1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
|
// Copyright 2017 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include <memory>
#include <utility>
#include "base/json/json_reader.h"
#include "base/time/default_clock.h"
#include "base/time/default_tick_clock.h"
#include "base/time/time.h"
#include "base/values.h"
#include "net/base/network_anonymization_key.h"
#include "net/reporting/reporting_cache.h"
#include "net/reporting/reporting_header_parser.h"
#include "net/reporting/reporting_policy.pb.h"
#include "net/reporting/reporting_test_util.h"
#include "third_party/abseil-cpp/absl/types/optional.h"
#include "url/gurl.h"
#include "url/origin.h"
#include "testing/libfuzzer/proto/json_proto_converter.h"
#include "third_party/libprotobuf-mutator/src/src/libfuzzer/libfuzzer_macro.h"
// Silence logging from the protobuf library.
protobuf_mutator::protobuf::LogSilencer log_silencer;
namespace net_reporting_header_parser_fuzzer {
void FuzzReportingHeaderParser(const std::string& data_json,
const net::ReportingPolicy& policy) {
net::TestReportingContext context(base::DefaultClock::GetInstance(),
base::DefaultTickClock::GetInstance(),
policy);
// Emulate what ReportingService::OnHeader does before calling
// ReportingHeaderParser::ParseHeader.
absl::optional<base::Value> data_value =
base::JSONReader::Read("[" + data_json + "]");
if (!data_value)
return;
// TODO: consider including proto definition for URL after moving that to
// testing/libfuzzer/proto and creating a separate converter.
net::ReportingHeaderParser::ParseReportToHeader(
&context, net::NetworkAnonymizationKey(),
url::Origin::Create(GURL("https://origin/")), data_value->GetList());
if (context.cache()->GetEndpointCount() == 0) {
return;
}
}
void InitializeReportingPolicy(
net::ReportingPolicy& policy,
const net_reporting_policy_proto::ReportingPolicy& policy_data) {
policy.max_report_count = policy_data.max_report_count();
policy.max_endpoint_count = policy_data.max_endpoint_count();
policy.delivery_interval =
base::Microseconds(policy_data.delivery_interval_us());
policy.persistence_interval =
base::Microseconds(policy_data.persistence_interval_us());
policy.persist_reports_across_restarts =
policy_data.persist_reports_across_restarts();
policy.persist_clients_across_restarts =
policy_data.persist_clients_across_restarts();
policy.garbage_collection_interval =
base::Microseconds(policy_data.garbage_collection_interval_us());
policy.max_report_age = base::Microseconds(policy_data.max_report_age_us());
policy.max_report_attempts = policy_data.max_report_attempts();
policy.persist_reports_across_network_changes =
policy_data.persist_reports_across_network_changes();
policy.persist_clients_across_network_changes =
policy_data.persist_clients_across_network_changes();
if (policy_data.has_max_endpoints_per_origin())
policy.max_endpoints_per_origin = policy_data.max_endpoints_per_origin();
if (policy_data.has_max_group_staleness_us()) {
policy.max_group_staleness =
base::Microseconds(policy_data.max_report_age_us());
}
}
DEFINE_BINARY_PROTO_FUZZER(
const net_reporting_policy_proto::ReportingHeaderParserFuzzInput& input) {
net::ReportingPolicy policy;
InitializeReportingPolicy(policy, input.policy());
json_proto::JsonProtoConverter converter;
auto data = converter.Convert(input.headers());
FuzzReportingHeaderParser(data, policy);
}
} // namespace net_reporting_header_parser_fuzzer
|
