feat: add fuzzing targets for untrusted input parsers

Browse Source

Add cargo-fuzz infrastructure with 5 fuzz targets exercising
security-critical code paths:

- fuzz_safety_sanitizer: Aho-Corasick + regex injection detection
- fuzz_safety_validator: Input validation (length, encoding, patterns)
- fuzz_leak_detector: Secret leak scanning (API keys, tokens)
- fuzz_tool_params: Tool parameter JSON validation
- fuzz_config_env: TOML/JSON config parsing

Each target exercises real IronClaw business logic with invariant
assertions. Includes corpus directories and setup documentation.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

...

This commit is contained in:

[email protected]

2026-03-09 23:05:58 -07:00

co-authored by Claude Opus 4.6

parent 3a2989d009

commit e41eb8ae33

12 changed files with 176 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

fuzz/corpus/fuzz_config_env/.gitkeep

fuzz/corpus/fuzz_leak_detector/.gitkeep

fuzz/corpus/fuzz_safety_sanitizer/.gitkeep

fuzz/corpus/fuzz_safety_validator/.gitkeep

fuzz/corpus/fuzz_tool_params/.gitkeep