|
## Fuzz testing module -- Nimcheck against random, binary, and malicious inputs.
|
|
## Auto-generated. Tests framework robustness, never-crash guarantee.
|
|
## Includes false-positive prevention tests.
|
|
|
|
import std/[unittest, strutils, strformat, math, sequtils]
|
|
import ../src/nimcheck
|
|
|
|
const allLangs* = [
|
|
lfNim, lfBash, lfPython, lfJavaScript, lfTypeScript,
|
|
lfPHP, lfHTML, lfXML, lfJinja, lfJSON, lfYAML, lfTOML,
|
|
lfC, lfCpp, lfJava, lfCSharp, lfKotlin, lfLua, lfSwift,
|
|
lfGo, lfRust, lfRuby, lfCSS, lfSQL, lfMarkdown,
|
|
lfDockerfile, lfMakefile
|
|
]
|
|
|
|
const threeLangs* = [lfNim, lfPython, lfJSON]
|
|
|
|
suite "Fuzz and Robustness Tests":
|
|
|
|
test "null bytes in every language":
|
|
let src = "\x00\x01\x02\x03hello\x00world"
|
|
for lang in allLangs:
|
|
let result = validateSource(src, flavor = lang)
|
|
check result.errors.len >= 0
|
|
|
|
test "very long strings (10k chars)":
|
|
let src = "x = \"" & repeat('A', 1000) & "\""
|
|
for lang in [lfNim, lfPython, lfJavaScript]:
|
|
let result = validateSource(src, flavor = lang)
|
|
check result.errors.len >= 0
|
|
|
|
test "deep bracket nesting (100 levels)":
|
|
let src = "let x = " & repeat('(', 100) & "42" & repeat(')', 100)
|
|
let result = validateSource(src, flavor = lfJavaScript)
|
|
check result.errors.len >= 0
|
|
|
|
test "unclosed strings at end of file (every lang)":
|
|
let src = "x = \"unclosed"
|
|
for lang in allLangs:
|
|
let result = validateSource(src, flavor = lang)
|
|
check result.errors.len >= 0
|
|
|
|
test "empty source never crashes":
|
|
for lang in allLangs:
|
|
let result = validateSource("", flavor = lang)
|
|
check result.errors.len >= 0
|
|
|
|
test "whitespace-only source":
|
|
let src = " \t \n \t \n "
|
|
for lang in allLangs:
|
|
let result = validateSource(src, flavor = lang)
|
|
check result.errors.len >= 0
|
|
|
|
test "raw binary data never crashes":
|
|
let src = "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0A\x0B\x0C\x0D\x0E\x0F\x10ABCDEFGH\x1F\x20\x7F\x80\xFF"
|
|
for lang in threeLangs:
|
|
let result = validateSource(src, flavor = lang)
|
|
check result.errors.len >= 0
|
|
|
|
test "unicode BOM and weird encodings":
|
|
let src = "\xEF\xBB\xBF\xF0\x9F\x98\x80\xE2\x82\xAC\xC0\xAF"
|
|
for lang in allLangs:
|
|
let result = validateSource(src, flavor = lang)
|
|
check result.errors.len >= 0
|
|
|
|
test "high unicode (surrogate pairs)":
|
|
let src = "let x = '\U0001F600\U0001F601\U0001F602'"
|
|
let result = validateSource(src, flavor = lfJavaScript)
|
|
check result.errors.len >= 0
|
|
|
|
test "mixed encoding attack":
|
|
let src = "proc hello() =\x80\x81\x82\x83\n discard\n"
|
|
let result = validateSource(src, flavor = lfNim)
|
|
check result.errors.len >= 0
|
|
|
|
test "alternating open/close brackets with garbage":
|
|
let src = "({[({[({[({[)}])}])}])}"
|
|
let result = validateSource(src, flavor = lfJavaScript)
|
|
check result.errors.len >= 0
|
|
|
|
test "inspectSource never crashes on any input":
|
|
for lang in allLangs:
|
|
let json = inspectSource("garbage!@#$%^&*()_+", flavor = lang)
|
|
check json.kind == JObject
|
|
|
|
test "version and supportedFlavors":
|
|
check version().len > 0
|
|
check supportedFlavors().len >= 28
|
|
|
|
test "detectFlavor on all good code samples":
|
|
discard detectFlavor("proc x() = discard")
|
|
discard detectFlavor("echo hello")
|
|
discard detectFlavor("def x(): pass")
|
|
discard detectFlavor("function x() {}")
|
|
discard detectFlavor("<?php echo 'hi';")
|
|
discard detectFlavor("<html></html>")
|
|
discard detectFlavor("{% block x %}{% endblock %}")
|
|
discard detectFlavor("{\"a\": 1}")
|
|
discard detectFlavor("a: 1")
|
|
discard detectFlavor("x = 1")
|
|
discard detectFlavor("#include <stdio.h>")
|
|
discard detectFlavor("package main")
|
|
discard detectFlavor("fn main() {}")
|
|
discard detectFlavor("fun main() {}")
|
|
discard detectFlavor("import Foundation")
|
|
discard detectFlavor("<?xml version=\"1.0\"?>")
|
|
discard detectFlavor("interface Foo {}")
|
|
|
|
test "source with only newlines":
|
|
let src = "\n\n\n\n\n\n\n\n\n\n"
|
|
for lang in allLangs:
|
|
let result = validateSource(src, flavor = lang)
|
|
check result.errors.len >= 0
|
|
|
|
test "very deep comment nesting":
|
|
let src = "proc test() =\n " & repeat("#[ ", 20) & " content " & repeat(" ]# ", 20) & "\n discard\n"
|
|
let result = validateSource(src, flavor = lfNim)
|
|
check result.errors.len >= 0
|
|
|
|
test "concurrent validation calls":
|
|
for i in 0..10:
|
|
let src = "proc test" & $i & "() = discard\n"
|
|
let result = validateSource(src, flavor = lfNim)
|
|
check result.errors.len >= 0
|
|
|
|
test "detectFlavor unknown garbage":
|
|
let flavor = detectFlavor("!@#$%^&*()_+{}[]|\\:;\"'<>,.?/~`")
|
|
check $flavor == "unknown" or $flavor == "bash"
|
|
|
|
test "validateFile with nonexistent path":
|
|
let result = validateFile("/nonexistent/path/file.nim")
|
|
check result.errors.len > 0
|
|
check not result.valid
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# False Positive Prevention Tests
|
|
# ---------------------------------------------------------------------------
|
|
|
|
test "false positive: short random text returns unknown":
|
|
let flavor = detectFlavor("abc def ghi")
|
|
check $flavor == "unknown"
|
|
|
|
test "false positive: single token returns unknown":
|
|
let flavor = detectFlavor("hello")
|
|
check $flavor == "unknown"
|
|
|
|
test "false positive: numbers-only returns unknown":
|
|
let flavor = detectFlavor("42 123 456 7890")
|
|
check $flavor == "unknown"
|
|
|
|
test "false positive: punctuation-only returns unknown":
|
|
let flavor = detectFlavor("... --- !!! ??? >>> <<<")
|
|
check $flavor == "unknown"
|
|
|
|
test "false positive: binary-like data returns unknown":
|
|
let flavor = detectFlavor("\x00\x01\x02\xFF\xFE\xFD\x00\x01\x02\x03")
|
|
check $flavor == "unknown"
|