plan 8: fuzz decoders; fold ẞ and invalid UTF-8 correctly, refuse non-UTF-8 paths in krino new

1 files changed, 56 insertions, 0 deletions

diff --git a/internal/extract/fuzz_test.go b/internal/extract/fuzz_test.go
new file mode 100644
index 0000000..5f707d2
--- /dev/null
+++ b/internal/extract/fuzz_test.go
@@ -0,0 +1,56 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package extract
+
+import (
+	"archive/zip"
+	"bytes"
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// FuzzStripMarkup: decoding and stripping any bytes as HTML never panics.
+func FuzzStripMarkup(f *testing.F) {
+	for _, s := range []string{"<p>a &amp; b</p>", "<script>x</script>y", "<!-- c", "<", "&#x110000;", "<a href='>'>t</a>", "\xff\xfe<\x00p\x00>\x00", "\xef\xbb\xbf\xff"} {
+		f.Add([]byte(s))
+	}
+	f.Fuzz(func(t *testing.T, data []byte) {
+		stripMarkup(decode(data))
+	})
+}
+
+// FuzzZipText: reading any bytes as a .docx never panics and never returns
+// more text than the budget allows - each entry adds at most one separating
+// newline beyond it, and an entry takes more than one byte of the archive.
+func FuzzZipText(f *testing.F) {
+	var buf bytes.Buffer
+	zw := zip.NewWriter(&buf)
+	w, err := zw.Create("word/document.xml")
+	if err != nil {
+		f.Fatal(err)
+	}
+	if _, err := w.Write([]byte(`<w:document><w:body><w:p><w:r><w:t>acme ltd</w:t></w:r></w:p></w:body></w:document>`)); err != nil {
+		f.Fatal(err)
+	}
+	if err := zw.Close(); err != nil {
+		f.Fatal(err)
+	}
+	f.Add(buf.Bytes())
+	f.Add([]byte("PK\x03\x04"))
+	f.Add([]byte{})
+	old := zipBudget
+	zipBudget = 4 << 10
+	f.Cleanup(func() { zipBudget = old })
+	f.Fuzz(func(t *testing.T, data []byte) {
+		p := filepath.Join(t.TempDir(), "f.docx")
+		if err := os.WriteFile(p, data, 0o600); err != nil {
+			t.Fatal(err)
+		}
+		text, err := zipText(context.Background(), p, "docx", 0)
+		if err == nil && int64(len(text)) > zipBudget+int64(len(data)) {
+			t.Fatalf("%d bytes of text from a %d-byte archive, budget %d", len(text), len(data), zipBudget)
+		}
+	})
+}