mirror of
https://github.com/outbackdingo/optimclaw.git
synced 2026-08-25 14:53:34 +00:00
c148dd2b5b
* feat: add fuzzing targets for untrusted input parsers Add cargo-fuzz infrastructure with 5 fuzz targets exercising security-critical code paths: - fuzz_safety_sanitizer: Aho-Corasick + regex injection detection - fuzz_safety_validator: Input validation (length, encoding, patterns) - fuzz_leak_detector: Secret leak scanning (API keys, tokens) - fuzz_tool_params: Tool parameter JSON validation - fuzz_config_env: TOML/JSON config parsing Each target exercises real IronClaw business logic with invariant assertions. Includes corpus directories and setup documentation. Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: improve fuzz targets to exercise real IronClaw code paths - fuzz_config_env: exercise SafetyLayer end-to-end (sanitize, validate, policy check) instead of generic TOML/JSON parsing - fuzz_tool_params: add validate_tool_schema coverage alongside validate_tool_params - Add "fuzz" to workspace exclude in root Cargo.toml - Update README descriptions to match actual target behavior [skip-regression-check] Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: replace redundant detect() call with meaningful invariant assertion Replace the double sanitize()+detect() call with an assertion that critical severity warnings always trigger content modification. Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: rewrite fuzz_config_env to exercise IronClaw safety code directly Replace SafetyLayer wrapper usage with direct Sanitizer, Validator, and LeakDetector instantiation and invocation. Adds meaningful consistency assertions (non-empty output, valid-means-no-errors, scan/clean agreement). Removes the config construction that was only exercising struct instantiation. [skip-regression-check] Co-Authored-By: Claude Opus 4.6 <[email protected]> --------- Co-authored-by: Claude Opus 4.6 <[email protected]>
22 lines
626 B
Rust
22 lines
626 B
Rust
#![no_main]
|
|
use libfuzzer_sys::fuzz_target;
|
|
use ironclaw::safety::Validator;
|
|
|
|
fuzz_target!(|data: &[u8]| {
|
|
if let Ok(s) = std::str::from_utf8(data) {
|
|
let validator = Validator::new();
|
|
|
|
// Exercise input validation
|
|
let result = validator.validate(s);
|
|
// Invariant: empty input is always invalid
|
|
if s.is_empty() {
|
|
assert!(!result.is_valid);
|
|
}
|
|
|
|
// Exercise tool parameter validation with arbitrary JSON
|
|
if let Ok(value) = serde_json::from_str::<serde_json::Value>(s) {
|
|
let _ = validator.validate_tool_params(&value);
|
|
}
|
|
}
|
|
});
|