Branch data     Line data    Source code

       1                 :             : // Copyright (c) 2020-present The Bitcoin Core developers
       2                 :             : // Distributed under the MIT software license, see the accompanying
       3                 :             : // file COPYING or http://www.opensource.org/licenses/mit-license.php.
       4                 :             : 
       5                 :             : #include <httpserver.h>
       6                 :             : #include <netaddress.h>
       7                 :             : #include <test/fuzz/FuzzedDataProvider.h>
       8                 :             : #include <test/fuzz/fuzz.h>
       9                 :             : #include <test/fuzz/util.h>
      10                 :             : #include <util/signalinterrupt.h>
      11                 :             : #include <util/strencodings.h>
      12                 :             : 
      13                 :             : #include <cassert>
      14                 :             : #include <cstdint>
      15                 :             : #include <string>
      16                 :             : #include <vector>
      17                 :             : 
      18                 :             : 
      19                 :             : std::string_view RequestMethodString(HTTPRequestMethod m);
      20                 :             : 
      21         [ +  - ]:         788 : FUZZ_TARGET(http_request)
      22                 :             : {
      23                 :         312 :     using util::LineReader;
      24                 :         312 :     using namespace bitcoin_http;
      25                 :             : 
      26                 :         312 :     FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
      27                 :         312 :     const std::string http_buffer{fuzzed_data_provider.ConsumeRandomLengthString(4096)};
      28                 :             : 
      29                 :         312 :     HTTPRequest http_request;
      30   [ -  +  +  - ]:         312 :     LineReader reader(http_buffer, MAX_HEADERS_SIZE);
      31                 :         312 :     try {
      32   [ +  +  +  + ]:         312 :         if (!http_request.LoadControlData(reader)) return;
      33   [ +  +  +  + ]:         167 :         if (!http_request.LoadHeaders(reader)) return;
      34   [ +  +  +  + ]:         110 :         if (!http_request.LoadBody(reader)) return;
      35         [ -  + ]:         159 :     } catch (const std::runtime_error&) {
      36                 :         159 :         return;
      37                 :         159 :     }
      38                 :             : 
      39         [ +  - ]:          94 :     const HTTPRequestMethod request_method = http_request.GetRequestMethod();
      40         [ +  - ]:          94 :     (void)RequestMethodString(request_method);
      41         [ -  + ]:         188 :     (void)http_request.GetURI();
      42         [ +  - ]:          94 :     (void)http_request.GetHeader("Host");
      43         [ +  - ]:          94 :     std::string header = fuzzed_data_provider.ConsumeRandomLengthString(16);
      44   [ -  +  +  - ]:          94 :     (void)http_request.GetHeader(header);
      45   [ +  -  +  - ]:         282 :     (void)http_request.WriteHeader(std::string(header), fuzzed_data_provider.ConsumeRandomLengthString(16));
      46   [ -  +  +  - ]:          94 :     (void)http_request.GetHeader(header);
      47                 :             :     // Reaching here means LoadControlData/LoadHeaders/LoadBody all succeeded, so the
      48                 :             :     // parsed body must be consistent with the message framing. Before libevent was
      49                 :             :     // replaced with HTTPRequest (#35182), ReadBody() always returned an
      50                 :             :     // empty string here; LoadBody now populates the body per RFC 9112 framing, so mirror
      51                 :             :     // its branch logic to assert the body matches the framing that produced it.
      52         [ -  + ]:          94 :     const std::string body = http_request.ReadBody();
      53         [ +  - ]:          94 :     const auto transfer_encoding = http_request.GetHeader("Transfer-Encoding");
      54         [ +  - ]:          94 :     const auto content_length = http_request.GetHeader("Content-Length");
      55   [ -  +  -  -  :          94 :     if (transfer_encoding && ToLower(*transfer_encoding) == "chunked") {
          -  -  -  -  -  
                      + ]
      56                 :             :         // A chunked body is the concatenation of the decoded chunks, bounded by MAX_BODY_SIZE.
      57   [ #  #  #  # ]:           0 :         assert(body.size() <= MAX_BODY_SIZE);
      58         [ +  + ]:          94 :     } else if (content_length) {
      59                 :             :         // A Content-Length body is exactly that many bytes.
      60         [ -  + ]:           1 :         const auto parsed_length{ToIntegral<uint64_t>(*content_length)};
      61         [ -  + ]:           1 :         assert(parsed_length);
      62   [ -  +  -  + ]:           1 :         assert(body.size() == *parsed_length);
      63                 :             :     } else {
      64                 :             :         // Absent both framing headers there is no body.
      65         [ -  + ]:          93 :         assert(body.empty());
      66                 :             :     }
      67                 :         312 : }