Duplicate Keys Fields Fuzzer

Item	Description
Full Fuzzer Name	DuplicateKeysFieldsFuzzer
Log Key	DKF
Description	This fuzzer tests JSON parsing robustness by sending payloads where the same JSON key appears twice within the same object (e.g. {"id":1,"id":"catsFuzzyDup"}). It detects first-wins / last-wins ambiguities and inconsistent JSON parser behavior, which can lead to authorization bypasses, data corruption, or logic flaws, as described in RFC 8259.
Enabled by default?	Yes
Target field types	Any JSON field (object members), regardless of schema type
Expected result when fuzzed field is required	4XX
Expected result when fuzzed field is optional	4XX
Expected result when fuzzed value is not matching field pattern	4XX
Fuzzing logic	Iteratively duplicates each JSON key in the request payload while keeping the original structure intact: 1. Traverses the JSON payload and identifies each field path up to a maximum nesting depth of 5 levels. 2. For each eligible field, rewrites the JSON so that the target key appears twice in its parent object, placing the duplicate immediately after the original. 3. The duplicated key is assigned a fixed value "catsFuzzyDup". 4. Arrays are traversed recursively, preserving their structure. 5. A maximum of 100 duplicated-field mutations per request is enforced to limit execution time. 6. The resulting payload is sent as intentionally invalid JSON (validJson=false) to test parser behavior.
Conditions when this fuzzer will be skipped	When the request payload is empty, OR the field does not exist in the payload, OR the field nesting depth exceeds 5 levels, OR a duplicated payload cannot be generated for the given field.
HTTP methods that will be skipped	GET, DELETE, HEAD
Reporting	Reports error if: 1. The service accepts the request instead of rejecting the duplicated key payload. 2. The response code is not in the expected 4XX family. Reports success if: 1. The service correctly rejects the request with a documented 4XX response, indicating proper handling of duplicate JSON keys.