max / makenotwork

1.7 KB · 37 lines History Blame Raw

1	//! Structured fuzz over the git-over-SSH command grammar.
2	//!
3	//! Row 4 of `astra-soak-overview`: this is the pre-auth surface on
4	//! `ssh.makenot.work` and on the sshd `command=` door, and the failure cost
5	//! named there is a remote crash or an auth bypass. It is the second soak target
6	//! after `subst-substitute`, and the first one whose boundary is reached before
7	//! the caller knows who is asking.
8	//!
9	//! `git_command::parse` is the whole surface. One call runs verb dispatch,
10	//! whitespace and quote stripping, the owner/repo split, the traversal test and
11	//! the segment whitelist, so there is nothing private left to reach.
12	//!
13	//! ## The oracle lives in the crate, not here
14	//!
15	//! Everything asserted is `git_command::oracle::check_line`. That is deliberate:
16	//! the committed regression replay in `tests/regressions.rs` calls the same
17	//! function on stable, so a crash found here becomes a unit test by copying one
18	//! file, and neither side can drift into checking less than the other.
19	//!
20	//! What it asserts, in short: an accepted request has two valid segments, its
21	//! `repo_dir` adds exactly two normal components to the root it is given, and
22	//! its `git-shell` argument round-trips through the parser as one quoted word.
23	//! The last is the injection oracle — a name that could break out of the quotes
24	//! would come back as a different request, or not parse at all.
25	//!
26	//! Not-panicking is the weakest thing a fuzz target can assert, and a target
27	//! that asserts only that reports clean forever while handing `git-shell` a
28	//! second argument.
29
30	#![no_main]
31
32	use libfuzzer_sys::fuzz_target;
33
34	fuzz_target!(\|line: &str\| {
35	git_command::oracle::check_line(line);
36	});
37