2
0
mirror of synced 2025-02-24 14:48:27 +00:00

Add fuzzing for webseed path escaping

This commit is contained in:
Matt Joiner 2022-12-25 18:20:23 +11:00
parent 291c428016
commit df126fcace
No known key found for this signature in database
GPG Key ID: 6B990B8185E7F782

View File

@ -10,6 +10,33 @@ import (
func TestDefaultPathEscaper(t *testing.T) { func TestDefaultPathEscaper(t *testing.T) {
c := qt.New(t) c := qt.New(t)
test := func(unescaped string, parts ...string) { test := func(unescaped string, parts ...string) {
assertPartsUnescape(c, unescaped, parts...)
}
for _, tc := range defaultPathEscapeTestCases {
test(tc.escaped, tc.parts...)
}
}
// So we can manually check, and use these to seed fuzzing.
var defaultPathEscapeTestCases = []struct {
escaped string
parts []string
}{
{"/", []string{"", ""}},
{"a_b-c/d + e.f", []string{"a_b-c", "d + e.f"}},
{"a_1-b_c2/d 3. (e, f).g", []string{"a_1-b_c2", "d 3. (e, f).g"}},
{"a_b-c/d + e.f", []string{"a_b-c", "d + e.f"}},
{"a_1-b_c2/d 3. (e, f).g", []string{"a_1-b_c2", "d 3. (e, f).g"}},
{"war/and/peace", []string{"war", "and", "peace"}},
{"he//o#world/world", []string{"he//o#world", "world"}},
{`ノ┬─┬ノ ︵ ( \o°o)\`, []string{`ノ┬─┬ノ ︵ ( \o°o)\`}},
{
`%aa + %bb/Parsi Tv - سرقت و باز کردن در ماشین در کم‌تر از ۳ ثانیه + فیلم.webm`,
[]string{`%aa + %bb`, `Parsi Tv - سرقت و باز کردن در ماشین در کم‌تر از ۳ ثانیه + فیلم.webm`},
},
}
func assertPartsUnescape(c *qt.C, unescaped string, parts ...string) {
escaped := defaultPathEscaper(parts) escaped := defaultPathEscaper(parts)
pathUnescaped, err := url.PathUnescape(escaped) pathUnescaped, err := url.PathUnescape(escaped)
c.Assert(err, qt.IsNil) c.Assert(err, qt.IsNil)
@ -18,13 +45,16 @@ func TestDefaultPathEscaper(t *testing.T) {
c.Assert(err, qt.IsNil) c.Assert(err, qt.IsNil)
c.Assert(queryUnescaped, qt.Equals, unescaped) c.Assert(queryUnescaped, qt.Equals, unescaped)
} }
test("a_b-c/d + e.f", "a_b-c", "d + e.f")
test("a_1-b_c2/d 3. (e, f).g", "a_1-b_c2", "d 3. (e, f).g") func FuzzDefaultPathEscaper(f *testing.F) {
test("a_b-c/d + e.f", "a_b-c", "d + e.f") for _, tc := range defaultPathEscapeTestCases {
test("a_1-b_c2/d 3. (e, f).g", "a_1-b_c2", "d 3. (e, f).g") if len(tc.parts) == 2 {
test("war/and/peace", "war", "and", "peace") f.Add(tc.parts[0], tc.parts[1])
test("hello/world", "hello", "world") }
test(`ノ┬─┬ノ ︵ ( \o°o)\`, `ノ┬─┬ノ ︵ ( \o°o)\`) }
test(`%aa + %bb/Parsi Tv - سرقت و باز کردن در ماشین در کم‌تر از ۳ ثانیه + فیلم.webm`, // I think a single separator is enough to test special handling around /. Also fuzzing doesn't
`%aa + %bb`, `Parsi Tv - سرقت و باز کردن در ماشین در کم‌تر از ۳ ثانیه + فیلم.webm`) // let us take []string as an input.
f.Fuzz(func(t *testing.T, first, second string) {
assertPartsUnescape(qt.New(t), first+"/"+second, first, second)
})
} }