Depends on the roster parser issue.
The parser is the only door the site's content comes through and the templates
are the only place that content becomes markup. Those two are the whole attack
surface of a static site generator, and a hand-written fixture only covers the
malformed inputs somebody thought of.
Two targets. The parser is fuzzed against arbitrary bytes and must never panic
and never accept something the schema forbids. The rendering path is fuzzed with
arbitrary strings in every roster field, and the property is that no input
produces a page where that string became markup rather than text.
The seed corpus carries the cases that already matter: brackets and quotes in a
sentence, a very long field, an empty field, characters outside ASCII, and a
repository name with path separators in it. The corpus is committed, and the
gate replays it on every run so that a crash found once cannot come back
silently.
Fuzzing is in the standard toolchain here, so this needs no second apparatus and
no dependency.
Done when
Both targets exist, the seed corpus is committed and replayed as a leg of the
gate verb, a deliberately removed escaping call is found by the rendering
target, and a longer exploratory run is recorded with its duration and what it
found.
Depends on the roster parser issue.
The parser is the only door the site's content comes through and the templates
are the only place that content becomes markup. Those two are the whole attack
surface of a static site generator, and a hand-written fixture only covers the
malformed inputs somebody thought of.
Two targets. The parser is fuzzed against arbitrary bytes and must never panic
and never accept something the schema forbids. The rendering path is fuzzed with
arbitrary strings in every roster field, and the property is that no input
produces a page where that string became markup rather than text.
The seed corpus carries the cases that already matter: brackets and quotes in a
sentence, a very long field, an empty field, characters outside ASCII, and a
repository name with path separators in it. The corpus is committed, and the
gate replays it on every run so that a crash found once cannot come back
silently.
Fuzzing is in the standard toolchain here, so this needs no second apparatus and
no dependency.
Done when
Both targets exist, the seed corpus is committed and replayed as a leg of the
gate verb, a deliberately removed escaping call is found by the rendering
target, and a longer exploratory run is recorded with its duration and what it
found.