max / docengine
| 1 | //! Structured fuzz over docengine's rendering and sanitization chain. |
| 2 | //! |
| 3 | //! Row 3 of `astra-soak-overview`. The crate's render entry points are called |
| 4 | //! from MNW server and multithreaded, goingson, balanced_breakfast, |
| 5 | //! mnw-assumptions and bb-core, with one implementation behind all of them. |
| 6 | //! |
| 7 | //! ## The oracle lives in the crate, not here |
| 8 | //! |
| 9 | //! Everything asserted is `docengine::oracle::check`. The committed regression |
| 10 | //! replay in `tests/regressions.rs` calls the same function on stable, so a crash |
| 11 | //! found here becomes a unit test by copying one file, and neither side can drift |
| 12 | //! into checking less than the other. |
| 13 | //! |
| 14 | //! What it asserts: a safety floor on the output of every preset (no script, |
| 15 | //! iframe, object, embed, form, svg, math, `javascript:`, `vbscript:` or event |
| 16 | //! handler, however the input was shaped), and that `sanitize_html` is |
| 17 | //! idempotent. The second is the one worth having and nothing else in the crate |
| 18 | //! checks it: a sanitizer that is not idempotent is the mutation-XSS shape, |
| 19 | //! where a second parse of the same bytes sees different markup than the first. |
| 20 | //! |
| 21 | //! Not-panicking is the weakest thing a fuzz target can assert, and a target |
| 22 | //! that asserts only that reports clean forever while a preset quietly starts |
| 23 | //! emitting an `onerror` attribute. |
| 24 | |
| 25 | |
| 26 | |
| 27 | use fuzz_target; |
| 28 | |
| 29 | fuzz_target! |
| 30 | check; |
| 31 | ; |
| 32 |