[email protected] and Claude Opus 4.6
97cbe38949
fix(fuzz): address PR review — LazyLock for expensive constructors, fix assertions and docs
...
- Use std::sync::LazyLock to construct Sanitizer, Validator, and LeakDetector
once instead of on every fuzz iteration (they compile regex/Aho-Corasick)
- Remove fuzz_config_env assertion that panics on null-byte-only input
- Remove no-op length check with misleading comment in fuzz_config_env
- Update fuzz_config_env description in README to match actual behavior
Co-Authored-By: Claude Opus 4.6 <[email protected]
2026-03-10 11:15:56 -07:00
[email protected] and Claude Opus 4.6
3c6f4a97dc
fix: improve fuzz targets to exercise real IronClaw code paths
...
- fuzz_config_env: exercise SafetyLayer end-to-end (sanitize, validate,
policy check) instead of generic TOML/JSON parsing
- fuzz_tool_params: add validate_tool_schema coverage alongside
validate_tool_params
- Add "fuzz" to workspace exclude in root Cargo.toml
- Update README descriptions to match actual target behavior
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 <[email protected]
2026-03-09 23:09:25 -07:00
[email protected] and Claude Opus 4.6
e41eb8ae33
feat: add fuzzing targets for untrusted input parsers
...
Add cargo-fuzz infrastructure with 5 fuzz targets exercising
security-critical code paths:
- fuzz_safety_sanitizer: Aho-Corasick + regex injection detection
- fuzz_safety_validator: Input validation (length, encoding, patterns)
- fuzz_leak_detector: Secret leak scanning (API keys, tokens)
- fuzz_tool_params: Tool parameter JSON validation
- fuzz_config_env: TOML/JSON config parsing
Each target exercises real IronClaw business logic with invariant
assertions. Includes corpus directories and setup documentation.
Co-Authored-By: Claude Opus 4.6 <[email protected]
2026-03-09 23:05:58 -07:00
