Coverage Report

Created: 2026-07-14 06:18

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/ada-url/fuzz/url_pattern.cc
Line
Count
Source
1
#include <fuzzer/FuzzedDataProvider.h>
2
3
#include <memory>
4
#include <string>
5
6
#include "ada.cpp"
7
#include "ada.h"
8
9
using regex_provider = ada::url_pattern_regex::std_regex_provider;
10
11
108k
void exercise_result(auto result) {
12
108k
  (void)result.get_protocol();
13
108k
  (void)result.get_username();
14
108k
  (void)result.get_password();
15
108k
  (void)result.get_hostname();
16
108k
  (void)result.get_port();
17
108k
  (void)result.get_pathname();
18
108k
  (void)result.get_search();
19
108k
  (void)result.get_hash();
20
108k
  (void)result.ignore_case();
21
108k
  (void)result.has_regexp_groups();
22
108k
}
23
24
// Shared helper: walk every field of a url_pattern_result.
25
38.8k
static void exercise_match_result(const ada::url_pattern_result& match) {
26
38.8k
  volatile size_t len = 0;
27
311k
  auto exercise_component = [&len](const ada::url_pattern_component_result& c) {
28
311k
    len += c.input.size();
29
311k
    for (const auto& [k, v] : c.groups) {
30
305k
      len += k.size();
31
305k
      if (v.has_value()) len += v->size();
32
305k
    }
33
311k
  };
34
38.8k
  exercise_component(match.protocol);
35
38.8k
  exercise_component(match.username);
36
38.8k
  exercise_component(match.password);
37
38.8k
  exercise_component(match.hostname);
38
38.8k
  exercise_component(match.port);
39
38.8k
  exercise_component(match.pathname);
40
38.8k
  exercise_component(match.search);
41
38.8k
  exercise_component(match.hash);
42
  // Exercise the 'inputs' vector (each element is a url_pattern_input
43
  // variant holding either a string_view or url_pattern_init).
44
46.6k
  for (const auto& inp : match.inputs) {
45
46.6k
    if (std::holds_alternative<std::string_view>(inp)) {
46
23.3k
      len += std::get<std::string_view>(inp).size();
47
23.3k
    }
48
46.6k
  }
49
38.8k
  (void)len;
50
38.8k
}
51
52
// Exercise exec() and test() on a parsed url_pattern with an ASCII input.
53
// We restrict inputs to ASCII to avoid catastrophic regex backtracking.
54
static void exercise_exec_and_test(ada::url_pattern<regex_provider>& pattern,
55
                                   const std::string& test_input,
56
108k
                                   const std::string& test_base) {
57
108k
  std::string_view test_view(test_input.data(), test_input.size());
58
59
  // exec() and test() must agree: exec finds a match iff test returns true.
60
  // Both operate on the same input so their answers must be consistent.
61
108k
  auto exec_result = pattern.exec(test_view, nullptr);
62
108k
  auto test_result = pattern.test(test_view, nullptr);
63
64
108k
  bool exec_matched = exec_result && exec_result->has_value();
65
108k
  bool test_matched = test_result && *test_result;
66
67
108k
  if (exec_matched != test_matched) {
68
0
    printf(
69
0
        "exec/test inconsistency on input '%s': exec_matched=%d "
70
0
        "test_matched=%d\n",
71
0
        test_input.c_str(), exec_matched, test_matched);
72
0
    abort();
73
0
  }
74
75
108k
  if (exec_result && exec_result->has_value()) {
76
7.77k
    exercise_match_result(**exec_result);
77
7.77k
  }
78
79
  // test() with base URL
80
108k
  if (!test_base.empty()) {
81
108k
    std::string_view base_view(test_base.data(), test_base.size());
82
108k
    auto test_result_with_base = pattern.test(test_view, &base_view);
83
108k
    auto exec_with_base = pattern.exec(test_view, &base_view);
84
85
108k
    bool exec_base_matched = exec_with_base && exec_with_base->has_value();
86
108k
    bool test_base_matched = test_result_with_base && *test_result_with_base;
87
88
108k
    if (exec_base_matched != test_base_matched) {
89
0
      printf(
90
0
          "exec/test inconsistency with base on input '%s': "
91
0
          "exec_matched=%d test_matched=%d\n",
92
0
          test_input.c_str(), exec_base_matched, test_base_matched);
93
0
      abort();
94
0
    }
95
96
108k
    if (exec_with_base && exec_with_base->has_value()) {
97
7.77k
      exercise_match_result(**exec_with_base);
98
7.77k
    }
99
108k
  }
100
101
  // test() with url_pattern_init input (sets only the pathname component)
102
108k
  ada::url_pattern_init init_input{};
103
108k
  init_input.pathname = test_input;
104
108k
  auto test_with_init = pattern.test(init_input, nullptr);
105
108k
  auto exec_with_init = pattern.exec(init_input, nullptr);
106
  // exec and test must agree on the init-based input too.
107
108k
  if ((test_with_init && *test_with_init) !=
108
108k
      (exec_with_init && exec_with_init->has_value())) {
109
0
    printf("exec/test inconsistency on url_pattern_init input\n");
110
0
    abort();
111
0
  }
112
108k
  if (exec_with_init && exec_with_init->has_value()) {
113
23.3k
    exercise_match_result(**exec_with_init);
114
23.3k
  }
115
116
  // test_components() — tests each URL component individually
117
108k
  {
118
108k
    std::string_view sv(test_input.data(), test_input.size());
119
108k
    auto parsed = ada::parse<ada::url_aggregator>(sv);
120
108k
    if (parsed) {
121
33.1k
      volatile bool tc = pattern.test_components(
122
33.1k
          std::string(parsed->get_protocol()),
123
33.1k
          std::string(parsed->get_username()),
124
33.1k
          std::string(parsed->get_password()),
125
33.1k
          std::string(parsed->get_hostname()), std::string(parsed->get_port()),
126
33.1k
          std::string(parsed->get_pathname()),
127
33.1k
          std::string(parsed->get_search()), std::string(parsed->get_hash()));
128
33.1k
      (void)tc;
129
33.1k
    }
130
108k
  }
131
132
  // match() — the internal method underlying exec(); must not crash.
133
108k
  auto match_result = pattern.match(test_view, nullptr);
134
108k
  (void)match_result;
135
108k
}
136
137
12.4k
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
138
379k
  auto to_ascii = [](const std::string& source) -> std::string {
139
379k
    std::string result;
140
379k
    result.reserve(source.size());
141
379k
    for (char c : source) {
142
173k
      result.push_back(static_cast<unsigned char>(c) % 128);
143
173k
    }
144
379k
    return result;
145
379k
  };
146
12.4k
  FuzzedDataProvider fdp(data, size);
147
  // We do not want to trigger arbitrary regex matching.
148
12.4k
  std::string source_1 = "/" + to_ascii(fdp.ConsumeRandomLengthString(50)) +
149
12.4k
                         "/" + to_ascii(fdp.ConsumeRandomLengthString(50));
150
12.4k
  std::string base_source_1 = "/" +
151
12.4k
                              to_ascii(fdp.ConsumeRandomLengthString(50)) +
152
12.4k
                              "/" + to_ascii(fdp.ConsumeRandomLengthString(50));
153
154
12.4k
  std::string source_2 = "https://ada-url.com/*";
155
12.4k
  std::string base_source_2 = "https://ada-url.com";
156
157
  // Additional test input for exec/test calls (also ASCII-only)
158
12.4k
  std::string test_input = "https://" +
159
12.4k
                           to_ascii(fdp.ConsumeRandomLengthString(30)) + "/" +
160
12.4k
                           to_ascii(fdp.ConsumeRandomLengthString(20));
161
12.4k
  std::string test_base = "https://ada-url.com";
162
163
12.4k
  std::array<std::pair<std::string, std::string>, 2> sources = {{
164
12.4k
      {source_1, base_source_1},
165
12.4k
      {source_2, base_source_2},
166
12.4k
  }};
167
168
24.9k
  for (const auto& [source, base_source] : sources) {
169
    // Without base or options
170
24.9k
    auto result =
171
24.9k
        ada::parse_url_pattern<regex_provider>(source, nullptr, nullptr);
172
24.9k
    if (result) {
173
12.4k
      exercise_result(*result);
174
12.4k
      exercise_exec_and_test(*result, test_input, test_base);
175
12.4k
    }
176
177
    // Testing with base_url
178
24.9k
    std::string_view base_source_view(base_source.data(), base_source.length());
179
24.9k
    auto result_with_base = ada::parse_url_pattern<regex_provider>(
180
24.9k
        source, &base_source_view, nullptr);
181
24.9k
    if (result_with_base) {
182
12.4k
      exercise_result(*result_with_base);
183
12.4k
      exercise_exec_and_test(*result_with_base, test_input, test_base);
184
12.4k
    }
185
186
    // Testing with base_url and options
187
24.9k
    ada::url_pattern_options options{.ignore_case = fdp.ConsumeBool()};
188
24.9k
    auto result_with_base_and_options = ada::parse_url_pattern<regex_provider>(
189
24.9k
        source, &base_source_view, &options);
190
24.9k
    if (result_with_base_and_options) {
191
12.4k
      exercise_result(*result_with_base_and_options);
192
12.4k
      exercise_exec_and_test(*result_with_base_and_options, test_input,
193
12.4k
                             test_base);
194
12.4k
    }
195
196
    // Testing with url_pattern_init and base url.
197
24.9k
    int field_index = fdp.ConsumeIntegralInRange(0, 7);
198
24.9k
    std::string random_value = to_ascii(fdp.ConsumeRandomLengthString(50));
199
24.9k
    ada::url_pattern_init init{};
200
24.9k
    switch (field_index) {
201
17.3k
      case 0:
202
17.3k
        init.protocol = random_value;
203
17.3k
        break;
204
860
      case 1:
205
860
        init.username = random_value;
206
860
        break;
207
1.42k
      case 2:
208
1.42k
        init.password = random_value;
209
1.42k
        break;
210
744
      case 3:
211
744
        init.hostname = random_value;
212
744
        break;
213
2.02k
      case 4:
214
2.02k
        init.port = random_value;
215
2.02k
        break;
216
811
      case 5:
217
811
        init.pathname = random_value;
218
811
        break;
219
730
      case 6:
220
730
        init.search = random_value;
221
730
        break;
222
976
      case 7:
223
976
        init.hash = random_value;
224
976
        break;
225
24.9k
    }
226
24.9k
    auto result_with_init = ada::parse_url_pattern<regex_provider>(
227
24.9k
        init, &base_source_view, nullptr);
228
24.9k
    if (result_with_init) {
229
0
      exercise_result(*result_with_init);
230
0
      exercise_exec_and_test(*result_with_init, test_input, test_base);
231
0
    }
232
233
    // Testing url_pattern_init with ALL fields populated simultaneously
234
24.9k
    ada::url_pattern_init init_all{};
235
24.9k
    init_all.protocol = to_ascii(fdp.ConsumeRandomLengthString(10));
236
24.9k
    init_all.username = to_ascii(fdp.ConsumeRandomLengthString(10));
237
24.9k
    init_all.password = to_ascii(fdp.ConsumeRandomLengthString(10));
238
24.9k
    init_all.hostname = to_ascii(fdp.ConsumeRandomLengthString(20));
239
24.9k
    init_all.port = to_ascii(fdp.ConsumeRandomLengthString(5));
240
24.9k
    init_all.pathname = "/" + to_ascii(fdp.ConsumeRandomLengthString(20));
241
24.9k
    init_all.search = to_ascii(fdp.ConsumeRandomLengthString(10));
242
24.9k
    init_all.hash = to_ascii(fdp.ConsumeRandomLengthString(10));
243
24.9k
    auto result_with_init_all =
244
24.9k
        ada::parse_url_pattern<regex_provider>(init_all, nullptr, nullptr);
245
24.9k
    if (result_with_init_all) {
246
21.7k
      exercise_result(*result_with_init_all);
247
21.7k
      exercise_exec_and_test(*result_with_init_all, test_input, test_base);
248
21.7k
    }
249
250
    // Testing url_pattern_init with the base_url field set.
251
    //
252
    // url_pattern_init::base_url is a completely separate code path from the
253
    // base_url *parameter* of parse_url_pattern. When base_url is embedded
254
    // inside the init struct the spec processes it differently. This field
255
    // was previously never exercised by any fuzzer.
256
24.9k
    {
257
24.9k
      ada::url_pattern_init init_base_url{};
258
24.9k
      init_base_url.pathname =
259
24.9k
          "/" + to_ascii(fdp.ConsumeRandomLengthString(20));
260
24.9k
      init_base_url.base_url = "https://example.com";
261
24.9k
      auto result_base_in_init = ada::parse_url_pattern<regex_provider>(
262
24.9k
          init_base_url, nullptr, nullptr);
263
24.9k
      if (result_base_in_init) {
264
24.1k
        exercise_result(*result_base_in_init);
265
24.1k
        exercise_exec_and_test(*result_base_in_init, test_input, test_base);
266
24.1k
      }
267
268
      // Also fuzz the base_url field itself.
269
24.9k
      ada::url_pattern_init init_fuzz_base{};
270
24.9k
      init_fuzz_base.pathname =
271
24.9k
          "/" + to_ascii(fdp.ConsumeRandomLengthString(15));
272
24.9k
      init_fuzz_base.base_url =
273
24.9k
          "https://" + to_ascii(fdp.ConsumeRandomLengthString(20));
274
24.9k
      auto result_fuzz_base = ada::parse_url_pattern<regex_provider>(
275
24.9k
          init_fuzz_base, nullptr, nullptr);
276
24.9k
      if (result_fuzz_base) {
277
868
        exercise_result(*result_fuzz_base);
278
868
        exercise_exec_and_test(*result_fuzz_base, test_input, test_base);
279
868
      }
280
24.9k
    }
281
282
    // Testing url_pattern_init with a random subset (2–4) of fields set.
283
    //
284
    // The single-field case (switch above) and the all-fields case are covered
285
    // above. Here we pick a random bitmask of fields so the parser sees every
286
    // combination of present/absent components.
287
24.9k
    {
288
24.9k
      uint8_t field_mask = fdp.ConsumeIntegral<uint8_t>();
289
24.9k
      ada::url_pattern_init init_subset{};
290
24.9k
      if (field_mask & 0x01)
291
599
        init_subset.protocol = to_ascii(fdp.ConsumeRandomLengthString(8));
292
24.9k
      if (field_mask & 0x02)
293
683
        init_subset.hostname = to_ascii(fdp.ConsumeRandomLengthString(20));
294
24.9k
      if (field_mask & 0x04)
295
734
        init_subset.port = to_ascii(fdp.ConsumeRandomLengthString(5));
296
24.9k
      if (field_mask & 0x08)
297
892
        init_subset.pathname =
298
892
            "/" + to_ascii(fdp.ConsumeRandomLengthString(20));
299
24.9k
      if (field_mask & 0x10)
300
742
        init_subset.search = to_ascii(fdp.ConsumeRandomLengthString(10));
301
24.9k
      if (field_mask & 0x20)
302
894
        init_subset.hash = to_ascii(fdp.ConsumeRandomLengthString(10));
303
24.9k
      if (field_mask & 0x40)
304
875
        init_subset.username = to_ascii(fdp.ConsumeRandomLengthString(10));
305
24.9k
      if (field_mask & 0x80)
306
377
        init_subset.password = to_ascii(fdp.ConsumeRandomLengthString(10));
307
24.9k
      auto result_subset =
308
24.9k
          ada::parse_url_pattern<regex_provider>(init_subset, nullptr, nullptr);
309
24.9k
      if (result_subset) {
310
23.9k
        exercise_result(*result_subset);
311
23.9k
        exercise_exec_and_test(*result_subset, test_input, test_base);
312
23.9k
      }
313
24.9k
    }
314
24.9k
  }
315
316
12.4k
  return 0;
317
12.4k
}