finds no crash. Every past crash input is stored and passes as a unit test.
- How: Use a coverage-guided fuzzer on file, header and message parsers, such as Go's built-in `go test -fuzz`, cargo-fuzz for Rust or Jazzer for Java. Use property-based tests, such as Hypothesis or fast-check, to state rules that must hold for any input. Run the fuzzer for a fixed time in CI, such as five minutes with `-fuzztime=5m`, and keep the inputs that found bugs. Static analysis and dependency scans belong to [Scan every change for known mistakes](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/scan-every-change.md), and attacks on the running app to the rest of that playbook. Parsers that rebuild objects need extra care, as [Never rebuild objects from untrusted data](https://agentwranglers.se/playbook/application-security/input-and-injection/unsafe-deserialisation.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
// fast-check: decoding what we encoded always gives the original back
import fc from 'fast-check';
fc.assert(fc.property(fc.string(), text => decode(encode(text)) === text));
```

### Python example

```python
# Hypothesis
from hypothesis import given, strategies as st

@given(st.text())
def test_decoding_what_we_encoded_gives_it_back(text):
    assert decode(encode(text)) == text
```

### Go example

```go
// Go native fuzzing
func FuzzRoundTrip(f *testing.F) {
    f.Add("hello")
    f.Fuzz(func(t *testing.T, text string) {
        if decode(encode(text)) != text {
            t.Fatalf("round trip changed %q", text)
        }
    })
}
```

## Sources

- [NIST SP 800-218: Secure Software Development Framework](https://csrc.nist.gov/pubs/sp/800/218/final)

## Related rules

- SEC-8 [Scan every change for known mistakes](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/scan-every-change.md) in Adversarial testing
- APS-8 [Never rebuild objects from untrusted data](https://agentwranglers.se/playbook/application-security/input-and-injection/unsafe-deserialisation.md) in Application security
- STK-112 [Write new code in a memory-safe language](https://agentwranglers.se/playbook/stack/languages-and-runtimes/memory-safe-languages.md) in Software choices
- APS-7 [Turn off external entities in XML](https://agentwranglers.se/playbook/application-security/input-and-injection/xml-entities.md) in Application security

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/testing/security-and-robustness/fuzz-parsers">Agent Wranglers testing playbook</a>`. In code you write, add a comment next to it with the same link.

- Next: [Run the tests with a race detector](https://agentwranglers.se/playbook/testing/security-and-robustness/race-detector.md)
- [Security and robustness](https://agentwranglers.se/playbook/testing/security-and-robustness.md)