hecks 3.14.0 → 4.0.0

data/rust/host/src/boundary_fuzz/server.rs

@@ -8,7 +8,10 @@ use crate::fuzz_support::*;
 use serde_json::json;
 
 fn limits(pairs: &[(&str, &str)]) -> RateLimits {
-    let map: std::collections::HashMap<String, String> = pairs.iter().map(|(k, v)| (k.to_string(), v.to_string())).collect();
+    let map: std::collections::HashMap<String, String> = pairs
+        .iter()
+        .map(|(k, v)| (k.to_string(), v.to_string()))
+        .collect();
     RateLimits::new(crate::rate_limit::Config::from_lookup(|name| map.get(name).cloned()).0)
 }
 
@@ -16,10 +19,27 @@ fn peer(text: &str) -> SocketAddr {
     text.parse().unwrap()
 }
 
-const PEERS: &[&str] = &["127.0.0.1:5000", "[::1]:5000", "[::ffff:127.0.0.1]:5000", "10.0.0.5:5000", "203.0.113.7:5000", "[2001:db8::1]:5000"];
+const PEERS: &[&str] = &[
+    "127.0.0.1:5000",
+    "[::1]:5000",
+    "[::ffff:127.0.0.1]:5000",
+    "10.0.0.5:5000",
+    "203.0.113.7:5000",
+    "[2001:db8::1]:5000",
+];
 
 fn random_method(rng: &mut Rng) -> Method {
-    let methods = [Method::GET, Method::POST, Method::PUT, Method::DELETE, Method::PATCH, Method::HEAD, Method::OPTIONS, Method::TRACE, Method::CONNECT];
+    let methods = [
+        Method::GET,
+        Method::POST,
+        Method::PUT,
+        Method::DELETE,
+        Method::PATCH,
+        Method::HEAD,
+        Method::OPTIONS,
+        Method::TRACE,
+        Method::CONNECT,
+    ];
     if rng.chance(8) {
         Method::from_bytes(b"BREW").unwrap()
     } else {
@@ -29,13 +49,34 @@ fn random_method(rng: &mut Rng) -> Method {
 
 /// A URI that parses: a hostile path built from the pieces, or a fixed route the limiter knows.
 fn random_uri(rng: &mut Rng) -> Uri {
-    const FIXED: &[&str] = &["/", "/newsletter/subscribers", "/registrations", "/api/me", "/login", "/%00", "/../..", "/a?b=%a", "/x?%", "/a//b", "/a;b", "*"];
+    const FIXED: &[&str] = &[
+        "/",
+        "/newsletter/subscribers",
+        "/registrations",
+        "/api/me",
+        "/login",
+        "/%00",
+        "/../..",
+        "/a?b=%a",
+        "/x?%",
+        "/a//b",
+        "/a;b",
+        "*",
+    ];
     if rng.chance(3) {
         return rng.pick(FIXED).parse().unwrap();
     }
     for _ in 0..8 {
-        let path: String = (0..rng.below(4)).map(|_| format!("/{}", rng.pick(PIECES_ASCII))).collect();
-        let query = if rng.chance(2) { format!("?{}={}", rng.pick(PIECES_ASCII), rng.pick(PIECES_ASCII)) } else { String::new() };
+        let path = (0..rng.below(4)).fold(String::new(), |mut path, _| {
+            path.push('/');
+            path.push_str(rng.pick(PIECES_ASCII));
+            path
+        });
+        let query = if rng.chance(2) {
+            format!("?{}={}", rng.pick(PIECES_ASCII), rng.pick(PIECES_ASCII))
+        } else {
+            String::new()
+        };
         if let Ok(uri) = format!("{path}{query}").parse::<Uri>() {
             return uri;
         }
@@ -43,10 +84,43 @@ fn random_uri(rng: &mut Rng) -> Uri {
     "/".parse().unwrap()
 }
 
-const PIECES_ASCII: &[&str] = &["a", "b", "0", "%41", "%zz", "%", "%00", "..", ".", "-", "_", "id", "api", "me", "newsletter", "subscribers", "x y", "a+b", "=", "&", "a=b"];
+const PIECES_ASCII: &[&str] = &[
+    "a",
+    "b",
+    "0",
+    "%41",
+    "%zz",
+    "%",
+    "%00",
+    "..",
+    ".",
+    "-",
+    "_",
+    "id",
+    "api",
+    "me",
+    "newsletter",
+    "subscribers",
+    "x y",
+    "a+b",
+    "=",
+    "&",
+    "a=b",
+];
 
 fn random_headers(rng: &mut Rng) -> HeaderMap {
-    const NAMES: &[&str] = &["x-forwarded-for", "cookie", "content-type", "authorization", "host", "x-real-ip", "x-hecks-proxy-auth", "x-anything", "content-length", "set-cookie"];
+    const NAMES: &[&str] = &[
+        "x-forwarded-for",
+        "cookie",
+        "content-type",
+        "authorization",
+        "host",
+        "x-real-ip",
+        "x-hecks-proxy-auth",
+        "x-anything",
+        "content-length",
+        "set-cookie",
+    ];
     let mut headers = HeaderMap::new();
     for _ in 0..rng.below(5) {
         let name = HeaderName::from_static(rng.pick(NAMES));
@@ -81,20 +155,47 @@ fn admit_answers_every_hostile_request_without_panicking() {
                 let headers = random_headers(&mut rng);
                 let body = Bytes::from(random_bytes(&mut rng));
 
-                let parsed = if body.is_empty() { Some(json!({})) } else { serde_json::from_slice::<Value>(&body).ok() };
+                let parsed = if body.is_empty() {
+                    Some(json!({}))
+                } else {
+                    serde_json::from_slice::<Value>(&body).ok()
+                };
                 let answer = admit(&limits, from, &method, &uri, &headers, &body);
                 match (parsed, answer) {
-                    (None, Err(refusal)) => assert_eq!(status_of(&refusal), 400, "seed {seed}: a body that is not JSON is a 400, got {}", status_of(&refusal)),
-                    (None, Ok(envelope)) => panic!("seed {seed}: admitted a body that is not JSON: {envelope}"),
-                    (Some(_), Err(refusal)) => assert_eq!(status_of(&refusal), 429, "seed {seed}: valid JSON is refused only by the limiter, got {}", status_of(&refusal)),
+                    (None, Err(refusal)) => assert_eq!(
+                        status_of(&refusal),
+                        400,
+                        "seed {seed}: a body that is not JSON is a 400, got {}",
+                        status_of(&refusal)
+                    ),
+                    (None, Ok(envelope)) => {
+                        panic!("seed {seed}: admitted a body that is not JSON: {envelope}")
+                    }
+                    (Some(_), Err(refusal)) => assert_eq!(
+                        status_of(&refusal),
+                        429,
+                        "seed {seed}: valid JSON is refused only by the limiter, got {}",
+                        status_of(&refusal)
+                    ),
                     (Some(parsed), Ok(envelope)) => {
-                        let internal = trusts_internal_dispatch(from) && is_internal_dispatch_shape(&parsed);
+                        let internal =
+                            trusts_internal_dispatch(from) && is_internal_dispatch_shape(&parsed);
                         if internal {
-                            assert_eq!(envelope, parsed, "seed {seed}: a trusted internal body passes through untouched");
+                            assert_eq!(
+                                envelope, parsed,
+                                "seed {seed}: a trusted internal body passes through untouched"
+                            );
                         } else {
-                            assert_eq!(envelope["requestContext"]["http"]["method"], method.as_str(), "seed {seed}");
+                            assert_eq!(
+                                envelope["requestContext"]["http"]["method"],
+                                method.as_str(),
+                                "seed {seed}"
+                            );
                             assert_eq!(envelope["rawPath"], uri.path(), "seed {seed}");
-                            assert!(envelope["body"].is_string(), "seed {seed}: the synthesized body is text");
+                            assert!(
+                                envelope["body"].is_string(),
+                                "seed {seed}: the synthesized body is text"
+                            );
                             assert_eq!(envelope["isBase64Encoded"], false, "seed {seed}");
                         }
                     }
@@ -113,18 +214,54 @@ fn a_public_peer_can_never_smuggle_in_the_internal_dispatch_protocol() {
             let limits = limits(&[]);
             for _ in 0..20 {
                 let mut internal = serde_json::Map::new();
-                for key in ["verb", "role", "actor_id", "args", "read", "query", "to", "with", "requestContext", "cookies"] {
+                for key in [
+                    "verb",
+                    "role",
+                    "actor_id",
+                    "args",
+                    "read",
+                    "query",
+                    "to",
+                    "with",
+                    "requestContext",
+                    "cookies",
+                ] {
                     if rng.chance(2) {
                         internal.insert(key.to_string(), random_value(&mut rng, 1));
                     }
                 }
                 let body = Bytes::from(Value::Object(internal).to_string());
                 let from = peer(rng.pick(&PEERS[3..]));
-                let envelope = admit(&limits, from, &Method::POST, &"/x".parse().unwrap(), &random_headers(&mut rng), &body)
-                    .unwrap_or_else(|_| panic!("seed {seed}: valid JSON from a public peer is admitted"));
-                let keys: std::collections::BTreeSet<&str> = envelope.as_object().unwrap().keys().map(String::as_str).collect();
-                let expected: std::collections::BTreeSet<&str> = ["requestContext", "rawPath", "rawQueryString", "headers", "body", "isBase64Encoded"].into();
-                assert_eq!(keys, expected, "seed {seed}: a public peer's body must be wrapped as plain request data");
+                let envelope = admit(
+                    &limits,
+                    from,
+                    &Method::POST,
+                    &"/x".parse().unwrap(),
+                    &random_headers(&mut rng),
+                    &body,
+                )
+                .unwrap_or_else(|_| {
+                    panic!("seed {seed}: valid JSON from a public peer is admitted")
+                });
+                let keys: std::collections::BTreeSet<&str> = envelope
+                    .as_object()
+                    .unwrap()
+                    .keys()
+                    .map(String::as_str)
+                    .collect();
+                let expected: std::collections::BTreeSet<&str> = [
+                    "requestContext",
+                    "rawPath",
+                    "rawQueryString",
+                    "headers",
+                    "body",
+                    "isBase64Encoded",
+                ]
+                .into();
+                assert_eq!(
+                    keys, expected,
+                    "seed {seed}: a public peer's body must be wrapped as plain request data"
+                );
             }
         });
     }
@@ -135,15 +272,47 @@ fn a_malformed_body_is_refused_before_it_costs_any_rate_limit_budget() {
     let limits = limits(&[("HECKS_RATE_LIMIT_SUBSCRIBE", "1")]);
     let from = peer("203.0.113.7:5000");
     let uri: Uri = "/newsletter/subscribers".parse().unwrap();
-    for body in ["{", "not json", "{\"a\":", "\u{0}", "[1,", "{\"a\":1}x", "\u{feff}{}"] {
+    for body in [
+        "{",
+        "not json",
+        "{\"a\":",
+        "\u{0}",
+        "[1,",
+        "{\"a\":1}x",
+        "\u{feff}{}",
+    ] {
         for _ in 0..10 {
-            let refusal = admit(&limits, from, &Method::POST, &uri, &HeaderMap::new(), &Bytes::from(body.to_string())).err().expect("refused");
+            let refusal = admit(
+                &limits,
+                from,
+                &Method::POST,
+                &uri,
+                &HeaderMap::new(),
+                &Bytes::from(body.to_string()),
+            )
+            .expect_err("refused");
             assert_eq!(status_of(&refusal), 400, "{body:?}");
         }
     }
-    let spent = |limits: &RateLimits| admit(limits, from, &Method::POST, &uri, &HeaderMap::new(), &Bytes::from("{}")).is_ok();
-    assert!(spent(&limits), "the one allowed request still goes through after the refusals");
-    assert!(!spent(&limits), "and the next is limited: only the valid request spent budget");
+    let spent = |limits: &RateLimits| {
+        admit(
+            limits,
+            from,
+            &Method::POST,
+            &uri,
+            &HeaderMap::new(),
+            &Bytes::from("{}"),
+        )
+        .is_ok()
+    };
+    assert!(
+        spent(&limits),
+        "the one allowed request still goes through after the refusals"
+    );
+    assert!(
+        !spent(&limits),
+        "and the next is limited: only the valid request spent budget"
+    );
 }
 
 #[test]
@@ -152,18 +321,61 @@ fn invalid_utf8_and_oversized_bodies_are_answered() {
     let from = peer("203.0.113.7:5000");
     let uri: Uri = "/x".parse().unwrap();
     let invalid = Bytes::from(vec![0xff, 0xfe, 0xfd]);
-    assert_eq!(status_of(&admit(&limits, from, &Method::POST, &uri, &HeaderMap::new(), &invalid).err().unwrap()), 400);
+    assert_eq!(
+        status_of(
+            &admit(
+                &limits,
+                from,
+                &Method::POST,
+                &uri,
+                &HeaderMap::new(),
+                &invalid
+            )
+            .err()
+            .unwrap()
+        ),
+        400
+    );
 
     // A 16 MiB body of valid JSON is admitted as text (a size cap belongs to the listener, not here)
     // and a 16 MiB run of openers is refused by the parser's depth limit rather than overflowing.
     guarded("large bodies", move || {
         let big_string = Bytes::from(format!("\"{}\"", "a".repeat(16 * 1024 * 1024)));
-        assert!(admit(&limits, from, &Method::POST, &uri, &HeaderMap::new(), &big_string).is_ok());
+        assert!(admit(
+            &limits,
+            from,
+            &Method::POST,
+            &uri,
+            &HeaderMap::new(),
+            &big_string
+        )
+        .is_ok());
         let openers = Bytes::from("[".repeat(16 * 1024 * 1024));
-        let refusal = admit(&limits, from, &Method::POST, &uri, &HeaderMap::new(), &openers).err().expect("refused");
+        let refusal = admit(
+            &limits,
+            from,
+            &Method::POST,
+            &uri,
+            &HeaderMap::new(),
+            &openers,
+        )
+        .expect_err("refused");
         assert_eq!(status_of(&refusal), 400);
         let nested = Bytes::from(format!("{}1{}", "[".repeat(100_000), "]".repeat(100_000)));
-        assert_eq!(status_of(&admit(&limits, from, &Method::POST, &uri, &HeaderMap::new(), &nested).err().expect("refused")), 400);
+        assert_eq!(
+            status_of(
+                &admit(
+                    &limits,
+                    from,
+                    &Method::POST,
+                    &uri,
+                    &HeaderMap::new(),
+                    &nested
+                )
+                .expect_err("refused")
+            ),
+            400
+        );
     });
 }
 
@@ -174,7 +386,14 @@ fn value_to_response_answers_any_shape_of_handler_output() {
             let mut rng = Rng::new(seed ^ 0xFACE);
             for _ in 0..30 {
                 let mut value = serde_json::Map::new();
-                for key in ["statusCode", "headers", "cookies", "body", "isBase64Encoded", "extra"] {
+                for key in [
+                    "statusCode",
+                    "headers",
+                    "cookies",
+                    "body",
+                    "isBase64Encoded",
+                    "extra",
+                ] {
                     if rng.chance(4) {
                         continue;
                     }
@@ -186,8 +405,28 @@ fn value_to_response_answers_any_shape_of_handler_output() {
                             }
                             Value::Object(map)
                         }
-                        "cookies" if rng.chance(2) => Value::Array((0..rng.below(4)).map(|_| random_value(&mut rng, 2)).collect()),
-                        "statusCode" if rng.chance(2) => json!(*rng.pick(&[0u64, 99, 100, 199, 200, 204, 299, 301, 404, 599, 600, 999, 65_536, 65_736, u64::MAX])),
+                        "cookies" if rng.chance(2) => Value::Array(
+                            (0..rng.below(4))
+                                .map(|_| random_value(&mut rng, 2))
+                                .collect(),
+                        ),
+                        "statusCode" if rng.chance(2) => json!(*rng.pick(&[
+                            0u64,
+                            99,
+                            100,
+                            199,
+                            200,
+                            204,
+                            299,
+                            301,
+                            404,
+                            599,
+                            600,
+                            999,
+                            65_536,
+                            65_736,
+                            u64::MAX
+                        ])),
                         _ => random_value(&mut rng, 1),
                     };
                     value.insert(key.to_string(), field);
@@ -209,7 +448,10 @@ fn an_out_of_range_status_code_is_a_500_not_a_wrapped_status() {
         let response = value_to_response(json!({ "statusCode": code, "body": "x" }));
         assert_eq!(status_of(&response), 500, "statusCode {code}");
     }
-    assert_eq!(status_of(&value_to_response(json!({ "statusCode": 204 }))), 204);
+    assert_eq!(
+        status_of(&value_to_response(json!({ "statusCode": 204 }))),
+        204
+    );
 }
 
 #[test]
@@ -222,6 +464,11 @@ fn control_characters_in_response_headers_and_cookies_are_dropped_not_emitted()
     }));
     assert!(response.headers().get("x-split").is_none());
     assert!(response.headers().get("x-injected").is_none());
-    let cookies: Vec<&str> = response.headers().get_all("set-cookie").iter().filter_map(|v| v.to_str().ok()).collect();
+    let cookies: Vec<&str> = response
+        .headers()
+        .get_all("set-cookie")
+        .iter()
+        .filter_map(|v| v.to_str().ok())
+        .collect();
     assert_eq!(cookies, vec!["session=abc; Path=/"]);
 }

data/rust/host/src/boundary_fuzz/web.rs

@@ -8,7 +8,25 @@ use crate::fuzz_support::*;
 #[test]
 fn percent_decoding_never_slices_through_a_multi_byte_character() {
     // `%a` followed by a 4-byte character puts the two-digit hex window mid-character.
-    for text in ["%a🍕", "%🍕", "%é", "a%é", "%a日", "%%a🍕", "%1é1", "🍕%", "🍕%a", "%a", "%", "%%", "%4", "%41", "x%e6%97%a5y", "%e6%97", "%ff%fe"] {
+    for text in [
+        "%a🍕",
+        "%🍕",
+        "%é",
+        "a%é",
+        "%a日",
+        "%%a🍕",
+        "%1é1",
+        "🍕%",
+        "🍕%a",
+        "%a",
+        "%",
+        "%%",
+        "%4",
+        "%41",
+        "x%e6%97%a5y",
+        "%e6%97",
+        "%ff%fe",
+    ] {
         for plus_as_space in [true, false] {
             let decoded = percent_decode_impl(text, plus_as_space);
             assert!(decoded.len() < text.len() * 4 + 4, "{text:?}");
@@ -39,7 +57,11 @@ fn form_and_query_strings_decode_any_text() {
                 let _ = percent_decode(&text);
                 let _ = auth::urlencode(&text);
                 // What the encoder emits, the decoder must read back exactly.
-                assert_eq!(percent_decode_impl(&auth::urlencode(&text), false), text, "seed {seed}: {text:?}");
+                assert_eq!(
+                    percent_decode_impl(&auth::urlencode(&text), false),
+                    text,
+                    "seed {seed}: {text:?}"
+                );
             }
         });
     }
@@ -48,7 +70,10 @@ fn form_and_query_strings_decode_any_text() {
 #[test]
 fn huge_query_strings_decode_in_linear_time() {
     guarded("huge query", || {
-        let pairs = (0..200_000).map(|i| format!("k{i}=%41%e6%97%a5")).collect::<Vec<_>>().join("&");
+        let pairs = (0..200_000)
+            .map(|i| format!("k{i}=%41%e6%97%a5"))
+            .collect::<Vec<_>>()
+            .join("&");
         assert_eq!(parse_query(&pairs).len(), 200_000);
         let _ = parse_form(&"%".repeat(5_000_000));
         let _ = parse_form(&"%a🍕".repeat(1_000_000));
@@ -65,7 +90,9 @@ fn cookie_extraction_reads_any_event_shape() {
                     0 => random_value(&mut rng, 0),
                     1 => json!({"cookies": random_value(&mut rng, 2)}),
                     2 => json!({"headers": {"cookie": random_value(&mut rng, 1)}}),
-                    _ => json!({"cookies": [random_text(&mut rng), random_text(&mut rng)], "headers": {"cookie": random_text(&mut rng)}}),
+                    _ => {
+                        json!({"cookies": [random_text(&mut rng), random_text(&mut rng)], "headers": {"cookie": random_text(&mut rng)}})
+                    }
                 };
                 let _ = extract_cookies(&body);
             }
@@ -105,7 +132,10 @@ fn paths_and_origins_shape_any_text() {
                 for authenticated in [true, false] {
                     if let Some(refusal) = auth_gate(&path, authenticated) {
                         let status = refusal["statusCode"].as_u64().expect("a status");
-                        assert!(status == 401 || status == 302, "seed {seed}: {path:?} gated with {status}");
+                        assert!(
+                            status == 401 || status == 302,
+                            "seed {seed}: {path:?} gated with {status}"
+                        );
                     }
                 }
             }
@@ -116,10 +146,28 @@ fn paths_and_origins_shape_any_text() {
 #[test]
 fn an_unauthenticated_request_is_never_let_past_the_gate_by_a_path_trick() {
     // Only the four sign-in paths are open; near-misses must be gated.
-    for path in ["/login/", "/LOGIN", "/login%2f", "//login", "/login/../admin", "/auth/google/", "/auth/google/callback/x", "/logout.json", "/./login", "/login?x", "/login "] {
-        assert!(auth_gate(path, false).is_some(), "{path:?} must be gated for an anonymous caller");
+    for path in [
+        "/login/",
+        "/LOGIN",
+        "/login%2f",
+        "//login",
+        "/login/../admin",
+        "/auth/google/",
+        "/auth/google/callback/x",
+        "/logout.json",
+        "/./login",
+        "/login?x",
+        "/login ",
+    ] {
+        assert!(
+            auth_gate(path, false).is_some(),
+            "{path:?} must be gated for an anonymous caller"
+        );
     }
     for path in ["/login", "/logout", "/auth/google", "/auth/google/callback"] {
-        assert!(auth_gate(path, false).is_none(), "{path:?} is the sign-in path");
+        assert!(
+            auth_gate(path, false).is_none(),
+            "{path:?} is the sign-in path"
+        );
     }
 }