hecks 3.5.0 → 3.7.0

data/rust/host/src/boundary_fuzz/expr_json.rs

@@ -0,0 +1,158 @@
+//! Seeded fuzz of the invariant interpreter: an `ast` node read from the IR sidecar is parsed
+//! and evaluated against a value object's fields, both of which can be wrong in every way
+//! (unknown ops, wrong-typed fields, hostile regexes, overflowing arithmetic). The answer is an
+//! `Ok` or an `Err(String)`, never a panic or a hang.
+
+use crate::expr_json::{interpret, parse};
+use crate::fuzz_support::*;
+use serde_json::{json, Value};
+
+const BINARY: &[&str] = &["or", "and", "compare", "include", "add", "modulo"];
+const UNARY: &[&str] = &["not", "sign_test", "empty", "to_s", "size", "presence", "assignment", "first", "last", "split", "starts_with", "ends_with", "matches_regex"];
+
+const PATTERNS: &[&str] = &[
+    "", "^$", "a", "(a*)*b", "(a|aa)+$", "[", "]", "[]", "[^]", "[a-", "(", ")", "(?", "(?P<x>", "\\", "\\d+", "\\D\\W\\S\\H", "\\Z", "[\\d]", "[\\Z]", "\\p{L}+", "\\p{Nope}",
+    "a{1000}", "a{1000}{1000}", "(((a{100}){100}){100})", "(?i)ABC", "(?x) a b", "\\x{110000}", "\\u{1F355}", ".*.*.*.*.*.*.*b", "\\b\\B", "(?<n>a)\\k<n>", "(a)\\1", "^*", "$+", "é+", "🍕{2}",
+];
+
+fn leaf(rng: &mut Rng) -> Value {
+    match rng.below(9) {
+        0 => json!({"op": "int", "value": edge_number(rng)}),
+        1 => json!({"op": "float", "value": edge_number(rng)}),
+        2 => json!({"op": "str", "value": random_text(rng)}),
+        3 => json!({"op": "bool", "value": rng.chance(2)}),
+        4 => json!({"op": "nil"}),
+        5 => json!({"op": "lookup", "path": (0..1 + rng.below(3)).map(|_| *rng.pick(&["a", "b", "items", "name", "missing", "x", ""])).collect::<Vec<_>>()}),
+        6 => json!({"op": "array", "elements": (0..rng.below(4)).map(|_| json!({"op": "int", "value": rng.below(5)})).collect::<Vec<_>>()}),
+        7 => json!({"op": "int", "value": i64::MAX}),
+        _ => json!({"op": "str", "value": ""}),
+    }
+}
+
+fn node(rng: &mut Rng, depth: usize) -> Value {
+    if depth >= 4 || rng.chance(4) {
+        return leaf(rng);
+    }
+    let cmp = || json!({"less_than": true, "equal": true, "negated": false});
+    match rng.below(10) {
+        0..=3 => {
+            let op = *rng.pick(BINARY);
+            let mut value = json!({"op": op, "left": node(rng, depth + 1), "right": node(rng, depth + 1), "receiver": node(rng, depth + 1), "divisor": node(rng, depth + 1), "haystack": node(rng, depth + 1), "needle": node(rng, depth + 1)});
+            value["cmp"] = cmp();
+            value
+        }
+        4..=7 => {
+            let op = *rng.pick(UNARY);
+            let mut value = json!({"op": op, "receiver": node(rng, depth + 1), "expr": node(rng, depth + 1), "negated": rng.chance(2), "separator": random_text(rng), "substring": random_text(rng), "pattern": *rng.pick(PATTERNS), "flags": *rng.pick(&["", "i", "m", "x", "imx", "z"])});
+            value["cmp"] = json!({"less_than": rng.chance(2), "equal": rng.chance(2), "negated": rng.chance(2)});
+            value
+        }
+        8 => json!({"op": *rng.pick(&["block_predicate", "find"]), "mode": *rng.pick(&["all", "any", "none", "some"]), "receiver": node(rng, depth + 1), "param": *rng.pick(&["i", "a", ""]), "predicate": node(rng, depth + 1), "path": [*rng.pick(&["a", "x"])]}),
+        _ => random_value(rng, 1),
+    }
+}
+
+fn instance(rng: &mut Rng) -> Value {
+    let mut fields = serde_json::Map::new();
+    for key in ["a", "b", "items", "name", "x"] {
+        if !rng.chance(4) {
+            fields.insert(key.to_string(), if rng.chance(2) { random_value(rng, 1) } else { json!([{"x": 1}, {"x": "t"}, 3]) });
+        }
+    }
+    Value::Object(fields)
+}
+
+#[test]
+fn any_expression_tree_parses_or_refuses_and_evaluates_or_refuses() {
+    for seed in 0..seeds() {
+        guarded(&format!("seed {seed}"), move || {
+            let mut rng = Rng::new(seed);
+            for _ in 0..40 {
+                let tree = node(&mut rng, 0);
+                let Ok(expr) = parse(&tree) else { continue };
+                for _ in 0..3 {
+                    let _ = interpret(&expr, &instance(&mut rng));
+                }
+            }
+        });
+    }
+}
+
+#[test]
+fn a_damaged_ast_document_is_refused_not_a_panic() {
+    for seed in 0..seeds() {
+        guarded(&format!("seed {seed}"), move || {
+            let mut rng = Rng::new(seed ^ 0xA57);
+            for _ in 0..40 {
+                let valid = node(&mut rng, 0).to_string();
+                let text = mutate_text(&mut rng, &valid);
+                if let Ok(tree) = serde_json::from_str::<Value>(&text) {
+                    if let Ok(expr) = parse(&tree) {
+                        let _ = interpret(&expr, &instance(&mut rng));
+                    }
+                }
+            }
+        });
+    }
+}
+
+#[test]
+fn arbitrary_json_is_never_an_expression() {
+    for seed in 0..seeds() {
+        guarded(&format!("seed {seed}"), move || {
+            let mut rng = Rng::new(seed ^ 0x77);
+            for _ in 0..100 {
+                let _ = parse(&random_value(&mut rng, 0));
+            }
+        });
+    }
+}
+
+#[test]
+fn hostile_regexes_compile_or_refuse_quickly_and_match_without_blowing_up() {
+    for pattern in PATTERNS {
+        for flags in ["", "i", "mx"] {
+            let tree = json!({"op": "matches_regex", "receiver": {"op": "str", "value": "a".repeat(5_000)}, "pattern": pattern, "flags": flags});
+            let expr = parse(&tree).expect("a well-formed node");
+            guarded(&format!("{pattern:?} {flags:?}"), move || {
+                let _ = interpret(&expr, &json!({}));
+            });
+        }
+    }
+}
+
+#[test]
+fn integer_arithmetic_at_the_limits_refuses_instead_of_overflowing() {
+    let int = |n: i64| json!({"op": "int", "value": n});
+    let cases = [
+        json!({"op": "add", "left": int(i64::MAX), "right": int(1)}),
+        json!({"op": "add", "left": int(i64::MIN), "right": int(-1)}),
+        json!({"op": "modulo", "receiver": int(i64::MIN), "divisor": int(-1)}),
+        json!({"op": "modulo", "receiver": int(i64::MAX), "divisor": int(i64::MIN)}),
+        json!({"op": "modulo", "receiver": int(1), "divisor": int(0)}),
+        json!({"op": "modulo", "receiver": {"op": "float", "value": 1.5}, "divisor": {"op": "float", "value": 0.0}}),
+        json!({"op": "add", "left": {"op": "float", "value": 1.7976931348623157e308}, "right": {"op": "float", "value": 1.7976931348623157e308}}),
+    ];
+    for tree in cases {
+        let expr = parse(&tree).expect("well-formed");
+        let _ = interpret(&expr, &json!({}));
+    }
+    assert!(interpret(&parse(&cases_add_overflow()).unwrap(), &json!({})).is_err(), "i64::MAX + 1 must refuse");
+}
+
+fn cases_add_overflow() -> Value {
+    json!({"op": "add", "left": {"op": "int", "value": i64::MAX}, "right": {"op": "int", "value": 1}})
+}
+
+#[test]
+fn a_document_nested_past_the_json_limit_never_reaches_the_interpreter() {
+    // The IR is read with serde_json, whose recursion limit refuses what would overflow `parse`.
+    let nested = format!("{}{{\"op\":\"nil\"}}{}", "{\"op\":\"not\",\"expr\":".repeat(10_000), "}".repeat(10_000));
+    assert!(serde_json::from_str::<Value>(&nested).is_err());
+    let within = format!("{}{{\"op\":\"nil\"}}{}", "{\"op\":\"not\",\"expr\":".repeat(60), "}".repeat(60));
+    guarded("depth 60", move || {
+        let tree: Value = serde_json::from_str(&within).expect("within serde's limit");
+        let expr = parse(&tree).expect("well-formed");
+        let _ = interpret(&expr, &json!({}));
+    });
+}

data/rust/host/src/boundary_fuzz/ir.rs

@@ -0,0 +1,78 @@
+//! Seeded fuzz of the IR sidecar readers: `ir.json` is generated, but it is read from disk at
+//! boot, so a stale, hand-edited or truncated file must come back as `None` or a refusal, never
+//! a panic.
+
+use super::*;
+use crate::fuzz_support::*;
+use serde_json::json;
+
+const KEYS: &[&str] = &[
+    "name", "aggregates", "lineage", "capable_aggregates", "storage_name", "persistence", "adapter", "authorization", "grant", "assignment_aggregate", "membership", "provider", "aggregate",
+    "identity", "register", "link", "resolve", "newsletter", "subscribe", "add_name", "confirm", "unsubscribe", "newsletter_issues", "issue_aggregate", "schedule", "send_issue", "record_delivery",
+    "payments", "initiate", "succeeded", "failed", "event_aggregate", "registrations", "registration_aggregate", "request", "payment_connection", "commands", "attributes",
+];
+
+/// An object over the keys the readers look up, with each value the right shape, the wrong
+/// shape, or missing: the mix that finds a reader trusting its input.
+fn random_ir(rng: &mut Rng, depth: usize) -> Value {
+    let mut fields = serde_json::Map::new();
+    for key in KEYS {
+        if rng.chance(3) {
+            continue;
+        }
+        let value = match rng.below(5) {
+            0 if depth < 2 => random_ir(rng, depth + 1),
+            1 => Value::String(random_text(rng)),
+            2 => Value::Array((0..rng.below(2)).map(|_| if depth < 2 { random_ir(rng, depth + 1) } else { Value::Null }).collect()),
+            3 => json!(*rng.pick(&["Postgres", "PostgresEra", "Heki", "Memory", ""])),
+            _ => random_value(rng, 2),
+        };
+        fields.insert(key.to_string(), value);
+    }
+    Value::Object(fields)
+}
+
+#[test]
+fn every_provider_reader_answers_any_ir_shape() {
+    for seed in 0..seeds() {
+        guarded(&format!("seed {seed}"), move || {
+            let mut rng = Rng::new(seed);
+            for _ in 0..40 {
+                let ir = if rng.chance(8) { random_value(&mut rng, 0) } else { random_ir(&mut rng, 0) };
+                let _ = lineage_capable_aggregates(&ir);
+                let _ = persistence_adapters(&ir);
+                let _ = mirrored_aggregates(&ir);
+                let _ = authorization_provider(&ir);
+                let _ = membership_provider(&ir);
+                let _ = identity_provider(&ir);
+                let _ = command_declares(&ir, &random_text(&mut rng), &random_text(&mut rng), &random_text(&mut rng));
+                let _ = newsletter_provider(&ir).map(|p| p.instance_prefix());
+                let _ = newsletter_issues_provider(&ir).map(|p| p.issue_prefix());
+                let _ = payments_provider(&ir).map(|p| p.instance_prefix());
+                if let Some(p) = registrations_provider(&ir) {
+                    let _ = (p.event_prefix(), p.registration_prefix(), p.request_target());
+                }
+                if let Some(p) = payment_connection_provider(&ir) {
+                    let _ = p.instance_prefix();
+                }
+                let _ = registrations_binding(&random_text(&mut rng));
+                let _ = payment_connection_binding(&random_text(&mut rng));
+                if let Err(message) = refuse_unsupported_persistence_adapters(&ir) {
+                    assert!(message.contains("rust/host only has a backend"), "seed {seed}: unhelpful refusal {message:?}");
+                }
+            }
+        });
+    }
+}
+
+#[test]
+fn an_unsupported_persistence_adapter_is_always_refused_at_boot() {
+    for adapter in ["Heki", "Memory", "Sqlite", "", "postgres", "Postgres "] {
+        let ir = json!({"name": "D", "persistence": {"aggregates": [{"name": "A", "adapter": adapter}]}});
+        assert!(refuse_unsupported_persistence_adapters(&ir).is_err(), "{adapter:?}");
+    }
+    for adapter in ["Postgres", "PostgresEra"] {
+        let ir = json!({"name": "D", "persistence": {"aggregates": [{"name": "A", "adapter": adapter}]}});
+        assert!(refuse_unsupported_persistence_adapters(&ir).is_ok(), "{adapter:?}");
+    }
+}

data/rust/host/src/boundary_fuzz/server.rs

@@ -0,0 +1,227 @@
+//! Seeded fuzz of the HTTP front door (`admit`, `value_to_response`): hostile bodies, methods, URIs
+//! and headers must be answered, never panic, and a refused request must leave no trace.
+//! Everything here is in-process: `admit` is the whole of what runs before dispatch, so none of
+//! it needs Postgres or wasm.
+
+use super::*;
+use crate::fuzz_support::*;
+use serde_json::json;
+
+fn limits(pairs: &[(&str, &str)]) -> RateLimits {
+    let map: std::collections::HashMap<String, String> = pairs.iter().map(|(k, v)| (k.to_string(), v.to_string())).collect();
+    RateLimits::new(crate::rate_limit::Config::from_lookup(|name| map.get(name).cloned()).0)
+}
+
+fn peer(text: &str) -> SocketAddr {
+    text.parse().unwrap()
+}
+
+const PEERS: &[&str] = &["127.0.0.1:5000", "[::1]:5000", "[::ffff:127.0.0.1]:5000", "10.0.0.5:5000", "203.0.113.7:5000", "[2001:db8::1]:5000"];
+
+fn random_method(rng: &mut Rng) -> Method {
+    let methods = [Method::GET, Method::POST, Method::PUT, Method::DELETE, Method::PATCH, Method::HEAD, Method::OPTIONS, Method::TRACE, Method::CONNECT];
+    if rng.chance(8) {
+        Method::from_bytes(b"BREW").unwrap()
+    } else {
+        rng.pick(&methods).clone()
+    }
+}
+
+/// A URI that parses: a hostile path built from the pieces, or a fixed route the limiter knows.
+fn random_uri(rng: &mut Rng) -> Uri {
+    const FIXED: &[&str] = &["/", "/newsletter/subscribers", "/registrations", "/api/me", "/login", "/%00", "/../..", "/a?b=%a", "/x?%", "/a//b", "/a;b", "*"];
+    if rng.chance(3) {
+        return rng.pick(FIXED).parse().unwrap();
+    }
+    for _ in 0..8 {
+        let path: String = (0..rng.below(4)).map(|_| format!("/{}", rng.pick(PIECES_ASCII))).collect();
+        let query = if rng.chance(2) { format!("?{}={}", rng.pick(PIECES_ASCII), rng.pick(PIECES_ASCII)) } else { String::new() };
+        if let Ok(uri) = format!("{path}{query}").parse::<Uri>() {
+            return uri;
+        }
+    }
+    "/".parse().unwrap()
+}
+
+const PIECES_ASCII: &[&str] = &["a", "b", "0", "%41", "%zz", "%", "%00", "..", ".", "-", "_", "id", "api", "me", "newsletter", "subscribers", "x y", "a+b", "=", "&", "a=b"];
+
+fn random_headers(rng: &mut Rng) -> HeaderMap {
+    const NAMES: &[&str] = &["x-forwarded-for", "cookie", "content-type", "authorization", "host", "x-real-ip", "x-hecks-proxy-auth", "x-anything", "content-length", "set-cookie"];
+    let mut headers = HeaderMap::new();
+    for _ in 0..rng.below(5) {
+        let name = HeaderName::from_static(rng.pick(NAMES));
+        let bytes: Vec<u8> = match rng.below(4) {
+            0 => random_text(rng).into_bytes(),
+            1 => (0..rng.below(24)).map(|_| rng.next() as u8).collect(),
+            2 => b"1.2.3.4, 5.6.7.8, ::1, not-an-ip, [::ffff:127.0.0.1]".to_vec(),
+            _ => "x".repeat(rng.below(9000)).into_bytes(),
+        };
+        // Header values are a restricted byte set; the ones the type refuses never reach `admit`.
+        if let Ok(value) = HeaderValue::from_bytes(&bytes) {
+            headers.append(name, value);
+        }
+    }
+    headers
+}
+
+fn status_of(refusal: &Response) -> u16 {
+    refusal.status().as_u16()
+}
+
+#[test]
+fn admit_answers_every_hostile_request_without_panicking() {
+    for seed in 0..seeds() {
+        guarded(&format!("seed {seed}"), move || {
+            let mut rng = Rng::new(seed);
+            let limits = limits(&[]);
+            for _ in 0..30 {
+                let from = peer(rng.pick(PEERS));
+                let method = random_method(&mut rng);
+                let uri = random_uri(&mut rng);
+                let headers = random_headers(&mut rng);
+                let body = Bytes::from(random_bytes(&mut rng));
+
+                let parsed = if body.is_empty() { Some(json!({})) } else { serde_json::from_slice::<Value>(&body).ok() };
+                let answer = admit(&limits, from, &method, &uri, &headers, &body);
+                match (parsed, answer) {
+                    (None, Err(refusal)) => assert_eq!(status_of(&refusal), 400, "seed {seed}: a body that is not JSON is a 400, got {}", status_of(&refusal)),
+                    (None, Ok(envelope)) => panic!("seed {seed}: admitted a body that is not JSON: {envelope}"),
+                    (Some(_), Err(refusal)) => assert_eq!(status_of(&refusal), 429, "seed {seed}: valid JSON is refused only by the limiter, got {}", status_of(&refusal)),
+                    (Some(parsed), Ok(envelope)) => {
+                        let internal = trusts_internal_dispatch(from) && is_internal_dispatch_shape(&parsed);
+                        if internal {
+                            assert_eq!(envelope, parsed, "seed {seed}: a trusted internal body passes through untouched");
+                        } else {
+                            assert_eq!(envelope["requestContext"]["http"]["method"], method.as_str(), "seed {seed}");
+                            assert_eq!(envelope["rawPath"], uri.path(), "seed {seed}");
+                            assert!(envelope["body"].is_string(), "seed {seed}: the synthesized body is text");
+                            assert_eq!(envelope["isBase64Encoded"], false, "seed {seed}");
+                        }
+                    }
+                }
+            }
+        });
+    }
+}
+
+#[test]
+fn a_public_peer_can_never_smuggle_in_the_internal_dispatch_protocol() {
+    // The internal shapes carry a caller's own `role` with no session check; only loopback may use them.
+    for seed in 0..seeds() {
+        guarded(&format!("seed {seed}"), move || {
+            let mut rng = Rng::new(seed ^ 0xBEEF);
+            let limits = limits(&[]);
+            for _ in 0..20 {
+                let mut internal = serde_json::Map::new();
+                for key in ["verb", "role", "actor_id", "args", "read", "query", "to", "with", "requestContext", "cookies"] {
+                    if rng.chance(2) {
+                        internal.insert(key.to_string(), random_value(&mut rng, 1));
+                    }
+                }
+                let body = Bytes::from(Value::Object(internal).to_string());
+                let from = peer(rng.pick(&PEERS[3..]));
+                let envelope = admit(&limits, from, &Method::POST, &"/x".parse().unwrap(), &random_headers(&mut rng), &body)
+                    .unwrap_or_else(|_| panic!("seed {seed}: valid JSON from a public peer is admitted"));
+                let keys: std::collections::BTreeSet<&str> = envelope.as_object().unwrap().keys().map(String::as_str).collect();
+                let expected: std::collections::BTreeSet<&str> = ["requestContext", "rawPath", "rawQueryString", "headers", "body", "isBase64Encoded"].into();
+                assert_eq!(keys, expected, "seed {seed}: a public peer's body must be wrapped as plain request data");
+            }
+        });
+    }
+}
+
+#[test]
+fn a_malformed_body_is_refused_before_it_costs_any_rate_limit_budget() {
+    let limits = limits(&[("HECKS_RATE_LIMIT_SUBSCRIBE", "1")]);
+    let from = peer("203.0.113.7:5000");
+    let uri: Uri = "/newsletter/subscribers".parse().unwrap();
+    for body in ["{", "not json", "{\"a\":", "\u{0}", "[1,", "{\"a\":1}x", "\u{feff}{}"] {
+        for _ in 0..10 {
+            let refusal = admit(&limits, from, &Method::POST, &uri, &HeaderMap::new(), &Bytes::from(body.to_string())).err().expect("refused");
+            assert_eq!(status_of(&refusal), 400, "{body:?}");
+        }
+    }
+    let spent = |limits: &RateLimits| admit(limits, from, &Method::POST, &uri, &HeaderMap::new(), &Bytes::from("{}")).is_ok();
+    assert!(spent(&limits), "the one allowed request still goes through after the refusals");
+    assert!(!spent(&limits), "and the next is limited: only the valid request spent budget");
+}
+
+#[test]
+fn invalid_utf8_and_oversized_bodies_are_answered() {
+    let limits = limits(&[]);
+    let from = peer("203.0.113.7:5000");
+    let uri: Uri = "/x".parse().unwrap();
+    let invalid = Bytes::from(vec![0xff, 0xfe, 0xfd]);
+    assert_eq!(status_of(&admit(&limits, from, &Method::POST, &uri, &HeaderMap::new(), &invalid).err().unwrap()), 400);
+
+    // A 16 MiB body of valid JSON is admitted as text (a size cap belongs to the listener, not here)
+    // and a 16 MiB run of openers is refused by the parser's depth limit rather than overflowing.
+    guarded("large bodies", move || {
+        let big_string = Bytes::from(format!("\"{}\"", "a".repeat(16 * 1024 * 1024)));
+        assert!(admit(&limits, from, &Method::POST, &uri, &HeaderMap::new(), &big_string).is_ok());
+        let openers = Bytes::from("[".repeat(16 * 1024 * 1024));
+        let refusal = admit(&limits, from, &Method::POST, &uri, &HeaderMap::new(), &openers).err().expect("refused");
+        assert_eq!(status_of(&refusal), 400);
+        let nested = Bytes::from(format!("{}1{}", "[".repeat(100_000), "]".repeat(100_000)));
+        assert_eq!(status_of(&admit(&limits, from, &Method::POST, &uri, &HeaderMap::new(), &nested).err().expect("refused")), 400);
+    });
+}
+
+#[test]
+fn value_to_response_answers_any_shape_of_handler_output() {
+    for seed in 0..seeds() {
+        guarded(&format!("seed {seed}"), move || {
+            let mut rng = Rng::new(seed ^ 0xFACE);
+            for _ in 0..30 {
+                let mut value = serde_json::Map::new();
+                for key in ["statusCode", "headers", "cookies", "body", "isBase64Encoded", "extra"] {
+                    if rng.chance(4) {
+                        continue;
+                    }
+                    let field = match key {
+                        "headers" if rng.chance(2) => {
+                            let mut map = serde_json::Map::new();
+                            for _ in 0..rng.below(4) {
+                                map.insert(random_text(&mut rng), random_value(&mut rng, 2));
+                            }
+                            Value::Object(map)
+                        }
+                        "cookies" if rng.chance(2) => Value::Array((0..rng.below(4)).map(|_| random_value(&mut rng, 2)).collect()),
+                        "statusCode" if rng.chance(2) => json!(*rng.pick(&[0u64, 99, 100, 199, 200, 204, 299, 301, 404, 599, 600, 999, 65_536, 65_736, u64::MAX])),
+                        _ => random_value(&mut rng, 1),
+                    };
+                    value.insert(key.to_string(), field);
+                }
+                let response = value_to_response(Value::Object(value));
+                // Whatever came in, what goes out is a real status.
+                assert!((100..1000).contains(&status_of(&response)), "seed {seed}");
+            }
+            let plain = value_to_response(random_value(&mut rng, 0));
+            assert!((100..1000).contains(&status_of(&plain)), "seed {seed}");
+        });
+    }
+}
+
+#[test]
+fn an_out_of_range_status_code_is_a_500_not_a_wrapped_status() {
+    // `65736 as u16` is 200: a handler bug must not turn into a success.
+    for code in [0u64, 99, 1000, 65_536, 65_736, 131_272, u64::MAX] {
+        let response = value_to_response(json!({ "statusCode": code, "body": "x" }));
+        assert_eq!(status_of(&response), 500, "statusCode {code}");
+    }
+    assert_eq!(status_of(&value_to_response(json!({ "statusCode": 204 }))), 204);
+}
+
+#[test]
+fn control_characters_in_response_headers_and_cookies_are_dropped_not_emitted() {
+    let response = value_to_response(json!({
+        "statusCode": 200,
+        "headers": { "x-ok": "fine", "x-split": "a\r\nSet-Cookie: stolen=1", "bad name": "v" },
+        "cookies": ["session=abc; Path=/", "evil=1\r\nX-Injected: yes", "nul=\u{0}"],
+        "body": ""
+    }));
+    assert!(response.headers().get("x-split").is_none());
+    assert!(response.headers().get("x-injected").is_none());
+    let cookies: Vec<&str> = response.headers().get_all("set-cookie").iter().filter_map(|v| v.to_str().ok()).collect();
+    assert_eq!(cookies, vec!["session=abc; Path=/"]);
+}

data/rust/host/src/boundary_fuzz/web.rs

@@ -0,0 +1,125 @@
+//! Seeded fuzz of the web layer's request decoding: percent-decoding, form and query strings,
+//! cookies, base64 bodies, path shaping and the auth gate. Every one takes text an anonymous
+//! caller controls, and none may panic on it.
+
+use super::*;
+use crate::fuzz_support::*;
+
+#[test]
+fn percent_decoding_never_slices_through_a_multi_byte_character() {
+    // `%a` followed by a 4-byte character puts the two-digit hex window mid-character.
+    for text in ["%a🍕", "%🍕", "%é", "a%é", "%a日", "%%a🍕", "%1é1", "🍕%", "🍕%a", "%a", "%", "%%", "%4", "%41", "x%e6%97%a5y", "%e6%97", "%ff%fe"] {
+        for plus_as_space in [true, false] {
+            let decoded = percent_decode_impl(text, plus_as_space);
+            assert!(decoded.len() < text.len() * 4 + 4, "{text:?}");
+        }
+    }
+    assert_eq!(percent_decode("%41%2f%2F+x"), "A// x");
+    assert_eq!(percent_decode_impl("a+b", false), "a+b");
+}
+
+#[test]
+fn percent_decoding_reads_only_two_hex_digits_never_a_sign() {
+    // `u8::from_str_radix` accepts a leading `+`, so `%+1` would decode to byte 0x01.
+    assert_eq!(percent_decode_impl("%+1", false), "%+1");
+    assert_eq!(percent_decode_impl("%-1", false), "%-1");
+    assert_eq!(percent_decode_impl("%4g", false), "%4g");
+    assert_eq!(percent_decode_impl("%41", false), "A");
+}
+
+#[test]
+fn form_and_query_strings_decode_any_text() {
+    for seed in 0..seeds() {
+        guarded(&format!("seed {seed}"), move || {
+            let mut rng = Rng::new(seed);
+            for _ in 0..100 {
+                let text = random_text(&mut rng);
+                let _ = parse_form(&text);
+                let _ = parse_query(&text);
+                let _ = percent_decode(&text);
+                let _ = auth::urlencode(&text);
+                // What the encoder emits, the decoder must read back exactly.
+                assert_eq!(percent_decode_impl(&auth::urlencode(&text), false), text, "seed {seed}: {text:?}");
+            }
+        });
+    }
+}
+
+#[test]
+fn huge_query_strings_decode_in_linear_time() {
+    guarded("huge query", || {
+        let pairs = (0..200_000).map(|i| format!("k{i}=%41%e6%97%a5")).collect::<Vec<_>>().join("&");
+        assert_eq!(parse_query(&pairs).len(), 200_000);
+        let _ = parse_form(&"%".repeat(5_000_000));
+        let _ = parse_form(&"%a🍕".repeat(1_000_000));
+    });
+}
+
+#[test]
+fn cookie_extraction_reads_any_event_shape() {
+    for seed in 0..seeds() {
+        guarded(&format!("seed {seed}"), move || {
+            let mut rng = Rng::new(seed ^ 0xC00C);
+            for _ in 0..50 {
+                let body = match rng.below(4) {
+                    0 => random_value(&mut rng, 0),
+                    1 => json!({"cookies": random_value(&mut rng, 2)}),
+                    2 => json!({"headers": {"cookie": random_value(&mut rng, 1)}}),
+                    _ => json!({"cookies": [random_text(&mut rng), random_text(&mut rng)], "headers": {"cookie": random_text(&mut rng)}}),
+                };
+                let _ = extract_cookies(&body);
+            }
+        });
+    }
+}
+
+#[test]
+fn base64_bodies_decode_any_text_without_panicking() {
+    for seed in 0..seeds() {
+        guarded(&format!("seed {seed}"), move || {
+            let mut rng = Rng::new(seed ^ 0xB64);
+            for _ in 0..100 {
+                let text = random_text(&mut rng);
+                let _ = base64_decode(&text);
+                let _ = String::from_utf8(base64_decode(&text)).unwrap_or_default();
+            }
+        });
+    }
+    assert_eq!(base64_decode("aGk="), b"hi");
+    assert!(base64_decode("").is_empty());
+}
+
+#[test]
+fn paths_and_origins_shape_any_text() {
+    for seed in 0..seeds() {
+        guarded(&format!("seed {seed}"), move || {
+            let mut rng = Rng::new(seed ^ 0x9A7);
+            for _ in 0..100 {
+                let path = format!("/{}", random_text(&mut rng));
+                let _ = json_shaped(&path);
+                let _ = split_format(&path);
+                let _ = origin_of(&path);
+                let _ = same_origin(&path, &random_text(&mut rng));
+                let _ = humanize(&path);
+                let _ = esc(&path);
+                for authenticated in [true, false] {
+                    if let Some(refusal) = auth_gate(&path, authenticated) {
+                        let status = refusal["statusCode"].as_u64().expect("a status");
+                        assert!(status == 401 || status == 302, "seed {seed}: {path:?} gated with {status}");
+                    }
+                }
+            }
+        });
+    }
+}
+
+#[test]
+fn an_unauthenticated_request_is_never_let_past_the_gate_by_a_path_trick() {
+    // Only the four sign-in paths are open; near-misses must be gated.
+    for path in ["/login/", "/LOGIN", "/login%2f", "//login", "/login/../admin", "/auth/google/", "/auth/google/callback/x", "/logout.json", "/./login", "/login?x", "/login "] {
+        assert!(auth_gate(path, false).is_some(), "{path:?} must be gated for an anonymous caller");
+    }
+    for path in ["/login", "/logout", "/auth/google", "/auth/google/callback"] {
+        assert!(auth_gate(path, false).is_none(), "{path:?} is the sign-in path");
+    }
+}