mirror of
https://github.com/sol1/rustguac.git
synced 2026-09-11 13:50:14 +00:00
Dave Kempe
54c1d5be17
- Fix open redirect via protocol-relative URLs (//evil.com) in OIDC next parameter - Add Secure flag to all cookie-clearing Set-Cookie headers - Add single-quote escaping to html_escape() (defence-in-depth) - Cross-check OIDC state cookie against state query parameter in callback - Switch API key and user token validation to constant-time hash comparison (subtle) - Add 3 new fuzz targets: api_input, vault_response, websocket_message - Bump version to 0.3.3 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
52 lines
821 B
TOML
52 lines
821 B
TOML
[package]
|
|
name = "rustguac-fuzz"
|
|
version = "0.0.0"
|
|
publish = false
|
|
edition = "2021"
|
|
|
|
[package.metadata]
|
|
cargo-fuzz = true
|
|
|
|
[dependencies]
|
|
libfuzzer-sys = "0.4"
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
|
|
[dependencies.rustguac]
|
|
path = ".."
|
|
|
|
[[bin]]
|
|
name = "protocol_parse"
|
|
path = "fuzz_targets/protocol_parse.rs"
|
|
test = false
|
|
doc = false
|
|
bench = false
|
|
|
|
[[bin]]
|
|
name = "protocol_stream"
|
|
path = "fuzz_targets/protocol_stream.rs"
|
|
test = false
|
|
doc = false
|
|
bench = false
|
|
|
|
[[bin]]
|
|
name = "api_input"
|
|
path = "fuzz_targets/api_input.rs"
|
|
test = false
|
|
doc = false
|
|
bench = false
|
|
|
|
[[bin]]
|
|
name = "vault_response"
|
|
path = "fuzz_targets/vault_response.rs"
|
|
test = false
|
|
doc = false
|
|
bench = false
|
|
|
|
[[bin]]
|
|
name = "websocket_message"
|
|
path = "fuzz_targets/websocket_message.rs"
|
|
test = false
|
|
doc = false
|
|
bench = false
|