Harden configuration boundaries with fuzz coverage

internal/yaml/fuzz_test.go

@@ -0,0 +1,61 @@
+package yaml
+
+import (
+	"bytes"
+	"reflect"
+	"testing"
+
+	"gitea.maximumdirect.net/eric/ConfigKit/internal/document"
+)
+
+func FuzzParseDocument(f *testing.F) {
+	for _, seed := range []string{
+		"{}\n",
+		"service:\n  enabled: true\n  ports: [8080, 8081]\n",
+		"values: {empty: '', nothing: null, number: -1.5e2}\n",
+		"duplicate: one\nduplicate: two\n",
+		"alias: &value one\nother: *value\n",
+	} {
+		f.Add([]byte(seed))
+	}
+
+	limits := Limits{Depth: 64, Nodes: 4096, ParserDepth: 128}
+	f.Fuzz(func(t *testing.T, input []byte) {
+		if len(input) > 64<<10 {
+			return
+		}
+		parsed, issues := Parse(bytes.NewReader(input), "fuzz-input", limits)
+		if len(issues) != 0 {
+			return
+		}
+
+		var output bytes.Buffer
+		if err := Write(&output, parsed); err != nil {
+			t.Fatalf("Write() failed for accepted document: %v", err)
+		}
+		reparsed, issues := Parse(bytes.NewReader(output.Bytes()), "round-trip", limits)
+		if len(issues) != 0 {
+			t.Fatalf("rendered accepted document was rejected: %#v", issues)
+		}
+		clearLocations(parsed)
+		clearLocations(reparsed)
+		if !reflect.DeepEqual(parsed, reparsed) {
+			t.Fatalf("document changed across parse/write/parse: before=%#v after=%#v", parsed, reparsed)
+		}
+	})
+}
+
+func clearLocations(node *document.Node) {
+	if node == nil {
+		return
+	}
+	node.Location = document.Location{}
+	for index := range node.Mapping {
+		node.Mapping[index].KeyLocation = document.Location{}
+		node.Mapping[index].ValueLocation = document.Location{}
+		clearLocations(node.Mapping[index].Value)
+	}
+	for _, child := range node.Sequence {
+		clearLocations(child)
+	}
+}