mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 02:54:26 +00:00
kevinveenbirkenbachandClaude Opus 5.5
a598b67d75
OpenSSF Scorecard reports no fuzzer integration (code scanning alert 507, issue #853). tests/fuzz/_yaml_bootstrap.py is an atheris harness that feeds arbitrary input to utils.yaml_bootstrap.load_block and fails whenever the reader accepts a document that load_yaml_str parses differently or rejects. That is the contract the module's docstring states, and the existing property test only samples it. The leading underscore keeps unittest discovery from importing it, because atheris is only installed with the fuzz extra. cron-security-fuzz.yml runs the harness for 15 minutes every Sunday and on demand, on ubuntu-latest, and uploads crashing inputs as the fuzz-crashes artifact. atheris 3.1.0 ships x86_64 manylinux wheels for CPython 3.12 to 3.14 only, so it lives in its own `fuzz` extra and stays out of every other install path. tests/fuzz/ is not part of `make test`. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
23 lines
496 B
Python
23 lines
496 B
Python
import sys
|
|
|
|
import atheris
|
|
|
|
from utils.cache.yaml import load_yaml_str
|
|
|
|
with atheris.instrument_imports():
|
|
from utils.yaml_bootstrap import BootstrapYamlError, load_block
|
|
|
|
|
|
def fuzz_one_input(data: bytes) -> None:
|
|
text = data.decode("utf-8", errors="replace")
|
|
try:
|
|
parsed = load_block(text)
|
|
except BootstrapYamlError:
|
|
return
|
|
assert parsed == load_yaml_str(text), text
|
|
|
|
|
|
if __name__ == "__main__":
|
|
atheris.Setup(sys.argv, fuzz_one_input)
|
|
atheris.Fuzz()
|