max / makenotwork

Keep the two inputs that found the marker-regex bug Found by the soak tier's second session on astra. An input that once found a bug is worth more than the compute that produced it, so it stays in the seed corpus whether or not the bug is fixed. The first is the finding as the fuzzer produced it: substitution emitting live template syntax. The second is the minimal form of the same root cause, a }} inside a quoted filter argument truncating the marker. Details in GoingsOn problem subst-substitute:4def8fda6141.

Author: Max Johnson <me@maxj.phd> · 2026-08-11 23:33 UTC

Signed with PGP, not checked

Commit: 8ed15ecd5b1cb3feeaa04e8867e7e031c46a3946

Parent: 91cf78d

3 files changed, +17 insertions, -0 deletions

M shared/subst/fuzz/seeds/README.md +15

			@@ -22,3 +22,18 @@
22	22		Run a target against these on a machine with no corpus:
23	23
24	24		cargo +nightly fuzz run substitute seeds/substitute
	25	+
	26	+	## Crash seeds
	27	+
	28	+	An input that once found a bug stays here forever. Two so far, both from the
	29	+	same finding on 2026-08-11 (GoingsOn problem `subst-substitute:4def8fda6141`):
	30	+
	31	+	- `14-quote-aware-marker-injection` -- substitution emitted live template
	32	+	syntax, because the marker regex is not quote-aware.
	33	+	- `15-close-brace-in-string-arg` -- the minimal form of the same root cause: a
	34	+	`}}` inside a quoted filter argument truncates the marker.
	35	+
	36	+	These are seeds rather than a `tests/regressions/` directory because the crate
	37	+	is not fixed yet. When it is, they become unit tests too, and they stay here
	38	+	regardless: a test proves the one case, the seed keeps the fuzzer pushing on
	39	+	the shape around it.

A shared/subst/fuzz/seeds/substitute/14-quote-aware-marker-injection +1

			@@ -1,0 +1,1 @@
	1	+	{{ price.basic \| money("{{ price.basic \| money("$") }}$") }}

A shared/subst/fuzz/seeds/substitute/15-close-brace-in-string-arg +1

			@@ -1,0 +1,1 @@
	1	+	{{ price.basic \| money("}}") }}