mirror of
https://github.com/lunchcat/sif.git
synced 2026-08-02 08:47:38 -07:00
1d7e219656
* refactor(modules): extract parseYAMLModuleBytes from ParseYAMLModule split the byte-parsing and validation core out of the file-reading wrapper so module definitions can be parsed from memory. behavior is unchanged: ParseYAMLModule reads the file then delegates. * test(fuzz): add harnesses for parsers and extractors cover the untrusted-input parsers that had no fuzz coverage: jwt analysis and segment decode, js secret scanning, yaml module parsing, openapi spec parsing, html title extraction and js endpoint extraction. the secrets, openapi and endpoint harnesses assert invariants (match is a substring of input, ok implies non-nil spec, results non-empty and sorted); the rest are crash-only. --------- Co-authored-by: vmfunc <vmfunc.lc@gmail.com>
42 lines
1.9 KiB
Go
42 lines
1.9 KiB
Go
/*
|
|
·━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━·
|
|
: :
|
|
: █▀ █ █▀▀ · Blazing-fast pentesting suite :
|
|
: ▄█ █ █▀ · BSD 3-Clause License :
|
|
: :
|
|
: (c) 2022-2026 vmfunc, xyzeva, :
|
|
: lunchcat alumni & contributors :
|
|
: :
|
|
·━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━·
|
|
*/
|
|
|
|
package js
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func FuzzScanSecrets(f *testing.F) {
|
|
f.Add(`const key = "AKIAIOSFODNN7EXAMPLE"`, "https://example.com/app.js")
|
|
f.Add(`apikey: "sk-1234567890abcdefghij"`, "")
|
|
f.Add("ghp_0123456789abcdefghijklmnopqrstuvwxyz01", "src")
|
|
f.Add("-----BEGIN RSA PRIVATE KEY-----", "")
|
|
f.Add(`var token = ""`, "")
|
|
f.Add("", "")
|
|
f.Add("aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY", "js")
|
|
|
|
f.Fuzz(func(t *testing.T, content, srcURL string) {
|
|
for _, m := range ScanSecrets(content, srcURL) {
|
|
// a reported match must be a non-empty run lifted verbatim from the
|
|
// input; anything else means the capture-group indexing is off
|
|
if m.Match == "" {
|
|
t.Fatalf("empty Match for rule %q", m.Rule)
|
|
}
|
|
if !strings.Contains(content, m.Match) {
|
|
t.Fatalf("Match %q (rule %q) not found in input", m.Match, m.Rule)
|
|
}
|
|
}
|
|
})
|
|
}
|