1 // Copyright 2017 The Chromium Authors
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "net/reporting/reporting_header_parser.h"
6
7 #include <memory>
8 #include <optional>
9 #include <utility>
10
11 #include "base/json/json_reader.h"
12 #include "base/time/default_clock.h"
13 #include "base/time/default_tick_clock.h"
14 #include "base/time/time.h"
15 #include "base/values.h"
16 #include "net/base/network_anonymization_key.h"
17 #include "net/reporting/reporting_cache.h"
18 #include "net/reporting/reporting_policy.pb.h"
19 #include "net/reporting/reporting_test_util.h"
20 #include "testing/libfuzzer/proto/json_proto_converter.h"
21 #include "third_party/libprotobuf-mutator/src/src/libfuzzer/libfuzzer_macro.h"
22 #include "url/gurl.h"
23 #include "url/origin.h"
24
25 // Silence logging from the protobuf library.
26 protobuf_mutator::protobuf::LogSilencer log_silencer;
27
28 namespace net_reporting_header_parser_fuzzer {
29
FuzzReportingHeaderParser(const std::string & data_json,const net::ReportingPolicy & policy)30 void FuzzReportingHeaderParser(const std::string& data_json,
31 const net::ReportingPolicy& policy) {
32 net::TestReportingContext context(base::DefaultClock::GetInstance(),
33 base::DefaultTickClock::GetInstance(),
34 policy);
35 // Emulate what ReportingService::OnHeader does before calling
36 // ReportingHeaderParser::ParseHeader.
37 std::optional<base::Value> data_value =
38 base::JSONReader::Read("[" + data_json + "]");
39 if (!data_value)
40 return;
41
42 // TODO: consider including proto definition for URL after moving that to
43 // testing/libfuzzer/proto and creating a separate converter.
44 net::ReportingHeaderParser::ParseReportToHeader(
45 &context, net::NetworkAnonymizationKey(),
46 url::Origin::Create(GURL("https://origin/")), data_value->GetList());
47 if (context.cache()->GetEndpointCount() == 0) {
48 return;
49 }
50 }
51
InitializeReportingPolicy(net::ReportingPolicy & policy,const net_reporting_policy_proto::ReportingPolicy & policy_data)52 void InitializeReportingPolicy(
53 net::ReportingPolicy& policy,
54 const net_reporting_policy_proto::ReportingPolicy& policy_data) {
55 policy.max_report_count = policy_data.max_report_count();
56 policy.max_endpoint_count = policy_data.max_endpoint_count();
57 policy.delivery_interval =
58 base::Microseconds(policy_data.delivery_interval_us());
59 policy.persistence_interval =
60 base::Microseconds(policy_data.persistence_interval_us());
61 policy.persist_reports_across_restarts =
62 policy_data.persist_reports_across_restarts();
63 policy.persist_clients_across_restarts =
64 policy_data.persist_clients_across_restarts();
65 policy.garbage_collection_interval =
66 base::Microseconds(policy_data.garbage_collection_interval_us());
67 policy.max_report_age = base::Microseconds(policy_data.max_report_age_us());
68 policy.max_report_attempts = policy_data.max_report_attempts();
69 policy.persist_reports_across_network_changes =
70 policy_data.persist_reports_across_network_changes();
71 policy.persist_clients_across_network_changes =
72 policy_data.persist_clients_across_network_changes();
73 if (policy_data.has_max_endpoints_per_origin())
74 policy.max_endpoints_per_origin = policy_data.max_endpoints_per_origin();
75 if (policy_data.has_max_group_staleness_us()) {
76 policy.max_group_staleness =
77 base::Microseconds(policy_data.max_report_age_us());
78 }
79 }
80
DEFINE_BINARY_PROTO_FUZZER(const net_reporting_policy_proto::ReportingHeaderParserFuzzInput & input)81 DEFINE_BINARY_PROTO_FUZZER(
82 const net_reporting_policy_proto::ReportingHeaderParserFuzzInput& input) {
83 net::ReportingPolicy policy;
84 InitializeReportingPolicy(policy, input.policy());
85
86 json_proto::JsonProtoConverter converter;
87 auto data = converter.Convert(input.headers());
88
89 FuzzReportingHeaderParser(data, policy);
90 }
91
92 } // namespace net_reporting_header_parser_fuzzer
93