mirror of https://github.com/outbackdingo/optimclaw.git synced 2026-08-26 15:40:18 +00:00

Files

T

[email protected]andClaude Opus 4.6 e41eb8ae33 feat: add fuzzing targets for untrusted input parsers

Add cargo-fuzz infrastructure with 5 fuzz targets exercising
security-critical code paths:

- fuzz_safety_sanitizer: Aho-Corasick + regex injection detection
- fuzz_safety_validator: Input validation (length, encoding, patterns)
- fuzz_leak_detector: Secret leak scanning (API keys, tokens)
- fuzz_tool_params: Tool parameter JSON validation
- fuzz_config_env: TOML/JSON config parsing

Each target exercises real IronClaw business logic with invariant
assertions. Includes corpus directories and setup documentation.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

2026-03-09 23:05:58 -07:00

1.4 KiB

Raw Blame History

IronClaw Fuzz Targets

Fuzz testing for security-critical input parsing paths using cargo-fuzz (libFuzzer).

Targets

Target	What it exercises
`fuzz_safety_sanitizer`	Prompt injection pattern detection (Aho-Corasick + regex)
`fuzz_safety_validator`	Input validation (length, encoding, forbidden patterns)
`fuzz_leak_detector`	Secret leak detection (API keys, tokens, credentials)
`fuzz_tool_params`	Tool parameter JSON validation pipeline
`fuzz_config_env`	Configuration parsing (TOML, JSON)

Setup

cargo install cargo-fuzz
rustup install nightly

Running

# Run a specific target (runs until stopped or crash found)
cargo +nightly fuzz run fuzz_safety_sanitizer

# Run with a time limit (5 minutes)
cargo +nightly fuzz run fuzz_leak_detector -- -max_total_time=300

# Run all targets for 60 seconds each
for target in fuzz_safety_sanitizer fuzz_safety_validator fuzz_leak_detector fuzz_tool_params fuzz_config_env; do
    echo "==> $target"
    cargo +nightly fuzz run "$target" -- -max_total_time=60
done

Adding New Targets

Create fuzz/fuzz_targets/fuzz_<name>.rs following the existing pattern
Add a [[bin]] entry in fuzz/Cargo.toml
Create fuzz/corpus/fuzz_<name>/ for seed inputs
Exercise real IronClaw code paths, not just generic serde

1.4 KiB Raw Blame History