mirror of
https://github.com/outbackdingo/optimclaw.git
synced 2026-08-25 14:53:34 +00:00
c148dd2b5b
* feat: add fuzzing targets for untrusted input parsers Add cargo-fuzz infrastructure with 5 fuzz targets exercising security-critical code paths: - fuzz_safety_sanitizer: Aho-Corasick + regex injection detection - fuzz_safety_validator: Input validation (length, encoding, patterns) - fuzz_leak_detector: Secret leak scanning (API keys, tokens) - fuzz_tool_params: Tool parameter JSON validation - fuzz_config_env: TOML/JSON config parsing Each target exercises real IronClaw business logic with invariant assertions. Includes corpus directories and setup documentation. Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: improve fuzz targets to exercise real IronClaw code paths - fuzz_config_env: exercise SafetyLayer end-to-end (sanitize, validate, policy check) instead of generic TOML/JSON parsing - fuzz_tool_params: add validate_tool_schema coverage alongside validate_tool_params - Add "fuzz" to workspace exclude in root Cargo.toml - Update README descriptions to match actual target behavior [skip-regression-check] Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: replace redundant detect() call with meaningful invariant assertion Replace the double sanitize()+detect() call with an assertion that critical severity warnings always trigger content modification. Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: rewrite fuzz_config_env to exercise IronClaw safety code directly Replace SafetyLayer wrapper usage with direct Sanitizer, Validator, and LeakDetector instantiation and invocation. Adds meaningful consistency assertions (non-empty output, valid-means-no-errors, scan/clean agreement). Removes the config construction that was only exercising struct instantiation. [skip-regression-check] Co-Authored-By: Claude Opus 4.6 <[email protected]> --------- Co-authored-by: Claude Opus 4.6 <[email protected]>
41 lines
681 B
TOML
41 lines
681 B
TOML
[package]
|
|
name = "ironclaw-fuzz"
|
|
version = "0.0.0"
|
|
publish = false
|
|
edition = "2021"
|
|
|
|
[package.metadata]
|
|
cargo-fuzz = true
|
|
|
|
[dependencies]
|
|
libfuzzer-sys = "0.4"
|
|
serde_json = "1"
|
|
|
|
[dependencies.ironclaw]
|
|
path = ".."
|
|
|
|
[[bin]]
|
|
name = "fuzz_safety_sanitizer"
|
|
path = "fuzz_targets/fuzz_safety_sanitizer.rs"
|
|
doc = false
|
|
|
|
[[bin]]
|
|
name = "fuzz_safety_validator"
|
|
path = "fuzz_targets/fuzz_safety_validator.rs"
|
|
doc = false
|
|
|
|
[[bin]]
|
|
name = "fuzz_leak_detector"
|
|
path = "fuzz_targets/fuzz_leak_detector.rs"
|
|
doc = false
|
|
|
|
[[bin]]
|
|
name = "fuzz_tool_params"
|
|
path = "fuzz_targets/fuzz_tool_params.rs"
|
|
doc = false
|
|
|
|
[[bin]]
|
|
name = "fuzz_config_env"
|
|
path = "fuzz_targets/fuzz_config_env.rs"
|
|
doc = false
|