1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
|
// Copyright 2021 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "components/policy/core/common/schema.h"
#include <stddef.h>
#include <stdint.h>
#include <optional>
#include <string>
#include "base/check.h"
#include "base/json/json_reader.h"
#include "base/values.h"
#include "components/policy/policy_constants.h"
namespace policy {
namespace {
// The maximum input size the fuzzer accepts.
constexpr size_t kMaxInputSize = 100 * 1000;
// Holds the state and performs initialization that's shared across fuzzer runs.
struct Environment {
Environment() {
chrome_policy_schema = Schema::Wrap(GetChromeSchemaData());
CHECK(chrome_policy_schema.valid());
}
Schema chrome_policy_schema;
};
// Test schema parsing.
void TestParsing(const Environment& env, const std::string& data) {
std::ignore = Schema::Parse(data);
}
// Test validation and normalization against the Chrome policy schema.
void TestValidation(const Environment& env, const base::Value& parsed_json) {
// Exercise with every possible strategy.
for (auto strategy : {SCHEMA_STRICT, SCHEMA_ALLOW_UNKNOWN,
SCHEMA_ALLOW_UNKNOWN_AND_INVALID_LIST_ENTRY,
SCHEMA_ALLOW_UNKNOWN_WITHOUT_WARNING}) {
env.chrome_policy_schema.Validate(parsed_json, strategy,
/*out_error_path=*/nullptr,
/*out_error=*/nullptr);
base::Value copy = parsed_json.Clone();
if (env.chrome_policy_schema.Normalize(©, strategy,
/*out_error_path=*/nullptr,
/*out_error=*/nullptr,
/*out_changed=*/nullptr)) {
// If normalization succeeded, the validation of the result should succeed
// too.
CHECK(env.chrome_policy_schema.Validate(copy, strategy,
/*out_error_path=*/nullptr,
/*out_error=*/nullptr));
}
}
}
// Test masking sensitive values.
void TestMasking(const Environment& env, const base::Value& parsed_json) {
base::Value copy = parsed_json.Clone();
env.chrome_policy_schema.MaskSensitiveValues(©);
}
} // namespace
// Fuzzer for methods of the `Schema` class.
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
static Environment env;
if (size > kMaxInputSize) {
// Avoid spurious timeouts on exceedingly large inputs.
return 0;
}
const std::string data_string(reinterpret_cast<const char*>(data), size);
TestParsing(env, data_string);
std::optional<base::Value> parsed_json = base::JSONReader::Read(data_string);
if (parsed_json) {
TestValidation(env, *parsed_json);
TestMasking(env, *parsed_json);
}
return 0;
}
} // namespace policy
|
