dlss
/
FedP2P
4
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Add fuzzing for webseed path escaping

This commit is contained in:
Matt Joiner 2022-12-25 18:20:23 +11:00
parent 291c428016
commit df126fcace
No known key found for this signature in database
GPG Key ID: 6B990B8185E7F782
1 changed files with 46 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

62
webseed/request_test.go
View File

@ -10,21 +10,51 @@ import (
func TestDefaultPathEscaper(t *testing.T) {
c := qt.New(t)
test := func(unescaped string, parts ...string) {
escaped := defaultPathEscaper(parts)
pathUnescaped, err := url.PathUnescape(escaped)
c.Assert(err, qt.IsNil)
c.Assert(pathUnescaped, qt.Equals, unescaped)
queryUnescaped, err := url.QueryUnescape(escaped)
c.Assert(err, qt.IsNil)
c.Assert(queryUnescaped, qt.Equals, unescaped)
assertPartsUnescape(c, unescaped, parts...)
}
for _, tc := range defaultPathEscapeTestCases {
test(tc.escaped, tc.parts...)
}
test("a_b-c/d + e.f", "a_b-c", "d + e.f")
test("a_1-b_c2/d 3. (e, f).g", "a_1-b_c2", "d 3. (e, f).g")
test("a_b-c/d + e.f", "a_b-c", "d + e.f")
test("a_1-b_c2/d 3. (e, f).g", "a_1-b_c2", "d 3. (e, f).g")
test("war/and/peace", "war", "and", "peace")
test("hello/world", "hello", "world")
test(`ノ┬─┬ノ ︵ ( \o°o)\`, `ノ┬─┬ノ ︵ ( \o°o)\`)
test(`%aa + %bb/Parsi Tv - سرقت و باز کردن در ماشین در کم‌تر از ۳ ثانیه + فیلم.webm`,
`%aa + %bb`, `Parsi Tv - سرقت و باز کردن در ماشین در کم‌تر از ۳ ثانیه + فیلم.webm`)
}
// So we can manually check, and use these to seed fuzzing.
var defaultPathEscapeTestCases = []struct {
escaped string
parts []string
}{
{"/", []string{"", ""}},
{"a_b-c/d + e.f", []string{"a_b-c", "d + e.f"}},
{"a_1-b_c2/d 3. (e, f).g", []string{"a_1-b_c2", "d 3. (e, f).g"}},
{"a_b-c/d + e.f", []string{"a_b-c", "d + e.f"}},
{"a_1-b_c2/d 3. (e, f).g", []string{"a_1-b_c2", "d 3. (e, f).g"}},
{"war/and/peace", []string{"war", "and", "peace"}},
{"he//o#world/world", []string{"he//o#world", "world"}},
{`ノ┬─┬ノ ︵ ( \o°o)\`, []string{`ノ┬─┬ノ ︵ ( \o°o)\`}},
{
`%aa + %bb/Parsi Tv - سرقت و باز کردن در ماشین در کم‌تر از ۳ ثانیه + فیلم.webm`,
[]string{`%aa + %bb`, `Parsi Tv - سرقت و باز کردن در ماشین در کم‌تر از ۳ ثانیه + فیلم.webm`},
},
}
func assertPartsUnescape(c *qt.C, unescaped string, parts ...string) {
escaped := defaultPathEscaper(parts)
pathUnescaped, err := url.PathUnescape(escaped)
c.Assert(err, qt.IsNil)
c.Assert(pathUnescaped, qt.Equals, unescaped)
queryUnescaped, err := url.QueryUnescape(escaped)
c.Assert(err, qt.IsNil)
c.Assert(queryUnescaped, qt.Equals, unescaped)
}
func FuzzDefaultPathEscaper(f *testing.F) {
for _, tc := range defaultPathEscapeTestCases {
if len(tc.parts) == 2 {
f.Add(tc.parts[0], tc.parts[1])
}
}
// I think a single separator is enough to test special handling around /. Also fuzzing doesn't
// let us take []string as an input.
f.Fuzz(func(t *testing.T, first, second string) {
assertPartsUnescape(qt.New(t), first+"/"+second, first, second)
})
}