Add fuzzer for parse of Permissions-Policy header

Bug: 1095641
Change-Id: I7558008667c0c3a83dbb19c9211bad78db1dd3fc
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2272611
Reviewed-by: Ian Clelland <iclelland@chromium.org>
Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Commit-Queue: Charlie Hu <chenleihu@google.com>
Cr-Commit-Position: refs/heads/master@{#785803}

third_party/blink/renderer/core/BUILD.gn

@@ -1661,3 +1661,14 @@ fuzzer_test("document_policy_fuzzer") {
   seed_corpus =
       "//third_party/blink/renderer/core/feature_policy/document_policy_corpus"
 }
+
+fuzzer_test("permissions_policy_fuzzer") {
+  sources = [ "feature_policy/permissions_policy_fuzzer.cc" ]
+  deps = [
+    "//third_party/blink/renderer/platform:blink_fuzzer_test_support",
+    "//third_party/icu",
+  ]
+  dict =
+      "//third_party/blink/renderer/core/feature_policy/permissions_policy.dict"
+  seed_corpus = "//third_party/blink/renderer/core/feature_policy/permissions_policy_corpus"
+}

third_party/blink/renderer/core/feature_policy/permissions_policy.dict

@@ -0,0 +1,53 @@
+# Copyright 2020 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+"accelerometer"
+"ambient-light-sensor"
+"autoplay"
+"camera"
+"document-domain"
+"document-write"
+"encrypted-media"
+"forms"
+"fullscreen"
+"geolocation"
+"gyroscope"
+"hid"
+"idle-detection"
+"layout-animations"
+"lazyload"
+"magnetometer"
+"microphone"
+"midi"
+"modals"
+"orientation-lock"
+"payment"
+"picture-in-picture"
+"pointer-lock"
+"popups"
+"presentation"
+"screen-wake-lock"
+"scripts"
+"serial"
+"speaker"
+"sync-script"
+"sync-xkr"
+"top-navigation"
+"unsized-media"
+"usb"
+"vertical-scroll"
+"vr"
+"\"https://example.com/\""
+"*"
+"self"
+"("
+")"
+"="
+"0"
+"1"
+".0"
+"?0"
+"?1"
+"\""
+" "

third_party/blink/renderer/core/feature_policy/permissions_policy_corpus/1

@@ -0,0 +1 @@
+badfeaturename

third_party/blink/renderer/core/feature_policy/permissions_policy_corpus/10

@@ -0,0 +1 @@
+camera=(self "https://example.com/"), camera=(self "https://example.net/")

third_party/blink/renderer/core/feature_policy/permissions_policy_corpus/11

@@ -0,0 +1 @@
+vibrate=(self "https://example.org/")

third_party/blink/renderer/core/feature_policy/permissions_policy_corpus/12

@@ -0,0 +1 @@
+document-write=(self "https://example.org/")

third_party/blink/renderer/core/feature_policy/permissions_policy_corpus/13

@@ -0,0 +1 @@
+vibrate=(self https://example.net/), docwrite=self

third_party/blink/renderer/core/feature_policy/permissions_policy_corpus/14

@@ -0,0 +1 @@
+vibrate=*, docwrite=*

third_party/blink/renderer/core/feature_policy/permissions_policy_corpus/15

@@ -0,0 +1 @@
+vibrate, fullscreen, payment

third_party/blink/renderer/core/feature_policy/permissions_policy_corpus/16

@@ -0,0 +1 @@
+vibrate=src

third_party/blink/renderer/core/feature_policy/permissions_policy_corpus/2

@@ -0,0 +1 @@
+badfeaturename=self

third_party/blink/renderer/core/feature_policy/permissions_policy_corpus/3

@@ -0,0 +1 @@
+vibrate="data://badorigin"

third_party/blink/renderer/core/feature_policy/permissions_policy_corpus/4

@@ -0,0 +1 @@
+1.0

third_party/blink/renderer/core/feature_policy/permissions_policy_corpus/5

@@ -0,0 +1 @@
+vibrate=(self)

third_party/blink/renderer/core/feature_policy/permissions_policy_corpus/6

@@ -0,0 +1 @@
+vibrate=("https://example.com/")

third_party/blink/renderer/core/feature_policy/permissions_policy_corpus/7

@@ -0,0 +1 @@
+docwrite=()

third_party/blink/renderer/core/feature_policy/permissions_policy_corpus/8

@@ -0,0 +1 @@
+docwrite=self

third_party/blink/renderer/core/feature_policy/permissions_policy_corpus/9

@@ -0,0 +1 @@
+vibrate=*

third_party/blink/renderer/core/feature_policy/permissions_policy_fuzzer.cc

@@ -0,0 +1,26 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "third_party/blink/renderer/core/feature_policy/feature_policy_parser.h"
+
+#include <stddef.h>
+#include <stdint.h>
+#include <memory>
+
+#include "third_party/blink/renderer/platform/heap/handle.h"
+#include "third_party/blink/renderer/platform/testing/blink_fuzzer_test_support.h"
+#include "third_party/blink/renderer/platform/weborigin/security_origin.h"
+#include "third_party/blink/renderer/platform/wtf/text/wtf_string.h"
+#include "third_party/blink/renderer/platform/wtf/vector.h"
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  static blink::BlinkFuzzerTestSupport test_support =
+      blink::BlinkFuzzerTestSupport();
+  blink::PolicyParserMessageBuffer logger;
+  scoped_refptr<const blink::SecurityOrigin> origin =
+      blink::SecurityOrigin::CreateFromString("https://example.com/");
+  blink::FeaturePolicyParser::ParseHeader(
+      g_empty_string, WTF::String(data, size), origin.get(), logger);
+  return 0;
+}