mirror of
https://github.com/outbackdingo/optimclaw.git
synced 2026-08-25 14:53:34 +00:00
c148dd2b5b
* feat: add fuzzing targets for untrusted input parsers Add cargo-fuzz infrastructure with 5 fuzz targets exercising security-critical code paths: - fuzz_safety_sanitizer: Aho-Corasick + regex injection detection - fuzz_safety_validator: Input validation (length, encoding, patterns) - fuzz_leak_detector: Secret leak scanning (API keys, tokens) - fuzz_tool_params: Tool parameter JSON validation - fuzz_config_env: TOML/JSON config parsing Each target exercises real IronClaw business logic with invariant assertions. Includes corpus directories and setup documentation. Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: improve fuzz targets to exercise real IronClaw code paths - fuzz_config_env: exercise SafetyLayer end-to-end (sanitize, validate, policy check) instead of generic TOML/JSON parsing - fuzz_tool_params: add validate_tool_schema coverage alongside validate_tool_params - Add "fuzz" to workspace exclude in root Cargo.toml - Update README descriptions to match actual target behavior [skip-regression-check] Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: replace redundant detect() call with meaningful invariant assertion Replace the double sanitize()+detect() call with an assertion that critical severity warnings always trigger content modification. Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: rewrite fuzz_config_env to exercise IronClaw safety code directly Replace SafetyLayer wrapper usage with direct Sanitizer, Validator, and LeakDetector instantiation and invocation. Adds meaningful consistency assertions (non-empty output, valid-means-no-errors, scan/clean agreement). Removes the config construction that was only exercising struct instantiation. [skip-regression-check] Co-Authored-By: Claude Opus 4.6 <[email protected]> --------- Co-authored-by: Claude Opus 4.6 <[email protected]>
44 lines
1.4 KiB
Markdown
44 lines
1.4 KiB
Markdown
# IronClaw Fuzz Targets
|
|
|
|
Fuzz testing for security-critical input parsing paths using [cargo-fuzz](https://github.com/rust-fuzz/cargo-fuzz) (libFuzzer).
|
|
|
|
## Targets
|
|
|
|
| Target | What it exercises |
|
|
|--------|-------------------|
|
|
| `fuzz_safety_sanitizer` | Prompt injection pattern detection (Aho-Corasick + regex) |
|
|
| `fuzz_safety_validator` | Input validation (length, encoding, forbidden patterns) |
|
|
| `fuzz_leak_detector` | Secret leak detection (API keys, tokens, credentials) |
|
|
| `fuzz_tool_params` | Tool parameter and schema JSON validation |
|
|
| `fuzz_config_env` | SafetyLayer end-to-end (sanitize, validate, policy check) |
|
|
|
|
## Setup
|
|
|
|
```bash
|
|
cargo install cargo-fuzz
|
|
rustup install nightly
|
|
```
|
|
|
|
## Running
|
|
|
|
```bash
|
|
# Run a specific target (runs until stopped or crash found)
|
|
cargo +nightly fuzz run fuzz_safety_sanitizer
|
|
|
|
# Run with a time limit (5 minutes)
|
|
cargo +nightly fuzz run fuzz_leak_detector -- -max_total_time=300
|
|
|
|
# Run all targets for 60 seconds each
|
|
for target in fuzz_safety_sanitizer fuzz_safety_validator fuzz_leak_detector fuzz_tool_params fuzz_config_env; do
|
|
echo "==> $target"
|
|
cargo +nightly fuzz run "$target" -- -max_total_time=60
|
|
done
|
|
```
|
|
|
|
## Adding New Targets
|
|
|
|
1. Create `fuzz/fuzz_targets/fuzz_<name>.rs` following the existing pattern
|
|
2. Add a `[[bin]]` entry in `fuzz/Cargo.toml`
|
|
3. Create `fuzz/corpus/fuzz_<name>/` for seed inputs
|
|
4. Exercise real IronClaw code paths, not just generic serde
|