mirror of
https://github.com/lukaszraczylo/traefikoidc.git
synced 2026-10-15 04:18:03 +00:00
lukaszraczylo
6d96e8869b
- fail-on-old regression tests for every shipped fix (R-rounds) - fuzz targets (parseJWT, bearer), concurrency-stress, shuffle-flake guards - coverage-closing contract tests (health-check backend, TLS-posture reuse) - r154 ID-token fixture built from parts to avoid false-positive secret scan
27 lines
651 B
Go
27 lines
651 B
Go
package traefikoidc
|
|
|
|
import "testing"
|
|
|
|
// FuzzParseJWTFuzz verifies parseJWT (used on attacker-controlled cookies /
|
|
// bearer tokens) never panics on arbitrary input — no slice OOB, no
|
|
// unbounded alloc, no JSON-engine surprise. It must return an error or a
|
|
// valid JWT, never panic (R193).
|
|
func FuzzParseJWTFuzz(f *testing.F) {
|
|
seeds := []string{
|
|
"",
|
|
".",
|
|
"a.b.c",
|
|
"...",
|
|
"eyJhbGciOiJSUzI1NiIsImtpZCI6ImsifQ.eyJzdWIiOiJ4In0.sig", // valid header+claims
|
|
"$$$.$$$.$$$",
|
|
"a\u202e.\nb.\t",
|
|
"%%%",
|
|
}
|
|
for _, s := range seeds {
|
|
f.Add(s)
|
|
}
|
|
f.Fuzz(func(t *testing.T, token string) {
|
|
_, _ = parseJWT(token) // must not panic
|
|
})
|
|
}
|