diff --git a/docs/agents/task-logs/weekly/2026-02-18_13-06-28_fuzz-agent_completed.md b/docs/agents/task-logs/weekly/2026-02-18_13-06-28_fuzz-agent_completed.md new file mode 100644 index 00000000..9195babb --- /dev/null +++ b/docs/agents/task-logs/weekly/2026-02-18_13-06-28_fuzz-agent_completed.md @@ -0,0 +1,28 @@ +# Fuzz Agent Log + +- **Agent:** bitvid-fuzz-agent +- **Date:** 2026-02-18 +- **Status:** Completed +- **Target:** Nostr Event Schemas & Magnet Utils + +## Summary + +Executed fuzzing campaign against `js/nostrEventSchemas.js` and `js/magnetUtils.js`. + +1. **Standard Nostr Fuzzer** (`scripts/agent/fuzz-nostrEventSchemas.mjs`): + - Iterations: 1000 per target (29 targets) + - Result: No crashes found. +2. **Magnet Utils Fuzzer** (`scripts/agent/fuzz-magnetUtils.mjs`): + - Iterations: 1000 per target (4 targets) + - Result: No crashes found. +3. **Aggressive Nostr Fuzzer** (`scripts/agent/fuzz-nostrEventSchemas-aggressive.mjs`): + - Created new aggressive fuzzer targeting deeply nested JSON, huge strings, and prototype pollution keys. + - Iterations: 5000 + - Result: No crashes found. + +The codebase demonstrates high robustness against malformed inputs in these areas. + +## Artifacts + +- `scripts/agent/fuzz-nostrEventSchemas-aggressive.mjs`: New fuzz harness. +- `artifacts/fuzz-report-validateEventStructure-Aggressive.json`: Empty failure report. diff --git a/scripts/agent/fuzz-nostrEventSchemas-aggressive.mjs b/scripts/agent/fuzz-nostrEventSchemas-aggressive.mjs new file mode 100644 index 00000000..5b90a832 --- /dev/null +++ b/scripts/agent/fuzz-nostrEventSchemas-aggressive.mjs @@ -0,0 +1,97 @@ +import { + randomInt, + randomString, + runFuzzer, +} from "./fuzz-utils.mjs"; +import { validateEventStructure, NOTE_TYPES } from "../../js/nostrEventSchemas.js"; + +function generateAggressiveJSON(depth = 0) { + if (depth > 50) return "deep"; // Stop before stack overflow unless we want to test that limit + + const choice = randomInt(0, 10); + + if (choice < 2) { + // Nested Object + const obj = {}; + const key = Math.random() < 0.1 ? "__proto__" : (Math.random() < 0.1 ? "constructor" : randomString(5)); + obj[key] = generateAggressiveJSON(depth + 1); + return obj; + } + + if (choice < 4) { + // Nested Array + return [generateAggressiveJSON(depth + 1)]; + } + + if (choice < 5) { + // Huge String + return randomString(10000); + } + + if (choice < 6) { + // Unicode Chaos + return "\uD800\uDC00" + randomString(100, true) + "\uFFFF"; + } + + if (choice < 7) { + return null; + } + + if (choice < 8) { + return true; + } + + return 12345; +} + +function genAggressiveEvent() { + const types = Object.values(NOTE_TYPES); + const type = types[randomInt(0, types.length - 1)]; + + // Malformed structure + if (Math.random() < 0.1) return [type, null]; + if (Math.random() < 0.1) return [type, []]; + if (Math.random() < 0.1) return [type, "string"]; + + const event = { + kind: randomInt(0, 50000), + tags: [], + content: "" + }; + + // Malformed tags + if (Math.random() < 0.5) { + const numTags = randomInt(0, 100); + for(let i=0; i