dunglas / go-urlpattern / 31848212451

93%

main: 92%

push

github

Add fuzz testing, fix panics it found (#14)

* test: add fuzz targets for constructor-string and init-based pattern parsing

Cover both entry points into the pattern compiler: New() with a
constructor string plus baseURL, and URLPatternInit.New() with
struct fields. Seeded from patterns exercised by the WPT test data.

* fix: prevent panic on syntax-only pathname/hostname pattern components

Some canonicalization callbacks (e.g. hostname, opaque-pathname) can
collapse a non-empty component like "#" down to an empty string.
generatePatternString assumed adjacent fixed-text parts always carry
a non-empty value and indexed into their rune slice unconditionally,
panicking on inputs like URLPatternInit{Protocol: "A", Hostname: "#*0"}.

Guard both indexing sites, and make canonicalizeHostname fail instead
of silently returning an empty hostname for a non-empty forbidden-host-
code-point input, matching the URL spec and the existing ':' guard.

Found by the new fuzz targets.

9 of 9 new or added lines in 2 files covered. (100.0%)

1509 of 1624 relevant lines covered (92.92%)

1562.69 hits per line