> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wiremock.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Response Templating - Naughty Strings

> Return strings from the Big List of Naughty Strings in response templates to test how clients handle hostile or unusual input.

WireMock Cloud provides a `naughtyString` helper that returns strings from the
[Big List of Naughty Strings](https://github.com/minimaxir/big-list-of-naughty-strings) (BLNS).
The list contains strings that commonly cause problems in software, such as SQL injection, right-to-left text,
zero-width characters, emoji and Zalgo text.

Using the helper in a stub means every client test that calls it exercises these cases without any extra setup.

```json theme={null}
{
  "request": { "method": "GET", "url": "/user" },
  "response": {
    "status": 200,
    "headers": { "Content-Type": "application/json" },
    "body": "{ \"name\": {{{toJson (naughtyString category='sql-injection')}}} }",
    "transformers": ["response-template"]
  }
}
```

> [!WARNING]
>
> These are real payloads. The XSS, SQL injection and command injection strings reach whatever consumes the mock,
> including logs, databases and browsers. That is the point, but only point clients at these stubs in environments
> where that is safe.

The list is built in to WireMock Cloud, so there is nothing to install or download.
The stub needs response templating enabled, as with any other helper.

## Choosing a string

By default the helper picks a random string from the whole list. The `category` and `index` parameters narrow
the choice.

```handlebars theme={null}
{{naughtyString}}
{{naughtyString category='Emoji'}}
{{naughtyString category='sql-injection'}}
{{naughtyString index=42}}
{{naughtyString category='Emoji' index=0}}
{{naughtyString index=(randomInt lower=0 upper=10)}}
```

| Parameter | Meaning |
| - | - |
| `category` | Limits the choice to one [category](#categories). Matched case-insensitively, by either heading (`SQL Injection`) or slug (`sql-injection`). |
| `index` | Returns a fixed entry instead of a random one, counted from 0 within the whole list or within `category`. Use it when you need the same string every time, for example in a repeatable test. |

With neither parameter, the helper picks at random from all 516 strings.

### Errors

Bad input renders an error string in the response, in the same way as WireMock's built-in helpers:

* An unknown category gives `[ERROR: Unknown BLNS category 'x'. Known: reserved-strings, …]`.
* An `index` outside the range gives `[ERROR: BLNS index 600 is out of range 0-515]`.
  The index does not wrap around, so a typo can't quietly return the wrong string.

## Browsing the list

To see every string in every category, with the index you would use to select it, open the hosted mock API at
[blns.wiremockapi.cloud/naughty/strings](https://blns.wiremockapi.cloud/naughty/strings).
It returns the whole list as plain text, grouped by category, with each category's indexes starting at 0.

You can also build your own version. To see which string you get at each index, use a stub that prints a category with the
[`range`](./helper-reference#range) and [`each`](./conditional-logic-and-iteration) helpers. This one prints every string in `sql-injection`:

```handlebars theme={null}
{{#each (range 0 7)}}
{{this}}: {{{toJson (naughtyString category='sql-injection' index=this)}}}
{{/each}}
```

Which gives this response:

```text theme={null}
0: "1;DROP TABLE users"
1: "1'; DROP TABLE users-- 1"
2: "' OR 1=1 -- 1"
3: "' OR '1'='1"
4: "'; EXEC sp_MSForEachTable 'DROP TABLE ?'; --"
5: " "
6: "%"
7: "_"
```

The upper bound of `range` is inclusive, so use the category's string count from the [table below](#categories)
minus one. A bound that is too high is harmless: the extra lines show the out-of-range error, which is a handy way to
confirm where a category ends.

Remove the `category` parameter and use `range 0 515` to print the whole list. The output is long, because it includes the
236 script injection strings.

Some strings contain characters that are invisible or render oddly, such as zero-width characters. Their indexes
can look empty or identical in the response, so treat the output as a guide to which index you want rather than a
faithful view of every byte.

## JSON bodies

WireMock Cloud does not escape helper output, so a naughty string placed directly into JSON will often break it.
Quotes, backslashes and control characters are the usual culprits.

Wrap the helper in the [`toJson`](./json) helper, which adds the surrounding quotes and escapes the value.
Use triple braces and leave the value unquoted:

```handlebars theme={null}
{ "name": {{{toJson (naughtyString)}}} }
```

Every string in the list comes back from this pattern as valid JSON that parses to the original string.

Use this in the response `body`, not `jsonBody`. Inside a `jsonBody` string value
(`"name": "{{{toJson …}}}"`) the quotes are doubled up and the result is invalid JSON.

## Categories

Use either the category name or its slug as the `category` parameter.

| Category | Slug | Strings |
| - | - | -: |
| Reserved Strings | `reserved-strings` | 19 |
| Numeric Strings | `numeric-strings` | 71 |
| Special Characters | `special-characters` | 9 |
| Unicode Symbols | `unicode-symbols` | 11 |
| Unicode Subscript/Superscript/Accents | `unicode-subscript-superscript-accents` | 4 |
| Quotation Marks | `quotation-marks` | 11 |
| Two-Byte Characters | `two-byte-characters` | 10 |
| Special Unicode Characters Union | `special-unicode-characters-union` | 1 |
| Changing length when lowercased | `changing-length-when-lowercased` | 2 |
| Japanese Emoticons | `japanese-emoticons` | 12 |
| Emoji | `emoji` | 13 |
| Unicode Numbers | `unicode-numbers` | 2 |
| Right-To-Left Strings | `right-to-left-strings` | 7 |
| Ogham Text | `ogham-text` | 2 |
| Trick Unicode | `trick-unicode` | 5 |
| Zalgo Text | `zalgo-text` | 5 |
| Unicode Upsidedown | `unicode-upsidedown` | 2 |
| Unicode font | `unicode-font` | 8 |
| Script Injection | `script-injection` | 236 |
| SQL Injection | `sql-injection` | 8 |
| Server Code Injection | `server-code-injection` | 9 |
| Command Injection (Ruby) | `command-injection-ruby` | 7 |
| Unwanted Interpolation | `unwanted-interpolation` | 9 |
| File Inclusion | `file-inclusion` | 2 |
| Known CVEs and Vulnerabilities | `known-cves-and-vulnerabilities` | 4 |
| MSDOS/Windows Special Filenames | `msdos-windows-special-filenames` | 15 |
| Scunthorpe Problem | `scunthorpe-problem` | 22 |
| Human injection | `human-injection` | 1 |
| Terminal escape codes | `terminal-escape-codes` | 3 |
| iOS Vulnerabilities | `ios-vulnerabilities` | 6 |

## Attribution

The Big List of Naughty Strings is © Max Woolf and licensed under the MIT licence.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.