| 1 |
# Seeds |
| 2 |
|
| 3 |
Curated, read-only, and small. These are the inputs a person chose: real site |
| 4 |
docs for the ordinary shapes, plus the classic XSS payloads and two oracle edge |
| 5 |
cases (a markdown image that falls through as prose carrying ` onerror=`, and an |
| 6 |
entity-escaped payload inside a `title` attribute value). |
| 7 |
|
| 8 |
They are NOT the corpus. Run the fuzzer with the corpus first and these second: |
| 9 |
|
| 10 |
cargo +nightly fuzz run render fuzz/corpus/render fuzz/seeds/render -- -max_total_time=1800 |
| 11 |
|
| 12 |
libFuzzer writes new inputs into the FIRST directory only, so this arrangement |
| 13 |
keeps the curated set curated and lets `fuzz/corpus/` grow. Passing seeds as the |
| 14 |
first argument instead fills this directory with machine-generated files. |
| 15 |
|