Files
Dave Kempe 54c1d5be17 Security hardening: open redirect, cookie flags, constant-time auth, fuzz targets
- Fix open redirect via protocol-relative URLs (//evil.com) in OIDC next parameter
- Add Secure flag to all cookie-clearing Set-Cookie headers
- Add single-quote escaping to html_escape() (defence-in-depth)
- Cross-check OIDC state cookie against state query parameter in callback
- Switch API key and user token validation to constant-time hash comparison (subtle)
- Add 3 new fuzz targets: api_input, vault_response, websocket_message
- Bump version to 0.3.3

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-12 08:42:33 +11:00

26 lines
942 B
Rust

#![no_main]
use libfuzzer_sys::fuzz_target;
use rustguac::protocol::InstructionParser;
fuzz_target!(|data: &[u8]| {
if let Ok(s) = std::str::from_utf8(data) {
// Fuzz the streaming parser: split input into random-sized chunks
// to exercise buffer accumulation and boundary handling
let mut parser = InstructionParser::new();
let bytes = s.as_bytes();
let mut pos = 0;
let mut chunk_size = 1;
while pos < bytes.len() {
let end = (pos + chunk_size).min(bytes.len());
if let Ok(chunk) = std::str::from_utf8(&bytes[pos..end]) {
for inst in parser.receive(chunk).into_iter().flatten() {
let _ = inst.encode();
}
}
pos = end;
// Vary chunk sizes: 1, 2, 4, 8, ... then wrap back
chunk_size = if chunk_size >= 64 { 1 } else { chunk_size * 2 };
}
}
});