1 // Copyright 2020 The Chromium Authors
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include <fuzzer/FuzzedDataProvider.h>
6
7 #include <memory>
8 #include <string>
9
10 #include "net/base/network_isolation_key.h"
11 #include "net/dns/mock_host_resolver.h"
12 #include "net/http/http_auth_challenge_tokenizer.h"
13 #include "net/http/http_auth_handler.h"
14 #include "net/http/http_auth_handler_factory.h"
15 #include "net/http/http_auth_scheme.h"
16 #include "net/log/net_log_with_source.h"
17 #include "net/ssl/ssl_info.h"
18 #include "url/gurl.h"
19 #include "url/scheme_host_port.h"
20
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)21 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
22 FuzzedDataProvider data_provider{data, size};
23
24 std::string scheme;
25 if (data_provider.ConsumeBool()) {
26 scheme = std::string(data_provider.PickValueInArray(
27 {net::kBasicAuthScheme, net::kDigestAuthScheme, net::kNtlmAuthScheme,
28 net::kNegotiateAuthScheme}));
29 } else {
30 scheme = data_provider.ConsumeRandomLengthString(10);
31 }
32 std::unique_ptr<net::HttpAuthHandlerRegistryFactory> factory =
33 net::HttpAuthHandlerFactory::CreateDefault();
34
35 if (!factory->IsSchemeAllowedForTesting(scheme))
36 return 0;
37
38 std::string challenge = data_provider.ConsumeRandomLengthString(500);
39
40 // Dummies
41 net::SSLInfo null_ssl_info;
42 url::SchemeHostPort scheme_host_port(GURL("https://foo.test/"));
43 auto host_resolver = std::make_unique<net::MockHostResolver>();
44 std::unique_ptr<net::HttpAuthHandler> handler;
45
46 factory->CreateAuthHandlerFromString(
47 challenge, net::HttpAuth::AUTH_SERVER, null_ssl_info,
48 net::NetworkAnonymizationKey(), scheme_host_port, net::NetLogWithSource(),
49 host_resolver.get(), &handler);
50
51 if (handler) {
52 auto followup = data_provider.ConsumeRemainingBytesAsString();
53 net::HttpAuthChallengeTokenizer tokenizer{followup.begin(), followup.end()};
54 handler->HandleAnotherChallenge(&tokenizer);
55 }
56 return 0;
57 }
58