mirror of
https://github.com/shankar0123/certctl.git
synced 2026-06-07 22:21:30 +00:00
shankar0123
a0afa7ab6f
Added Go native fuzz tests (testing/fuzz) for security-critical input validation: 1. FuzzValidateShellCommand in internal/validation/command_fuzz_test.go - Tests shell command validation with injection payloads (;, |, &, $, `, etc.) - Seed corpus includes valid commands and dangerous metacharacters - Ensures function never panics under fuzzing 2. FuzzValidateDomainName in internal/validation/command_fuzz_test.go - Tests RFC 1123 domain validation with wildcard support - Seed corpus includes SQL injection, path traversal, and malformed domains - Ensures function never panics under fuzzing 3. FuzzValidateACMEToken in internal/validation/command_fuzz_test.go - Tests base64url token validation - Seed corpus includes injection payloads and special characters - Ensures function never panics under fuzzing 4. FuzzIsValidRevocationReason in internal/domain/revocation_fuzz_test.go - Tests RFC 5280 revocation reason validation - Seed corpus includes case variations, injection attempts, and null bytes - Ensures function never panics and returns only valid booleans 5. FuzzCRLReasonCode in internal/domain/revocation_fuzz_test.go - Tests CRL reason code mapping - Validates return codes are within 0-9 range - Ensures invalid reasons default to 0 (unspecified) All fuzz tests follow Go 1.18+ testing/fuzz conventions with seed corpus for faster discovery of edge cases. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
56 lines
1.4 KiB
Go
56 lines
1.4 KiB
Go
package domain
|
|
|
|
import (
|
|
"testing"
|
|
)
|
|
|
|
func FuzzIsValidRevocationReason(f *testing.F) {
|
|
f.Add("keyCompromise")
|
|
f.Add("unspecified")
|
|
f.Add("caCompromise")
|
|
f.Add("affiliationChanged")
|
|
f.Add("superseded")
|
|
f.Add("cessationOfOperation")
|
|
f.Add("certificateHold")
|
|
f.Add("privilegeWithdrawn")
|
|
f.Add("")
|
|
f.Add("invalid-reason")
|
|
f.Add("KeyCompromise")
|
|
f.Add("key_compromise")
|
|
f.Add("KEY_COMPROMISE")
|
|
f.Add("keycompromise")
|
|
f.Add("reason; DROP TABLE")
|
|
f.Add("reason\" OR \"1\"=\"1")
|
|
f.Add("unspecified\x00injection")
|
|
f.Fuzz(func(t *testing.T, reason string) {
|
|
// Should never panic, only return bool
|
|
_ = IsValidRevocationReason(reason)
|
|
})
|
|
}
|
|
|
|
func FuzzCRLReasonCode(f *testing.F) {
|
|
f.Add("keyCompromise")
|
|
f.Add("unspecified")
|
|
f.Add("caCompromise")
|
|
f.Add("affiliationChanged")
|
|
f.Add("superseded")
|
|
f.Add("cessationOfOperation")
|
|
f.Add("certificateHold")
|
|
f.Add("privilegeWithdrawn")
|
|
f.Add("")
|
|
f.Add("invalid-reason")
|
|
f.Add("reason\" OR \"1\"=\"1")
|
|
f.Fuzz(func(t *testing.T, reason string) {
|
|
// Should never panic, always return a reasonable code
|
|
code := CRLReasonCode(RevocationReason(reason))
|
|
// Valid codes should be 0-9 with gaps (no 7, no 8)
|
|
if code < 0 || code > 9 {
|
|
t.Errorf("CRLReasonCode returned invalid code: %d", code)
|
|
}
|
|
// For invalid reason, should default to 0
|
|
if !IsValidRevocationReason(reason) && code != 0 {
|
|
t.Errorf("CRLReasonCode should return 0 for invalid reason %q, got %d", reason, code)
|
|
}
|
|
})
|
|
}
|