hecks 3.6.0 → 3.7.0

data/rust/host/src/boundary_fuzz/ir.rs

@@ -0,0 +1,78 @@
+//! Seeded fuzz of the IR sidecar readers: `ir.json` is generated, but it is read from disk at
+//! boot, so a stale, hand-edited or truncated file must come back as `None` or a refusal, never
+//! a panic.
+
+use super::*;
+use crate::fuzz_support::*;
+use serde_json::json;
+
+const KEYS: &[&str] = &[
+    "name", "aggregates", "lineage", "capable_aggregates", "storage_name", "persistence", "adapter", "authorization", "grant", "assignment_aggregate", "membership", "provider", "aggregate",
+    "identity", "register", "link", "resolve", "newsletter", "subscribe", "add_name", "confirm", "unsubscribe", "newsletter_issues", "issue_aggregate", "schedule", "send_issue", "record_delivery",
+    "payments", "initiate", "succeeded", "failed", "event_aggregate", "registrations", "registration_aggregate", "request", "payment_connection", "commands", "attributes",
+];
+
+/// An object over the keys the readers look up, with each value the right shape, the wrong
+/// shape, or missing: the mix that finds a reader trusting its input.
+fn random_ir(rng: &mut Rng, depth: usize) -> Value {
+    let mut fields = serde_json::Map::new();
+    for key in KEYS {
+        if rng.chance(3) {
+            continue;
+        }
+        let value = match rng.below(5) {
+            0 if depth < 2 => random_ir(rng, depth + 1),
+            1 => Value::String(random_text(rng)),
+            2 => Value::Array((0..rng.below(2)).map(|_| if depth < 2 { random_ir(rng, depth + 1) } else { Value::Null }).collect()),
+            3 => json!(*rng.pick(&["Postgres", "PostgresEra", "Heki", "Memory", ""])),
+            _ => random_value(rng, 2),
+        };
+        fields.insert(key.to_string(), value);
+    }
+    Value::Object(fields)
+}
+
+#[test]
+fn every_provider_reader_answers_any_ir_shape() {
+    for seed in 0..seeds() {
+        guarded(&format!("seed {seed}"), move || {
+            let mut rng = Rng::new(seed);
+            for _ in 0..40 {
+                let ir = if rng.chance(8) { random_value(&mut rng, 0) } else { random_ir(&mut rng, 0) };
+                let _ = lineage_capable_aggregates(&ir);
+                let _ = persistence_adapters(&ir);
+                let _ = mirrored_aggregates(&ir);
+                let _ = authorization_provider(&ir);
+                let _ = membership_provider(&ir);
+                let _ = identity_provider(&ir);
+                let _ = command_declares(&ir, &random_text(&mut rng), &random_text(&mut rng), &random_text(&mut rng));
+                let _ = newsletter_provider(&ir).map(|p| p.instance_prefix());
+                let _ = newsletter_issues_provider(&ir).map(|p| p.issue_prefix());
+                let _ = payments_provider(&ir).map(|p| p.instance_prefix());
+                if let Some(p) = registrations_provider(&ir) {
+                    let _ = (p.event_prefix(), p.registration_prefix(), p.request_target());
+                }
+                if let Some(p) = payment_connection_provider(&ir) {
+                    let _ = p.instance_prefix();
+                }
+                let _ = registrations_binding(&random_text(&mut rng));
+                let _ = payment_connection_binding(&random_text(&mut rng));
+                if let Err(message) = refuse_unsupported_persistence_adapters(&ir) {
+                    assert!(message.contains("rust/host only has a backend"), "seed {seed}: unhelpful refusal {message:?}");
+                }
+            }
+        });
+    }
+}
+
+#[test]
+fn an_unsupported_persistence_adapter_is_always_refused_at_boot() {
+    for adapter in ["Heki", "Memory", "Sqlite", "", "postgres", "Postgres "] {
+        let ir = json!({"name": "D", "persistence": {"aggregates": [{"name": "A", "adapter": adapter}]}});
+        assert!(refuse_unsupported_persistence_adapters(&ir).is_err(), "{adapter:?}");
+    }
+    for adapter in ["Postgres", "PostgresEra"] {
+        let ir = json!({"name": "D", "persistence": {"aggregates": [{"name": "A", "adapter": adapter}]}});
+        assert!(refuse_unsupported_persistence_adapters(&ir).is_ok(), "{adapter:?}");
+    }
+}

data/rust/host/src/boundary_fuzz/server.rs

@@ -0,0 +1,227 @@
+//! Seeded fuzz of the HTTP front door (`admit`, `value_to_response`): hostile bodies, methods, URIs
+//! and headers must be answered, never panic, and a refused request must leave no trace.
+//! Everything here is in-process: `admit` is the whole of what runs before dispatch, so none of
+//! it needs Postgres or wasm.
+
+use super::*;
+use crate::fuzz_support::*;
+use serde_json::json;
+
+fn limits(pairs: &[(&str, &str)]) -> RateLimits {
+    let map: std::collections::HashMap<String, String> = pairs.iter().map(|(k, v)| (k.to_string(), v.to_string())).collect();
+    RateLimits::new(crate::rate_limit::Config::from_lookup(|name| map.get(name).cloned()).0)
+}
+
+fn peer(text: &str) -> SocketAddr {
+    text.parse().unwrap()
+}
+
+const PEERS: &[&str] = &["127.0.0.1:5000", "[::1]:5000", "[::ffff:127.0.0.1]:5000", "10.0.0.5:5000", "203.0.113.7:5000", "[2001:db8::1]:5000"];
+
+fn random_method(rng: &mut Rng) -> Method {
+    let methods = [Method::GET, Method::POST, Method::PUT, Method::DELETE, Method::PATCH, Method::HEAD, Method::OPTIONS, Method::TRACE, Method::CONNECT];
+    if rng.chance(8) {
+        Method::from_bytes(b"BREW").unwrap()
+    } else {
+        rng.pick(&methods).clone()
+    }
+}
+
+/// A URI that parses: a hostile path built from the pieces, or a fixed route the limiter knows.
+fn random_uri(rng: &mut Rng) -> Uri {
+    const FIXED: &[&str] = &["/", "/newsletter/subscribers", "/registrations", "/api/me", "/login", "/%00", "/../..", "/a?b=%a", "/x?%", "/a//b", "/a;b", "*"];
+    if rng.chance(3) {
+        return rng.pick(FIXED).parse().unwrap();
+    }
+    for _ in 0..8 {
+        let path: String = (0..rng.below(4)).map(|_| format!("/{}", rng.pick(PIECES_ASCII))).collect();
+        let query = if rng.chance(2) { format!("?{}={}", rng.pick(PIECES_ASCII), rng.pick(PIECES_ASCII)) } else { String::new() };
+        if let Ok(uri) = format!("{path}{query}").parse::<Uri>() {
+            return uri;
+        }
+    }
+    "/".parse().unwrap()
+}
+
+const PIECES_ASCII: &[&str] = &["a", "b", "0", "%41", "%zz", "%", "%00", "..", ".", "-", "_", "id", "api", "me", "newsletter", "subscribers", "x y", "a+b", "=", "&", "a=b"];
+
+fn random_headers(rng: &mut Rng) -> HeaderMap {
+    const NAMES: &[&str] = &["x-forwarded-for", "cookie", "content-type", "authorization", "host", "x-real-ip", "x-hecks-proxy-auth", "x-anything", "content-length", "set-cookie"];
+    let mut headers = HeaderMap::new();
+    for _ in 0..rng.below(5) {
+        let name = HeaderName::from_static(rng.pick(NAMES));
+        let bytes: Vec<u8> = match rng.below(4) {
+            0 => random_text(rng).into_bytes(),
+            1 => (0..rng.below(24)).map(|_| rng.next() as u8).collect(),
+            2 => b"1.2.3.4, 5.6.7.8, ::1, not-an-ip, [::ffff:127.0.0.1]".to_vec(),
+            _ => "x".repeat(rng.below(9000)).into_bytes(),
+        };
+        // Header values are a restricted byte set; the ones the type refuses never reach `admit`.
+        if let Ok(value) = HeaderValue::from_bytes(&bytes) {
+            headers.append(name, value);
+        }
+    }
+    headers
+}
+
+fn status_of(refusal: &Response) -> u16 {
+    refusal.status().as_u16()
+}
+
+#[test]
+fn admit_answers_every_hostile_request_without_panicking() {
+    for seed in 0..seeds() {
+        guarded(&format!("seed {seed}"), move || {
+            let mut rng = Rng::new(seed);
+            let limits = limits(&[]);
+            for _ in 0..30 {
+                let from = peer(rng.pick(PEERS));
+                let method = random_method(&mut rng);
+                let uri = random_uri(&mut rng);
+                let headers = random_headers(&mut rng);
+                let body = Bytes::from(random_bytes(&mut rng));
+
+                let parsed = if body.is_empty() { Some(json!({})) } else { serde_json::from_slice::<Value>(&body).ok() };
+                let answer = admit(&limits, from, &method, &uri, &headers, &body);
+                match (parsed, answer) {
+                    (None, Err(refusal)) => assert_eq!(status_of(&refusal), 400, "seed {seed}: a body that is not JSON is a 400, got {}", status_of(&refusal)),
+                    (None, Ok(envelope)) => panic!("seed {seed}: admitted a body that is not JSON: {envelope}"),
+                    (Some(_), Err(refusal)) => assert_eq!(status_of(&refusal), 429, "seed {seed}: valid JSON is refused only by the limiter, got {}", status_of(&refusal)),
+                    (Some(parsed), Ok(envelope)) => {
+                        let internal = trusts_internal_dispatch(from) && is_internal_dispatch_shape(&parsed);
+                        if internal {
+                            assert_eq!(envelope, parsed, "seed {seed}: a trusted internal body passes through untouched");
+                        } else {
+                            assert_eq!(envelope["requestContext"]["http"]["method"], method.as_str(), "seed {seed}");
+                            assert_eq!(envelope["rawPath"], uri.path(), "seed {seed}");
+                            assert!(envelope["body"].is_string(), "seed {seed}: the synthesized body is text");
+                            assert_eq!(envelope["isBase64Encoded"], false, "seed {seed}");
+                        }
+                    }
+                }
+            }
+        });
+    }
+}
+
+#[test]
+fn a_public_peer_can_never_smuggle_in_the_internal_dispatch_protocol() {
+    // The internal shapes carry a caller's own `role` with no session check; only loopback may use them.
+    for seed in 0..seeds() {
+        guarded(&format!("seed {seed}"), move || {
+            let mut rng = Rng::new(seed ^ 0xBEEF);
+            let limits = limits(&[]);
+            for _ in 0..20 {
+                let mut internal = serde_json::Map::new();
+                for key in ["verb", "role", "actor_id", "args", "read", "query", "to", "with", "requestContext", "cookies"] {
+                    if rng.chance(2) {
+                        internal.insert(key.to_string(), random_value(&mut rng, 1));
+                    }
+                }
+                let body = Bytes::from(Value::Object(internal).to_string());
+                let from = peer(rng.pick(&PEERS[3..]));
+                let envelope = admit(&limits, from, &Method::POST, &"/x".parse().unwrap(), &random_headers(&mut rng), &body)
+                    .unwrap_or_else(|_| panic!("seed {seed}: valid JSON from a public peer is admitted"));
+                let keys: std::collections::BTreeSet<&str> = envelope.as_object().unwrap().keys().map(String::as_str).collect();
+                let expected: std::collections::BTreeSet<&str> = ["requestContext", "rawPath", "rawQueryString", "headers", "body", "isBase64Encoded"].into();
+                assert_eq!(keys, expected, "seed {seed}: a public peer's body must be wrapped as plain request data");
+            }
+        });
+    }
+}
+
+#[test]
+fn a_malformed_body_is_refused_before_it_costs_any_rate_limit_budget() {
+    let limits = limits(&[("HECKS_RATE_LIMIT_SUBSCRIBE", "1")]);
+    let from = peer("203.0.113.7:5000");
+    let uri: Uri = "/newsletter/subscribers".parse().unwrap();
+    for body in ["{", "not json", "{\"a\":", "\u{0}", "[1,", "{\"a\":1}x", "\u{feff}{}"] {
+        for _ in 0..10 {
+            let refusal = admit(&limits, from, &Method::POST, &uri, &HeaderMap::new(), &Bytes::from(body.to_string())).err().expect("refused");
+            assert_eq!(status_of(&refusal), 400, "{body:?}");
+        }
+    }
+    let spent = |limits: &RateLimits| admit(limits, from, &Method::POST, &uri, &HeaderMap::new(), &Bytes::from("{}")).is_ok();
+    assert!(spent(&limits), "the one allowed request still goes through after the refusals");
+    assert!(!spent(&limits), "and the next is limited: only the valid request spent budget");
+}
+
+#[test]
+fn invalid_utf8_and_oversized_bodies_are_answered() {
+    let limits = limits(&[]);
+    let from = peer("203.0.113.7:5000");
+    let uri: Uri = "/x".parse().unwrap();
+    let invalid = Bytes::from(vec![0xff, 0xfe, 0xfd]);
+    assert_eq!(status_of(&admit(&limits, from, &Method::POST, &uri, &HeaderMap::new(), &invalid).err().unwrap()), 400);
+
+    // A 16 MiB body of valid JSON is admitted as text (a size cap belongs to the listener, not here)
+    // and a 16 MiB run of openers is refused by the parser's depth limit rather than overflowing.
+    guarded("large bodies", move || {
+        let big_string = Bytes::from(format!("\"{}\"", "a".repeat(16 * 1024 * 1024)));
+        assert!(admit(&limits, from, &Method::POST, &uri, &HeaderMap::new(), &big_string).is_ok());
+        let openers = Bytes::from("[".repeat(16 * 1024 * 1024));
+        let refusal = admit(&limits, from, &Method::POST, &uri, &HeaderMap::new(), &openers).err().expect("refused");
+        assert_eq!(status_of(&refusal), 400);
+        let nested = Bytes::from(format!("{}1{}", "[".repeat(100_000), "]".repeat(100_000)));
+        assert_eq!(status_of(&admit(&limits, from, &Method::POST, &uri, &HeaderMap::new(), &nested).err().expect("refused")), 400);
+    });
+}
+
+#[test]
+fn value_to_response_answers_any_shape_of_handler_output() {
+    for seed in 0..seeds() {
+        guarded(&format!("seed {seed}"), move || {
+            let mut rng = Rng::new(seed ^ 0xFACE);
+            for _ in 0..30 {
+                let mut value = serde_json::Map::new();
+                for key in ["statusCode", "headers", "cookies", "body", "isBase64Encoded", "extra"] {
+                    if rng.chance(4) {
+                        continue;
+                    }
+                    let field = match key {
+                        "headers" if rng.chance(2) => {
+                            let mut map = serde_json::Map::new();
+                            for _ in 0..rng.below(4) {
+                                map.insert(random_text(&mut rng), random_value(&mut rng, 2));
+                            }
+                            Value::Object(map)
+                        }
+                        "cookies" if rng.chance(2) => Value::Array((0..rng.below(4)).map(|_| random_value(&mut rng, 2)).collect()),
+                        "statusCode" if rng.chance(2) => json!(*rng.pick(&[0u64, 99, 100, 199, 200, 204, 299, 301, 404, 599, 600, 999, 65_536, 65_736, u64::MAX])),
+                        _ => random_value(&mut rng, 1),
+                    };
+                    value.insert(key.to_string(), field);
+                }
+                let response = value_to_response(Value::Object(value));
+                // Whatever came in, what goes out is a real status.
+                assert!((100..1000).contains(&status_of(&response)), "seed {seed}");
+            }
+            let plain = value_to_response(random_value(&mut rng, 0));
+            assert!((100..1000).contains(&status_of(&plain)), "seed {seed}");
+        });
+    }
+}
+
+#[test]
+fn an_out_of_range_status_code_is_a_500_not_a_wrapped_status() {
+    // `65736 as u16` is 200: a handler bug must not turn into a success.
+    for code in [0u64, 99, 1000, 65_536, 65_736, 131_272, u64::MAX] {
+        let response = value_to_response(json!({ "statusCode": code, "body": "x" }));
+        assert_eq!(status_of(&response), 500, "statusCode {code}");
+    }
+    assert_eq!(status_of(&value_to_response(json!({ "statusCode": 204 }))), 204);
+}
+
+#[test]
+fn control_characters_in_response_headers_and_cookies_are_dropped_not_emitted() {
+    let response = value_to_response(json!({
+        "statusCode": 200,
+        "headers": { "x-ok": "fine", "x-split": "a\r\nSet-Cookie: stolen=1", "bad name": "v" },
+        "cookies": ["session=abc; Path=/", "evil=1\r\nX-Injected: yes", "nul=\u{0}"],
+        "body": ""
+    }));
+    assert!(response.headers().get("x-split").is_none());
+    assert!(response.headers().get("x-injected").is_none());
+    let cookies: Vec<&str> = response.headers().get_all("set-cookie").iter().filter_map(|v| v.to_str().ok()).collect();
+    assert_eq!(cookies, vec!["session=abc; Path=/"]);
+}

data/rust/host/src/boundary_fuzz/web.rs

@@ -0,0 +1,125 @@
+//! Seeded fuzz of the web layer's request decoding: percent-decoding, form and query strings,
+//! cookies, base64 bodies, path shaping and the auth gate. Every one takes text an anonymous
+//! caller controls, and none may panic on it.
+
+use super::*;
+use crate::fuzz_support::*;
+
+#[test]
+fn percent_decoding_never_slices_through_a_multi_byte_character() {
+    // `%a` followed by a 4-byte character puts the two-digit hex window mid-character.
+    for text in ["%a🍕", "%🍕", "%é", "a%é", "%a日", "%%a🍕", "%1é1", "🍕%", "🍕%a", "%a", "%", "%%", "%4", "%41", "x%e6%97%a5y", "%e6%97", "%ff%fe"] {
+        for plus_as_space in [true, false] {
+            let decoded = percent_decode_impl(text, plus_as_space);
+            assert!(decoded.len() < text.len() * 4 + 4, "{text:?}");
+        }
+    }
+    assert_eq!(percent_decode("%41%2f%2F+x"), "A// x");
+    assert_eq!(percent_decode_impl("a+b", false), "a+b");
+}
+
+#[test]
+fn percent_decoding_reads_only_two_hex_digits_never_a_sign() {
+    // `u8::from_str_radix` accepts a leading `+`, so `%+1` would decode to byte 0x01.
+    assert_eq!(percent_decode_impl("%+1", false), "%+1");
+    assert_eq!(percent_decode_impl("%-1", false), "%-1");
+    assert_eq!(percent_decode_impl("%4g", false), "%4g");
+    assert_eq!(percent_decode_impl("%41", false), "A");
+}
+
+#[test]
+fn form_and_query_strings_decode_any_text() {
+    for seed in 0..seeds() {
+        guarded(&format!("seed {seed}"), move || {
+            let mut rng = Rng::new(seed);
+            for _ in 0..100 {
+                let text = random_text(&mut rng);
+                let _ = parse_form(&text);
+                let _ = parse_query(&text);
+                let _ = percent_decode(&text);
+                let _ = auth::urlencode(&text);
+                // What the encoder emits, the decoder must read back exactly.
+                assert_eq!(percent_decode_impl(&auth::urlencode(&text), false), text, "seed {seed}: {text:?}");
+            }
+        });
+    }
+}
+
+#[test]
+fn huge_query_strings_decode_in_linear_time() {
+    guarded("huge query", || {
+        let pairs = (0..200_000).map(|i| format!("k{i}=%41%e6%97%a5")).collect::<Vec<_>>().join("&");
+        assert_eq!(parse_query(&pairs).len(), 200_000);
+        let _ = parse_form(&"%".repeat(5_000_000));
+        let _ = parse_form(&"%a🍕".repeat(1_000_000));
+    });
+}
+
+#[test]
+fn cookie_extraction_reads_any_event_shape() {
+    for seed in 0..seeds() {
+        guarded(&format!("seed {seed}"), move || {
+            let mut rng = Rng::new(seed ^ 0xC00C);
+            for _ in 0..50 {
+                let body = match rng.below(4) {
+                    0 => random_value(&mut rng, 0),
+                    1 => json!({"cookies": random_value(&mut rng, 2)}),
+                    2 => json!({"headers": {"cookie": random_value(&mut rng, 1)}}),
+                    _ => json!({"cookies": [random_text(&mut rng), random_text(&mut rng)], "headers": {"cookie": random_text(&mut rng)}}),
+                };
+                let _ = extract_cookies(&body);
+            }
+        });
+    }
+}
+
+#[test]
+fn base64_bodies_decode_any_text_without_panicking() {
+    for seed in 0..seeds() {
+        guarded(&format!("seed {seed}"), move || {
+            let mut rng = Rng::new(seed ^ 0xB64);
+            for _ in 0..100 {
+                let text = random_text(&mut rng);
+                let _ = base64_decode(&text);
+                let _ = String::from_utf8(base64_decode(&text)).unwrap_or_default();
+            }
+        });
+    }
+    assert_eq!(base64_decode("aGk="), b"hi");
+    assert!(base64_decode("").is_empty());
+}
+
+#[test]
+fn paths_and_origins_shape_any_text() {
+    for seed in 0..seeds() {
+        guarded(&format!("seed {seed}"), move || {
+            let mut rng = Rng::new(seed ^ 0x9A7);
+            for _ in 0..100 {
+                let path = format!("/{}", random_text(&mut rng));
+                let _ = json_shaped(&path);
+                let _ = split_format(&path);
+                let _ = origin_of(&path);
+                let _ = same_origin(&path, &random_text(&mut rng));
+                let _ = humanize(&path);
+                let _ = esc(&path);
+                for authenticated in [true, false] {
+                    if let Some(refusal) = auth_gate(&path, authenticated) {
+                        let status = refusal["statusCode"].as_u64().expect("a status");
+                        assert!(status == 401 || status == 302, "seed {seed}: {path:?} gated with {status}");
+                    }
+                }
+            }
+        });
+    }
+}
+
+#[test]
+fn an_unauthenticated_request_is_never_let_past_the_gate_by_a_path_trick() {
+    // Only the four sign-in paths are open; near-misses must be gated.
+    for path in ["/login/", "/LOGIN", "/login%2f", "//login", "/login/../admin", "/auth/google/", "/auth/google/callback/x", "/logout.json", "/./login", "/login?x", "/login "] {
+        assert!(auth_gate(path, false).is_some(), "{path:?} must be gated for an anonymous caller");
+    }
+    for path in ["/login", "/logout", "/auth/google", "/auth/google/callback"] {
+        assert!(auth_gate(path, false).is_none(), "{path:?} is the sign-in path");
+    }
+}

data/rust/host/src/fuzz_support.rs

@@ -0,0 +1,165 @@
+//! Shared pieces of the boundary fuzz tests that sit beside `api`, `server`, `web`, `auth`,
+//! `expr_json` and `ir`: a seeded generator, a guard that fails on a panic or a hang, and
+//! generators for hostile text and JSON. Std-only, so a failing case is named by its seed alone.
+//!
+//! Run more seeds with `HOST_FUZZ_SEEDS=2000 cargo test fuzz`.
+
+use serde_json::{json, Map, Value};
+use std::sync::mpsc;
+use std::time::Duration;
+
+/// xorshift64*: no dependency, and the seed is the whole reproduction.
+pub(crate) struct Rng(u64);
+
+impl Rng {
+    pub(crate) fn new(seed: u64) -> Self {
+        Rng(seed.wrapping_mul(0x9E37_79B9_7F4A_7C15) | 1)
+    }
+
+    pub(crate) fn next(&mut self) -> u64 {
+        self.0 ^= self.0 >> 12;
+        self.0 ^= self.0 << 25;
+        self.0 ^= self.0 >> 27;
+        self.0.wrapping_mul(0x2545_F491_4F6C_DD1D)
+    }
+
+    pub(crate) fn below(&mut self, n: usize) -> usize {
+        (self.next() % n.max(1) as u64) as usize
+    }
+
+    pub(crate) fn chance(&mut self, one_in: usize) -> bool {
+        self.below(one_in) == 0
+    }
+
+    pub(crate) fn pick<'a, T>(&mut self, items: &'a [T]) -> &'a T {
+        &items[self.below(items.len())]
+    }
+}
+
+/// How many seeds each fuzz test runs.
+pub(crate) fn seeds() -> u64 {
+    std::env::var("HOST_FUZZ_SEEDS").ok().and_then(|v| v.parse().ok()).unwrap_or(200)
+}
+
+/// The most a single guarded case may take before it counts as a hang.
+pub(crate) const LIMIT: Duration = Duration::from_secs(20);
+
+/// Runs `f` on a thread with a 2 MiB stack (a tokio worker's default) and returns its answer.
+/// A panic or a missed `LIMIT` fails the test and names `label`; a stack overflow aborts the
+/// whole binary, which fails it too.
+pub(crate) fn guarded<T: Send + 'static>(label: &str, f: impl FnOnce() -> T + Send + 'static) -> T {
+    let (tx, rx) = mpsc::channel();
+    let handle = std::thread::Builder::new()
+        .stack_size(2 * 1024 * 1024)
+        .spawn(move || {
+            let _ = tx.send(f());
+        })
+        .expect("spawn a guarded thread");
+    match rx.recv_timeout(LIMIT) {
+        Ok(value) => {
+            handle.join().expect("guarded thread joined");
+            value
+        }
+        Err(mpsc::RecvTimeoutError::Timeout) => panic!("{label}: no answer within {LIMIT:?} (hang)"),
+        Err(mpsc::RecvTimeoutError::Disconnected) => {
+            let panic = handle.join().expect_err("a guarded thread that sent nothing must have panicked");
+            let message = panic.downcast_ref::<String>().cloned().or_else(|| panic.downcast_ref::<&str>().map(|s| s.to_string()));
+            panic!("{label}: panicked: {}", message.unwrap_or_default())
+        }
+    }
+}
+
+/// Pieces that break naive text handling: multi-byte characters next to ASCII delimiters (the
+/// shape that slices through a char boundary), control characters, NUL, bidi marks, astral
+/// planes, combining marks, percent signs, and every JSON/URL/cookie delimiter.
+const PIECES: &[&str] = &[
+    "a", "Z", "0", "9", " ", "\"", "'", "\\", "/", "%", "%4", "%41", "%zz", "%+1", "+", "=", "&", ";", "?", "#", ".", "..", "-", "_", ":", ",", "{", "}", "[", "]",
+    "\n", "\t", "\r", "\u{0}", "\u{1f}", "\u{7f}", "é", "ü", "日本", "🍕", "\u{10FFFF}", "\u{200B}", "\u{FEFF}", "\u{202E}", "\u{FFFD}", "e\u{301}", "__", "::",
+    "<script>", "../", "%0d%0a", "id", "name", "value", "sort", "direction", "desc",
+];
+
+pub(crate) fn random_text(rng: &mut Rng) -> String {
+    (0..rng.below(10)).map(|_| *rng.pick(PIECES)).collect()
+}
+
+/// Edge-case numbers a JSON consumer is likely to mishandle, as JSON values.
+pub(crate) fn edge_number(rng: &mut Rng) -> Value {
+    let edges: Vec<Value> = vec![
+        json!(0),
+        json!(-1),
+        json!(1),
+        json!(i64::MAX),
+        json!(i64::MIN),
+        json!(u64::MAX),
+        json!(0.0),
+        json!(-0.0),
+        json!(0.1),
+        json!(1e308),
+        json!(-1e308),
+        json!(5e-324),
+        json!(1.7976931348623157e308),
+        json!(9007199254740993_i64),
+    ];
+    rng.pick(&edges).clone()
+}
+
+/// A JSON value of any shape, to a bounded depth, favoring the wrong type for whatever reads it.
+pub(crate) fn random_value(rng: &mut Rng, depth: usize) -> Value {
+    let leaf_only = depth >= 3;
+    match rng.below(if leaf_only { 6 } else { 8 }) {
+        0 => Value::Null,
+        1 => Value::Bool(rng.chance(2)),
+        2 => edge_number(rng),
+        3 | 4 => Value::String(random_text(rng)),
+        5 => json!(rng.next() as i64 >> rng.below(63)),
+        6 => Value::Array((0..rng.below(4)).map(|_| random_value(rng, depth + 1)).collect()),
+        _ => {
+            let mut map = Map::new();
+            for _ in 0..rng.below(4) {
+                map.insert(random_text(rng), random_value(rng, depth + 1));
+            }
+            Value::Object(map)
+        }
+    }
+}
+
+/// `text` with a few random edits, on char boundaries.
+pub(crate) fn mutate_text(rng: &mut Rng, text: &str) -> String {
+    let mut chars: Vec<char> = text.chars().collect();
+    const JUNK: &[char] = &['{', '}', '[', ']', '"', '\\', ',', ':', '-', '+', '.', 'e', '0', '9', 'n', 't', ' ', '\u{0}', '\n', '%', 'é', '🍕'];
+    for _ in 0..1 + rng.below(3) {
+        if chars.is_empty() {
+            chars.push(*rng.pick(JUNK));
+            continue;
+        }
+        let at = rng.below(chars.len());
+        match rng.below(4) {
+            0 => {
+                chars.remove(at);
+            }
+            1 => chars.insert(at, *rng.pick(JUNK)),
+            2 => chars[at] = *rng.pick(JUNK),
+            _ => chars.truncate(at),
+        }
+    }
+    chars.into_iter().collect()
+}
+
+/// Raw bytes, valid UTF-8 or not: random, mutated JSON, truncated mid-character, or hostile.
+pub(crate) fn random_bytes(rng: &mut Rng) -> Vec<u8> {
+    match rng.below(6) {
+        0 => (0..rng.below(64)).map(|_| rng.next() as u8).collect(),
+        1 => {
+            let valid = random_value(rng, 0).to_string();
+            mutate_text(rng, &valid).into_bytes()
+        }
+        2 => {
+            let mut bytes = random_value(rng, 0).to_string().into_bytes();
+            bytes.extend_from_slice(&[0xff, 0xfe, 0xc0, 0x80, 0xf0, 0x9f]);
+            bytes
+        }
+        3 => "{\"a\":\"🍕\"}".as_bytes()[..rng.below(10)].to_vec(),
+        4 => random_text(rng).into_bytes(),
+        _ => random_value(rng, 0).to_string().into_bytes(),
+    }
+}

data/rust/host/src/ir.rs

@@ -731,3 +731,7 @@ mod tests {
         assert!(refuse_unsupported_persistence_adapters(&ir).is_ok());
     }
 }
+
+#[cfg(test)]
+#[path = "boundary_fuzz/ir.rs"]
+mod boundary_fuzz;

data/rust/host/src/main.rs

@@ -8,6 +8,11 @@ mod checkout;
 mod dispatch;
 mod expr_json;
 mod field_hints;
+#[cfg(test)]
+mod fuzz_support;
+#[cfg(test)]
+#[path = "boundary_fuzz/expr_json.rs"]
+mod expr_json_fuzz;
 mod ir;
 mod journal;
 mod lambda_client;
@@ -69,10 +74,10 @@ async fn main() -> Result<(), Error> {
                 .fetch_secret_string(&secret_arn)
                 .await
                 .map_err(|e| format!("fetching DB_SECRET_ARN from Secrets Manager: {e:#}"))?;
-            let password = secrets::extract_field(&secret_json, "password")?;
-            // Literal, unescaped, no percent-encoding -- parse_database_url
-            // below never percent-decodes the password segment either way.
-            format!("postgres://postgres:{password}@{db_host}:5432/{db_name}")
+            // The user and port come from the secret too (a client sharing an instance logs in as
+            // its own role); the password goes in literal, since parse_database_url below never
+            // percent-decodes it.
+            secrets::database_url(&secret_json, &db_host, &db_name)?
         }
         Err(_) => std::env::var("DATABASE_URL")
             .map_err(|_| "either DB_SECRET_ARN (+ DB_HOST/DB_NAME) or DATABASE_URL is required")?,