Skip to content

test(fapi): expect FuzzParseEndpointURL to refuse an empty fragment #783

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
osanderson merged 1 commit into from
Nov 2, 2026
Merged

test(fapi): expect FuzzParseEndpointURL to refuse an empty fragment #783

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions testdata/fuzz/FuzzParseEndpointURL/9df311e55a4487ec
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
go test fuzz v1
string("http://loCAlhost#")
bool(true)
10 changes: 5 additions & 5 deletions url_fuzz_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,8 @@ import (
// on a client-supplied redirect_uri, which a pushed authorization
// request now runs through it. Beyond "does not panic":
//
// - an accepted URL is absolute, has no credentials or fragment, and
// has a lowercase scheme and host;
// - an accepted URL is absolute, has no credentials or fragment (not
// even an empty "#"), and has a lowercase scheme and host;
// - it is https, or http only with AllowLoopbackHTTP and a host that
// is genuinely loopback — judged by an oracle independent of
// isLoopbackHost (url.Hostname, which strips the port and IPv6
Expand Down Expand Up @@ -85,8 +85,8 @@ func checkAcceptedURL(t *testing.T, raw string, u URL, allowLoopback bool) {
if parsed.User != nil {
t.Fatalf("accepted URL with credentials %q", raw)
}
if parsed.Fragment != "" {
t.Fatalf("accepted URL with fragment %q", raw)
if parsed.Fragment != "" || strings.Contains(raw, "#") {
t.Fatalf("accepted URL with a fragment, or an empty one, %q", raw)
}
if parsed.Scheme != strings.ToLower(parsed.Scheme) || parsed.Host != strings.ToLower(parsed.Host) {
t.Fatalf("accepted %q without lowercasing scheme/host: %q", raw, u.String())
Expand Down Expand Up @@ -115,7 +115,7 @@ func checkLoopbackHTTPNotWronglyRejected(t *testing.T, raw string, allowLoopback
}
parsed, err := url.Parse(raw)
if err != nil || !strings.EqualFold(parsed.Scheme, "http") || !parsed.IsAbs() || parsed.Host == "" ||
parsed.User != nil || parsed.Fragment != "" {
parsed.User != nil || strings.Contains(raw, "#") {
return
}
if loopbackOracle(parsed.Hostname()) {
Expand Down
Loading