|
2 | 2 | // Licensed under the MIT license. |
3 | 3 | // |
4 | 4 | // Fuzzing harness for wtcli CLI utility functions. |
5 | | -// Targets: TranslateKeys, BuildSendEventJson, MatchesEventFilter. |
| 5 | +// Targets: BuildSendEventJson, MatchesEventFilter. |
6 | 6 | // |
7 | 7 | // Built under the Fuzzing MSBuild configuration with LibFuzzer |
8 | 8 | // instrumentation; submittable to OneFuzz via the CI pipeline. |
@@ -43,66 +43,44 @@ static int FuzzOneInput(const uint8_t* data, size_t size) |
43 | 43 | } |
44 | 44 |
|
45 | 45 | // Split the entire input into segments for use across all targets. |
46 | | - // We need at least 5 segments: [keys...] [eventType] [paramsJson] |
47 | | - // [paneId] [eventTypeFilter] |
48 | | - auto parts = SplitInput(data, size, 5); |
| 46 | + // We need at least 4 segments: [eventType] [paramsJson] |
| 47 | + // [sessionId] [eventTypeFilter] |
| 48 | + auto parts = SplitInput(data, size, 4); |
49 | 49 |
|
50 | | - // ── Target 1: TranslateKeys ── |
51 | | - // Split the first segment on tab bytes to create multiple key entries, |
52 | | - // exercising the key-name matching and multi-key path. |
53 | | - { |
54 | | - std::vector<std::string> keys; |
55 | | - const auto& keyData = parts[0]; |
56 | | - size_t start = 0; |
57 | | - for (size_t i = 0; i < keyData.size(); ++i) |
58 | | - { |
59 | | - if (keyData[i] == '\t') |
60 | | - { |
61 | | - keys.emplace_back(keyData.data() + start, i - start); |
62 | | - start = i + 1; |
63 | | - } |
64 | | - } |
65 | | - if (start < keyData.size()) |
66 | | - { |
67 | | - keys.emplace_back(keyData.data() + start, keyData.size() - start); |
68 | | - } |
69 | | - if (keys.empty()) |
70 | | - { |
71 | | - keys.push_back(keyData); |
72 | | - } |
73 | | - |
74 | | - wtcli::TranslateKeys(keys); |
75 | | - } |
76 | | - |
77 | | - // ── Target 2: BuildSendEventJson ── |
78 | | - // Fuzz all three input parameters: eventType, paramsJson, and paneId. |
| 50 | + // ── Target 1: BuildSendEventJson ── |
| 51 | + // Fuzz all three input parameters: eventType, paramsJson, and sessionId. |
79 | 52 | { |
80 | 53 | Json::Value evt; |
81 | | - wtcli::BuildSendEventJson(parts[1], parts[2], parts[3], evt); |
| 54 | + wtcli::BuildSendEventJson(parts[0], parts[1], parts[2], evt); |
82 | 55 | } |
83 | 56 |
|
84 | | - // ── Target 3: MatchesEventFilter ── |
85 | | - // Construct semi-valid JSON from fuzzed fields so the parser succeeds |
86 | | - // and the deep matching logic (pane_id, wildcard) is actually reached. |
| 57 | + // ── Target 2: MatchesEventFilter ── |
| 58 | + // Construct valid JSON from fuzzed fields using Json::Value so the parser |
| 59 | + // succeeds and the deep matching logic (session_id, wildcard) is reached |
| 60 | + // even when fuzzed strings contain quotes/backslashes/control chars. |
87 | 61 | { |
88 | | - // 3a: Fuzzed event structure with fuzzed filter. |
89 | | - const auto& fuzzedPaneId = parts[3]; |
90 | | - const auto& fuzzedEvent = parts[1]; |
91 | | - const auto& fuzzedFilter = parts[4]; |
| 62 | + // 2a: Fuzzed event structure with fuzzed filter. |
| 63 | + const auto& fuzzedSessionId = parts[2]; |
| 64 | + const auto& fuzzedEvent = parts[0]; |
| 65 | + const auto& fuzzedFilter = parts[3]; |
92 | 66 |
|
93 | | - std::string syntheticJson = |
94 | | - R"({"params":{"pane_id":")" + fuzzedPaneId + |
95 | | - R"(","event":")" + fuzzedEvent + |
96 | | - R"("}})"; |
| 67 | + Json::Value params; |
| 68 | + params["session_id"] = fuzzedSessionId; |
| 69 | + params["event"] = fuzzedEvent; |
| 70 | + Json::Value ev; |
| 71 | + ev["params"] = params; |
| 72 | + Json::StreamWriterBuilder wb; |
| 73 | + wb["indentation"] = ""; |
| 74 | + auto syntheticJson = Json::writeString(wb, ev); |
97 | 75 |
|
98 | | - wtcli::MatchesEventFilter(syntheticJson, fuzzedPaneId, fuzzedFilter); |
| 76 | + wtcli::MatchesEventFilter(syntheticJson, fuzzedSessionId, fuzzedFilter); |
99 | 77 |
|
100 | | - // 3b: Mismatched pane_id — exercises the rejection path. |
| 78 | + // 2b: Mismatched session_id — exercises the rejection path. |
101 | 79 | wtcli::MatchesEventFilter(syntheticJson, "999", fuzzedFilter); |
102 | 80 |
|
103 | | - // 3c: Raw fuzzed bytes as event JSON — exercises parse-failure path. |
| 81 | + // 2c: Raw fuzzed bytes as event JSON — exercises parse-failure path. |
104 | 82 | const std::string raw(reinterpret_cast<const char*>(data), size); |
105 | | - wtcli::MatchesEventFilter(raw, fuzzedPaneId, fuzzedFilter); |
| 83 | + wtcli::MatchesEventFilter(raw, fuzzedSessionId, fuzzedFilter); |
106 | 84 | } |
107 | 85 |
|
108 | 86 | return 0; |
|
0 commit comments