matrix-fuzz.meta

Issues/PRs archive for MTRNord/matrix-fuzz
git clone git://archive.git.mtrnord.blog/MTRNord/matrix-fuzz.meta.git
Log | Files | Refs

2.diff (36259B)


      1 diff --git a/.gitignore b/.gitignore
      2 index b1ebc0f..3d959af 100644
      3 --- a/.gitignore
      4 +++ b/.gitignore
      5 @@ -2,4 +2,6 @@
      6  /Cargo.lock
      7  notes.md
      8  src/secrets.rs
      9 -/fuzz
     10 \ No newline at end of file
     11 +/fuzz
     12 +/meep.rs
     13 +/weird_ones/security_issues
     14 \ No newline at end of file
     15 diff --git a/Cargo.toml b/Cargo.toml
     16 index c2ac5c8..47ab89c 100644
     17 --- a/Cargo.toml
     18 +++ b/Cargo.toml
     19 @@ -10,6 +10,4 @@ serde = { version = "1.0", features = ["derive"] }
     20  reqwest = { version = "0.11.11", features = ["blocking","json","gzip"] }
     21  serde_json = "1.0.83"
     22  once_cell = "1.13.0"
     23 -
     24 -[target.'cfg(fuzzing)'.dev-dependencies]
     25  fuzzcheck = "0.12"
     26 \ No newline at end of file
     27 diff --git a/LICENSE.md b/LICENSE.md
     28 index 261eeb9..29f81d8 100644
     29 --- a/LICENSE.md
     30 +++ b/LICENSE.md
     31 @@ -1,201 +1,201 @@
     32 -                                 Apache License
     33 -                           Version 2.0, January 2004
     34 -                        http://www.apache.org/licenses/
     35 -
     36 -   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
     37 -
     38 -   1. Definitions.
     39 -
     40 -      "License" shall mean the terms and conditions for use, reproduction,
     41 -      and distribution as defined by Sections 1 through 9 of this document.
     42 -
     43 -      "Licensor" shall mean the copyright owner or entity authorized by
     44 -      the copyright owner that is granting the License.
     45 -
     46 -      "Legal Entity" shall mean the union of the acting entity and all
     47 -      other entities that control, are controlled by, or are under common
     48 -      control with that entity. For the purposes of this definition,
     49 -      "control" means (i) the power, direct or indirect, to cause the
     50 -      direction or management of such entity, whether by contract or
     51 -      otherwise, or (ii) ownership of fifty percent (50%) or more of the
     52 -      outstanding shares, or (iii) beneficial ownership of such entity.
     53 -
     54 -      "You" (or "Your") shall mean an individual or Legal Entity
     55 -      exercising permissions granted by this License.
     56 -
     57 -      "Source" form shall mean the preferred form for making modifications,
     58 -      including but not limited to software source code, documentation
     59 -      source, and configuration files.
     60 -
     61 -      "Object" form shall mean any form resulting from mechanical
     62 -      transformation or translation of a Source form, including but
     63 -      not limited to compiled object code, generated documentation,
     64 -      and conversions to other media types.
     65 -
     66 -      "Work" shall mean the work of authorship, whether in Source or
     67 -      Object form, made available under the License, as indicated by a
     68 -      copyright notice that is included in or attached to the work
     69 -      (an example is provided in the Appendix below).
     70 -
     71 -      "Derivative Works" shall mean any work, whether in Source or Object
     72 -      form, that is based on (or derived from) the Work and for which the
     73 -      editorial revisions, annotations, elaborations, or other modifications
     74 -      represent, as a whole, an original work of authorship. For the purposes
     75 -      of this License, Derivative Works shall not include works that remain
     76 -      separable from, or merely link (or bind by name) to the interfaces of,
     77 -      the Work and Derivative Works thereof.
     78 -
     79 -      "Contribution" shall mean any work of authorship, including
     80 -      the original version of the Work and any modifications or additions
     81 -      to that Work or Derivative Works thereof, that is intentionally
     82 -      submitted to Licensor for inclusion in the Work by the copyright owner
     83 -      or by an individual or Legal Entity authorized to submit on behalf of
     84 -      the copyright owner. For the purposes of this definition, "submitted"
     85 -      means any form of electronic, verbal, or written communication sent
     86 -      to the Licensor or its representatives, including but not limited to
     87 -      communication on electronic mailing lists, source code control systems,
     88 -      and issue tracking systems that are managed by, or on behalf of, the
     89 -      Licensor for the purpose of discussing and improving the Work, but
     90 -      excluding communication that is conspicuously marked or otherwise
     91 -      designated in writing by the copyright owner as "Not a Contribution."
     92 -
     93 -      "Contributor" shall mean Licensor and any individual or Legal Entity
     94 -      on behalf of whom a Contribution has been received by Licensor and
     95 -      subsequently incorporated within the Work.
     96 -
     97 -   2. Grant of Copyright License. Subject to the terms and conditions of
     98 -      this License, each Contributor hereby grants to You a perpetual,
     99 -      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
    100 -      copyright license to reproduce, prepare Derivative Works of,
    101 -      publicly display, publicly perform, sublicense, and distribute the
    102 -      Work and such Derivative Works in Source or Object form.
    103 -
    104 -   3. Grant of Patent License. Subject to the terms and conditions of
    105 -      this License, each Contributor hereby grants to You a perpetual,
    106 -      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
    107 -      (except as stated in this section) patent license to make, have made,
    108 -      use, offer to sell, sell, import, and otherwise transfer the Work,
    109 -      where such license applies only to those patent claims licensable
    110 -      by such Contributor that are necessarily infringed by their
    111 -      Contribution(s) alone or by combination of their Contribution(s)
    112 -      with the Work to which such Contribution(s) was submitted. If You
    113 -      institute patent litigation against any entity (including a
    114 -      cross-claim or counterclaim in a lawsuit) alleging that the Work
    115 -      or a Contribution incorporated within the Work constitutes direct
    116 -      or contributory patent infringement, then any patent licenses
    117 -      granted to You under this License for that Work shall terminate
    118 -      as of the date such litigation is filed.
    119 -
    120 -   4. Redistribution. You may reproduce and distribute copies of the
    121 -      Work or Derivative Works thereof in any medium, with or without
    122 -      modifications, and in Source or Object form, provided that You
    123 -      meet the following conditions:
    124 -
    125 -      (a) You must give any other recipients of the Work or
    126 -          Derivative Works a copy of this License; and
    127 -
    128 -      (b) You must cause any modified files to carry prominent notices
    129 -          stating that You changed the files; and
    130 -
    131 -      (c) You must retain, in the Source form of any Derivative Works
    132 -          that You distribute, all copyright, patent, trademark, and
    133 -          attribution notices from the Source form of the Work,
    134 -          excluding those notices that do not pertain to any part of
    135 -          the Derivative Works; and
    136 -
    137 -      (d) If the Work includes a "NOTICE" text file as part of its
    138 -          distribution, then any Derivative Works that You distribute must
    139 -          include a readable copy of the attribution notices contained
    140 -          within such NOTICE file, excluding those notices that do not
    141 -          pertain to any part of the Derivative Works, in at least one
    142 -          of the following places: within a NOTICE text file distributed
    143 -          as part of the Derivative Works; within the Source form or
    144 -          documentation, if provided along with the Derivative Works; or,
    145 -          within a display generated by the Derivative Works, if and
    146 -          wherever such third-party notices normally appear. The contents
    147 -          of the NOTICE file are for informational purposes only and
    148 -          do not modify the License. You may add Your own attribution
    149 -          notices within Derivative Works that You distribute, alongside
    150 -          or as an addendum to the NOTICE text from the Work, provided
    151 -          that such additional attribution notices cannot be construed
    152 -          as modifying the License.
    153 -
    154 -      You may add Your own copyright statement to Your modifications and
    155 -      may provide additional or different license terms and conditions
    156 -      for use, reproduction, or distribution of Your modifications, or
    157 -      for any such Derivative Works as a whole, provided Your use,
    158 -      reproduction, and distribution of the Work otherwise complies with
    159 -      the conditions stated in this License.
    160 -
    161 -   5. Submission of Contributions. Unless You explicitly state otherwise,
    162 -      any Contribution intentionally submitted for inclusion in the Work
    163 -      by You to the Licensor shall be under the terms and conditions of
    164 -      this License, without any additional terms or conditions.
    165 -      Notwithstanding the above, nothing herein shall supersede or modify
    166 -      the terms of any separate license agreement you may have executed
    167 -      with Licensor regarding such Contributions.
    168 -
    169 -   6. Trademarks. This License does not grant permission to use the trade
    170 -      names, trademarks, service marks, or product names of the Licensor,
    171 -      except as required for reasonable and customary use in describing the
    172 -      origin of the Work and reproducing the content of the NOTICE file.
    173 -
    174 -   7. Disclaimer of Warranty. Unless required by applicable law or
    175 -      agreed to in writing, Licensor provides the Work (and each
    176 -      Contributor provides its Contributions) on an "AS IS" BASIS,
    177 -      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
    178 -      implied, including, without limitation, any warranties or conditions
    179 -      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
    180 -      PARTICULAR PURPOSE. You are solely responsible for determining the
    181 -      appropriateness of using or redistributing the Work and assume any
    182 -      risks associated with Your exercise of permissions under this License.
    183 -
    184 -   8. Limitation of Liability. In no event and under no legal theory,
    185 -      whether in tort (including negligence), contract, or otherwise,
    186 -      unless required by applicable law (such as deliberate and grossly
    187 -      negligent acts) or agreed to in writing, shall any Contributor be
    188 -      liable to You for damages, including any direct, indirect, special,
    189 -      incidental, or consequential damages of any character arising as a
    190 -      result of this License or out of the use or inability to use the
    191 -      Work (including but not limited to damages for loss of goodwill,
    192 -      work stoppage, computer failure or malfunction, or any and all
    193 -      other commercial damages or losses), even if such Contributor
    194 -      has been advised of the possibility of such damages.
    195 -
    196 -   9. Accepting Warranty or Additional Liability. While redistributing
    197 -      the Work or Derivative Works thereof, You may choose to offer,
    198 -      and charge a fee for, acceptance of support, warranty, indemnity,
    199 -      or other liability obligations and/or rights consistent with this
    200 -      License. However, in accepting such obligations, You may act only
    201 -      on Your own behalf and on Your sole responsibility, not on behalf
    202 -      of any other Contributor, and only if You agree to indemnify,
    203 -      defend, and hold each Contributor harmless for any liability
    204 -      incurred by, or claims asserted against, such Contributor by reason
    205 -      of your accepting any such warranty or additional liability.
    206 -
    207 -   END OF TERMS AND CONDITIONS
    208 -
    209 -   APPENDIX: How to apply the Apache License to your work.
    210 -
    211 -      To apply the Apache License to your work, attach the following
    212 -      boilerplate notice, with the fields enclosed by brackets "[]"
    213 -      replaced with your own identifying information. (Don't include
    214 -      the brackets!)  The text should be enclosed in the appropriate
    215 -      comment syntax for the file format. We also recommend that a
    216 -      file or class name and description of purpose be included on the
    217 -      same "printed page" as the copyright notice for easier
    218 -      identification within third-party archives.
    219 -
    220 -   Copyright [yyyy] [name of copyright owner]
    221 -
    222 -   Licensed under the Apache License, Version 2.0 (the "License");
    223 -   you may not use this file except in compliance with the License.
    224 -   You may obtain a copy of the License at
    225 -
    226 -       http://www.apache.org/licenses/LICENSE-2.0
    227 -
    228 -   Unless required by applicable law or agreed to in writing, software
    229 -   distributed under the License is distributed on an "AS IS" BASIS,
    230 -   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    231 -   See the License for the specific language governing permissions and
    232 -   limitations under the License.
    233 +                                 Apache License
    234 +                           Version 2.0, January 2004
    235 +                        http://www.apache.org/licenses/
    236 +
    237 +   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
    238 +
    239 +   1. Definitions.
    240 +
    241 +      "License" shall mean the terms and conditions for use, reproduction,
    242 +      and distribution as defined by Sections 1 through 9 of this document.
    243 +
    244 +      "Licensor" shall mean the copyright owner or entity authorized by
    245 +      the copyright owner that is granting the License.
    246 +
    247 +      "Legal Entity" shall mean the union of the acting entity and all
    248 +      other entities that control, are controlled by, or are under common
    249 +      control with that entity. For the purposes of this definition,
    250 +      "control" means (i) the power, direct or indirect, to cause the
    251 +      direction or management of such entity, whether by contract or
    252 +      otherwise, or (ii) ownership of fifty percent (50%) or more of the
    253 +      outstanding shares, or (iii) beneficial ownership of such entity.
    254 +
    255 +      "You" (or "Your") shall mean an individual or Legal Entity
    256 +      exercising permissions granted by this License.
    257 +
    258 +      "Source" form shall mean the preferred form for making modifications,
    259 +      including but not limited to software source code, documentation
    260 +      source, and configuration files.
    261 +
    262 +      "Object" form shall mean any form resulting from mechanical
    263 +      transformation or translation of a Source form, including but
    264 +      not limited to compiled object code, generated documentation,
    265 +      and conversions to other media types.
    266 +
    267 +      "Work" shall mean the work of authorship, whether in Source or
    268 +      Object form, made available under the License, as indicated by a
    269 +      copyright notice that is included in or attached to the work
    270 +      (an example is provided in the Appendix below).
    271 +
    272 +      "Derivative Works" shall mean any work, whether in Source or Object
    273 +      form, that is based on (or derived from) the Work and for which the
    274 +      editorial revisions, annotations, elaborations, or other modifications
    275 +      represent, as a whole, an original work of authorship. For the purposes
    276 +      of this License, Derivative Works shall not include works that remain
    277 +      separable from, or merely link (or bind by name) to the interfaces of,
    278 +      the Work and Derivative Works thereof.
    279 +
    280 +      "Contribution" shall mean any work of authorship, including
    281 +      the original version of the Work and any modifications or additions
    282 +      to that Work or Derivative Works thereof, that is intentionally
    283 +      submitted to Licensor for inclusion in the Work by the copyright owner
    284 +      or by an individual or Legal Entity authorized to submit on behalf of
    285 +      the copyright owner. For the purposes of this definition, "submitted"
    286 +      means any form of electronic, verbal, or written communication sent
    287 +      to the Licensor or its representatives, including but not limited to
    288 +      communication on electronic mailing lists, source code control systems,
    289 +      and issue tracking systems that are managed by, or on behalf of, the
    290 +      Licensor for the purpose of discussing and improving the Work, but
    291 +      excluding communication that is conspicuously marked or otherwise
    292 +      designated in writing by the copyright owner as "Not a Contribution."
    293 +
    294 +      "Contributor" shall mean Licensor and any individual or Legal Entity
    295 +      on behalf of whom a Contribution has been received by Licensor and
    296 +      subsequently incorporated within the Work.
    297 +
    298 +   2. Grant of Copyright License. Subject to the terms and conditions of
    299 +      this License, each Contributor hereby grants to You a perpetual,
    300 +      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
    301 +      copyright license to reproduce, prepare Derivative Works of,
    302 +      publicly display, publicly perform, sublicense, and distribute the
    303 +      Work and such Derivative Works in Source or Object form.
    304 +
    305 +   3. Grant of Patent License. Subject to the terms and conditions of
    306 +      this License, each Contributor hereby grants to You a perpetual,
    307 +      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
    308 +      (except as stated in this section) patent license to make, have made,
    309 +      use, offer to sell, sell, import, and otherwise transfer the Work,
    310 +      where such license applies only to those patent claims licensable
    311 +      by such Contributor that are necessarily infringed by their
    312 +      Contribution(s) alone or by combination of their Contribution(s)
    313 +      with the Work to which such Contribution(s) was submitted. If You
    314 +      institute patent litigation against any entity (including a
    315 +      cross-claim or counterclaim in a lawsuit) alleging that the Work
    316 +      or a Contribution incorporated within the Work constitutes direct
    317 +      or contributory patent infringement, then any patent licenses
    318 +      granted to You under this License for that Work shall terminate
    319 +      as of the date such litigation is filed.
    320 +
    321 +   4. Redistribution. You may reproduce and distribute copies of the
    322 +      Work or Derivative Works thereof in any medium, with or without
    323 +      modifications, and in Source or Object form, provided that You
    324 +      meet the following conditions:
    325 +
    326 +      (a) You must give any other recipients of the Work or
    327 +          Derivative Works a copy of this License; and
    328 +
    329 +      (b) You must cause any modified files to carry prominent notices
    330 +          stating that You changed the files; and
    331 +
    332 +      (c) You must retain, in the Source form of any Derivative Works
    333 +          that You distribute, all copyright, patent, trademark, and
    334 +          attribution notices from the Source form of the Work,
    335 +          excluding those notices that do not pertain to any part of
    336 +          the Derivative Works; and
    337 +
    338 +      (d) If the Work includes a "NOTICE" text file as part of its
    339 +          distribution, then any Derivative Works that You distribute must
    340 +          include a readable copy of the attribution notices contained
    341 +          within such NOTICE file, excluding those notices that do not
    342 +          pertain to any part of the Derivative Works, in at least one
    343 +          of the following places: within a NOTICE text file distributed
    344 +          as part of the Derivative Works; within the Source form or
    345 +          documentation, if provided along with the Derivative Works; or,
    346 +          within a display generated by the Derivative Works, if and
    347 +          wherever such third-party notices normally appear. The contents
    348 +          of the NOTICE file are for informational purposes only and
    349 +          do not modify the License. You may add Your own attribution
    350 +          notices within Derivative Works that You distribute, alongside
    351 +          or as an addendum to the NOTICE text from the Work, provided
    352 +          that such additional attribution notices cannot be construed
    353 +          as modifying the License.
    354 +
    355 +      You may add Your own copyright statement to Your modifications and
    356 +      may provide additional or different license terms and conditions
    357 +      for use, reproduction, or distribution of Your modifications, or
    358 +      for any such Derivative Works as a whole, provided Your use,
    359 +      reproduction, and distribution of the Work otherwise complies with
    360 +      the conditions stated in this License.
    361 +
    362 +   5. Submission of Contributions. Unless You explicitly state otherwise,
    363 +      any Contribution intentionally submitted for inclusion in the Work
    364 +      by You to the Licensor shall be under the terms and conditions of
    365 +      this License, without any additional terms or conditions.
    366 +      Notwithstanding the above, nothing herein shall supersede or modify
    367 +      the terms of any separate license agreement you may have executed
    368 +      with Licensor regarding such Contributions.
    369 +
    370 +   6. Trademarks. This License does not grant permission to use the trade
    371 +      names, trademarks, service marks, or product names of the Licensor,
    372 +      except as required for reasonable and customary use in describing the
    373 +      origin of the Work and reproducing the content of the NOTICE file.
    374 +
    375 +   7. Disclaimer of Warranty. Unless required by applicable law or
    376 +      agreed to in writing, Licensor provides the Work (and each
    377 +      Contributor provides its Contributions) on an "AS IS" BASIS,
    378 +      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
    379 +      implied, including, without limitation, any warranties or conditions
    380 +      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
    381 +      PARTICULAR PURPOSE. You are solely responsible for determining the
    382 +      appropriateness of using or redistributing the Work and assume any
    383 +      risks associated with Your exercise of permissions under this License.
    384 +
    385 +   8. Limitation of Liability. In no event and under no legal theory,
    386 +      whether in tort (including negligence), contract, or otherwise,
    387 +      unless required by applicable law (such as deliberate and grossly
    388 +      negligent acts) or agreed to in writing, shall any Contributor be
    389 +      liable to You for damages, including any direct, indirect, special,
    390 +      incidental, or consequential damages of any character arising as a
    391 +      result of this License or out of the use or inability to use the
    392 +      Work (including but not limited to damages for loss of goodwill,
    393 +      work stoppage, computer failure or malfunction, or any and all
    394 +      other commercial damages or losses), even if such Contributor
    395 +      has been advised of the possibility of such damages.
    396 +
    397 +   9. Accepting Warranty or Additional Liability. While redistributing
    398 +      the Work or Derivative Works thereof, You may choose to offer,
    399 +      and charge a fee for, acceptance of support, warranty, indemnity,
    400 +      or other liability obligations and/or rights consistent with this
    401 +      License. However, in accepting such obligations, You may act only
    402 +      on Your own behalf and on Your sole responsibility, not on behalf
    403 +      of any other Contributor, and only if You agree to indemnify,
    404 +      defend, and hold each Contributor harmless for any liability
    405 +      incurred by, or claims asserted against, such Contributor by reason
    406 +      of your accepting any such warranty or additional liability.
    407 +
    408 +   END OF TERMS AND CONDITIONS
    409 +
    410 +   APPENDIX: How to apply the Apache License to your work.
    411 +
    412 +      To apply the Apache License to your work, attach the following
    413 +      boilerplate notice, with the fields enclosed by brackets "[]"
    414 +      replaced with your own identifying information. (Don't include
    415 +      the brackets!)  The text should be enclosed in the appropriate
    416 +      comment syntax for the file format. We also recommend that a
    417 +      file or class name and description of purpose be included on the
    418 +      same "printed page" as the copyright notice for easier
    419 +      identification within third-party archives.
    420 +
    421 +   Copyright [yyyy] [name of copyright owner]
    422 +
    423 +   Licensed under the Apache License, Version 2.0 (the "License");
    424 +   you may not use this file except in compliance with the License.
    425 +   You may obtain a copy of the License at
    426 +
    427 +       http://www.apache.org/licenses/LICENSE-2.0
    428 +
    429 +   Unless required by applicable law or agreed to in writing, software
    430 +   distributed under the License is distributed on an "AS IS" BASIS,
    431 +   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    432 +   See the License for the specific language governing permissions and
    433 +   limitations under the License.
    434 diff --git a/README.md b/README.md
    435 index faf897b..2734a11 100644
    436 --- a/README.md
    437 +++ b/README.md
    438 @@ -1,32 +1,36 @@
    439 -# Matrix Fuzzing
    440 -
    441 -Matrix fuzzing is a dumb fuzzer fuzzing a few matrix endpoints. It requires a HS and a user to exist.
    442 -
    443 -# Current targets
    444 -
    445 -- `/_matrix/client/v3/createRoom` - `tests::tests::fuzz_create_room`
    446 -
    447 -# Usage
    448 -
    449 -1. Create a HS
    450 -1. Setup a user
    451 -1. Add the secrets to src/secrets.rs.
    452 -
    453 -   Example code:
    454 -
    455 -   ```rust
    456 -   pub const USERNAME: &str = "@a:localhost";
    457 -   pub const PASSWORD: &str = "abc123";
    458 -   ```
    459 -
    460 -1. Install fuzzcheck -> https://github.com/loiclec/fuzzcheck-rs#setup
    461 -1. Run `cargo fuzzcheck <target>`
    462 -1. Wait until it crashes
    463 -1. Verify the error by trying the output json yourself
    464 -1. Please make sure to follow https://matrix.org/security-disclosure-policy/ for found errors instead of posting them in public unless you are 100% sure they are not a security issue. If you are in doubt prefer the security disclosure policy.
    465 -
    466 -# Hall of Explosions (Bugs found)
    467 -
    468 -- https://github.com/matrix-org/synapse/issues/13510
    469 -- https://github.com/matrix-org/synapse/issues/13511
    470 -- https://github.com/matrix-org/synapse/issues/13512
    471 +# Matrix Fuzzing
    472 +
    473 +Matrix fuzzing is a dumb fuzzer fuzzing a few matrix endpoints. It requires a HS and a user to exist.
    474 +
    475 +# Current targets
    476 +
    477 +- `/_matrix/client/v3/createRoom` - `tests::tests::fuzz_create_room`
    478 +
    479 +# Usage
    480 +
    481 +1. Create a HS
    482 +1. Setup a user
    483 +1. Add the secrets to src/secrets.rs.
    484 +
    485 +   Example code:
    486 +
    487 +   ```rust
    488 +   pub const USERNAME: &str = "@a:localhost";
    489 +   pub const PASSWORD: &str = "abc123";
    490 +   ```
    491 +
    492 +1. Install fuzzcheck -> https://github.com/loiclec/fuzzcheck-rs#setup
    493 +1. Run `cargo fuzzcheck <target>`
    494 +1. Wait until it crashes
    495 +1. Verify the error by trying the output json yourself
    496 +1. Please make sure to follow https://matrix.org/security-disclosure-policy/ for found errors instead of posting them in public unless you are 100% sure they are not a security issue. If you are in doubt prefer the security disclosure policy.
    497 +
    498 +# Hall of Explosions (Bugs found)
    499 +
    500 +- https://github.com/matrix-org/synapse/issues/13510
    501 +- https://github.com/matrix-org/synapse/issues/13511
    502 +- https://github.com/matrix-org/synapse/issues/13512
    503 +
    504 +# Known bugs in the fuzzer
    505 +
    506 +The fuzzer generates arbitrary json objects currently very poorly. Resulting in a lot less cases than it should. Its a workaround for now until there is a nicer way.
    507 \ No newline at end of file
    508 diff --git a/src/lib.rs b/src/lib.rs
    509 index 347bb3d..117d751 100644
    510 --- a/src/lib.rs
    511 +++ b/src/lib.rs
    512 @@ -1,5 +1,7 @@
    513 -#![cfg_attr(fuzzing, feature(no_coverage))]
    514 +#![feature(no_coverage)]
    515 +#![feature(type_alias_impl_trait)]
    516  #![allow(dead_code)]
    517 +#![allow(clippy::too_many_arguments)]
    518  
    519  use std::collections::HashMap;
    520  
    521 @@ -55,6 +57,10 @@ fn login() -> String {
    522  
    523  #[cfg(all(test, not(fuzzing)))]
    524  mod tests {
    525 +    use reqwest::header::{HeaderValue, CONTENT_TYPE};
    526 +
    527 +    use crate::types::CreateRoomMagic;
    528 +
    529      #[test]
    530      fn connection_test() {
    531          let client = crate::client();
    532 @@ -65,39 +71,6 @@ mod tests {
    533          assert!(resp.status().is_success());
    534      }
    535  
    536 -    use reqwest::header::{HeaderValue, CONTENT_TYPE};
    537 -    use serde::{Deserialize, Serialize};
    538 -
    539 -    #[derive(Clone, Serialize, Deserialize, Debug, Default)]
    540 -    struct CreateRoomMagic {
    541 -        #[serde(skip_serializing_if = "Option::is_none")]
    542 -        invite: Option<Vec<String>>,
    543 -        #[serde(skip_serializing_if = "Option::is_none")]
    544 -        invite_3pid: Option<Vec<Invite3pid>>,
    545 -        #[serde(skip_serializing_if = "Option::is_none")]
    546 -        is_direct: Option<bool>,
    547 -        #[serde(skip_serializing_if = "Option::is_none")]
    548 -        name: Option<String>,
    549 -        #[serde(skip_serializing_if = "Option::is_none")]
    550 -        preset: Option<String>,
    551 -        #[serde(skip_serializing_if = "Option::is_none")]
    552 -        room_alias_name: Option<String>,
    553 -        #[serde(skip_serializing_if = "Option::is_none")]
    554 -        room_version: Option<String>,
    555 -        #[serde(skip_serializing_if = "Option::is_none")]
    556 -        topic: Option<String>,
    557 -        #[serde(skip_serializing_if = "Option::is_none")]
    558 -        visibility: Option<String>,
    559 -    }
    560 -
    561 -    #[derive(Clone, Serialize, Deserialize, Debug, Default)]
    562 -    struct Invite3pid {
    563 -        address: String,
    564 -        id_access_token: String,
    565 -        id_server: String,
    566 -        medium: String,
    567 -    }
    568 -
    569      #[test]
    570      fn null_in_room() {
    571          let content = CreateRoomMagic {
    572 @@ -139,39 +112,7 @@ mod tests {
    573  
    574  #[cfg(all(fuzzing, test))]
    575  mod tests {
    576 -    use fuzzcheck::DefaultMutator;
    577 -    use serde::{Deserialize, Serialize};
    578 -
    579 -    #[derive(Clone, DefaultMutator, Serialize, Deserialize, Debug)]
    580 -    struct CreateRoomMagic {
    581 -        #[serde(skip_serializing_if = "Option::is_none")]
    582 -        invite: Option<Vec<String>>,
    583 -        // Due to https://github.com/matrix-org/synapse/issues/13512
    584 -        //#[serde(skip_serializing_if = "Option::is_none")]
    585 -        //invite_3pid: Option<Vec<Invite3pid>>,
    586 -        #[serde(skip_serializing_if = "Option::is_none")]
    587 -        is_direct: Option<bool>,
    588 -        #[serde(skip_serializing_if = "Option::is_none")]
    589 -        name: Option<String>,
    590 -        #[serde(skip_serializing_if = "Option::is_none")]
    591 -        preset: Option<String>,
    592 -        #[serde(skip_serializing_if = "Option::is_none")]
    593 -        room_alias_name: Option<String>,
    594 -        #[serde(skip_serializing_if = "Option::is_none")]
    595 -        room_version: Option<String>,
    596 -        #[serde(skip_serializing_if = "Option::is_none")]
    597 -        topic: Option<String>,
    598 -        #[serde(skip_serializing_if = "Option::is_none")]
    599 -        visibility: Option<String>,
    600 -    }
    601 -
    602 -    #[derive(Clone, DefaultMutator, Serialize, Deserialize, Debug)]
    603 -    struct Invite3pid {
    604 -        address: String,
    605 -        id_access_token: String,
    606 -        id_server: String,
    607 -        medium: String,
    608 -    }
    609 +    use crate::types::{CreateRoomMagic, CreateRoomMagicJSON};
    610  
    611      fn create_room(data: &CreateRoomMagic) -> bool {
    612          // FIXME: We probably should set it to null and not do a false positive
    613 @@ -193,10 +134,11 @@ mod tests {
    614          // TODO: Login once and reuse the access token
    615          let access_token = crate::access_token();
    616          let client = crate::client();
    617 +        let json_data: CreateRoomMagicJSON = data.into();
    618          let resp = client
    619              .post("http://localhost:8008/_matrix/client/v3/createRoom")
    620              .header("Authorization", format!("Bearer {}", access_token))
    621 -            .json(data)
    622 +            .json(&json_data)
    623              .send();
    624          if let Ok(resp) = resp {
    625              let status = resp.status().clone();
    626 @@ -230,13 +172,11 @@ mod tests {
    627          if !resp.status().is_success() {
    628              panic!("Failed to connect");
    629          }
    630 +
    631          let result = fuzzcheck::fuzz_test(create_room)
    632              .default_options()
    633              .stop_after_first_test_failure(true)
    634              .launch();
    635 -        if result.found_test_failure {
    636 -            println!("{:?}", result.reason_for_stopping);
    637 -        }
    638          assert!(!result.found_test_failure);
    639      }
    640  }
    641 diff --git a/src/types.rs b/src/types.rs
    642 index b0f459f..77a9c9c 100644
    643 --- a/src/types.rs
    644 +++ b/src/types.rs
    645 @@ -1,19 +1,121 @@
    646 -use serde::{Deserialize, Serialize};
    647 -
    648 -#[derive(Debug, Serialize, Deserialize)]
    649 -pub struct LoginGet {
    650 -    pub flows: Vec<Flow>,
    651 -}
    652 -
    653 -#[derive(Debug, Serialize, Deserialize, PartialEq, Eq)]
    654 -pub struct Flow {
    655 -    #[serde(rename = "type")]
    656 -    pub type_: String,
    657 -}
    658 -
    659 -#[derive(Debug, Serialize, Deserialize)]
    660 -pub struct LoginPost {
    661 -    pub user_id: String,
    662 -    pub access_token: String,
    663 -    pub home_server: String,
    664 -}
    665 +use fuzzcheck::DefaultMutator;
    666 +use serde::{Deserialize, Serialize};
    667 +use std::collections::HashMap;
    668 +
    669 +#[derive(Debug, Serialize, Deserialize)]
    670 +pub struct LoginGet {
    671 +    pub flows: Vec<Flow>,
    672 +}
    673 +
    674 +#[derive(Debug, Serialize, Deserialize, PartialEq, Eq)]
    675 +pub struct Flow {
    676 +    #[serde(rename = "type")]
    677 +    pub type_: String,
    678 +}
    679 +
    680 +#[derive(Debug, Serialize, Deserialize)]
    681 +pub struct LoginPost {
    682 +    pub user_id: String,
    683 +    pub access_token: String,
    684 +    pub home_server: String,
    685 +}
    686 +
    687 +#[derive(Clone, Serialize, Deserialize, Debug, Default)]
    688 +pub struct CreateRoomMagicJSON {
    689 +    #[serde(skip_serializing_if = "Option::is_none")]
    690 +    pub creation_content: Option<HashMap<String, String>>,
    691 +    #[serde(skip_serializing_if = "Option::is_none")]
    692 +    pub invite: Option<Vec<String>>,
    693 +    // Due to https://github.com/matrix-org/synapse/issues/13512
    694 +    //#[serde(skip_serializing_if = "Option::is_none")]
    695 +    //pub invite_3pid: Option<Vec<Invite3pid>>,
    696 +    #[serde(skip_serializing_if = "Option::is_none")]
    697 +    pub is_direct: Option<bool>,
    698 +    #[serde(skip_serializing_if = "Option::is_none")]
    699 +    pub name: Option<String>,
    700 +    #[serde(skip_serializing_if = "Option::is_none")]
    701 +    pub preset: Option<String>,
    702 +    #[serde(skip_serializing_if = "Option::is_none")]
    703 +    pub room_alias_name: Option<String>,
    704 +    #[serde(skip_serializing_if = "Option::is_none")]
    705 +    pub room_version: Option<String>,
    706 +    #[serde(skip_serializing_if = "Option::is_none")]
    707 +    pub topic: Option<String>,
    708 +    #[serde(skip_serializing_if = "Option::is_none")]
    709 +    pub visibility: Option<String>,
    710 +}
    711 +
    712 +// FIXME: This is stupid hacky.
    713 +impl From<&CreateRoomMagic> for CreateRoomMagicJSON {
    714 +    fn from(item: &CreateRoomMagic) -> Self {
    715 +        let mut creation_content = HashMap::new();
    716 +        if let Some(mut creation_content_keys) = item.creation_content_keys.clone() {
    717 +            if let Some(mut creation_content_values) = item.creation_content_values.clone() {
    718 +                if creation_content_keys.len() > creation_content_values.len() {
    719 +                    creation_content_keys.truncate(creation_content_values.len());
    720 +                } else {
    721 +                    creation_content_values.truncate(creation_content_keys.len());
    722 +                }
    723 +                for (key, value) in creation_content_keys
    724 +                    .iter()
    725 +                    .zip(creation_content_values.iter())
    726 +                {
    727 +                    creation_content.insert(key.to_string(), value.to_string());
    728 +                }
    729 +            }
    730 +        }
    731 +
    732 +        CreateRoomMagicJSON {
    733 +            invite: item.invite.clone(),
    734 +            is_direct: item.is_direct,
    735 +            name: item.name.clone(),
    736 +            preset: item.preset.clone(),
    737 +            room_alias_name: item.room_alias_name.clone(),
    738 +            room_version: item.room_version.clone(),
    739 +            topic: item.topic.clone(),
    740 +            visibility: item.visibility.clone(),
    741 +            creation_content: if item.creation_content_keys.is_none()
    742 +                || item.creation_content_values.is_none()
    743 +            {
    744 +                None
    745 +            } else {
    746 +                Some(creation_content)
    747 +            },
    748 +        }
    749 +    }
    750 +}
    751 +
    752 +#[derive(Clone, Serialize, Deserialize, Debug, Default, DefaultMutator)]
    753 +pub struct CreateRoomMagic {
    754 +    #[serde(skip_serializing_if = "Option::is_none")]
    755 +    pub creation_content_keys: Option<Vec<String>>,
    756 +    #[serde(skip_serializing_if = "Option::is_none")]
    757 +    pub creation_content_values: Option<Vec<String>>,
    758 +    #[serde(skip_serializing_if = "Option::is_none")]
    759 +    pub invite: Option<Vec<String>>,
    760 +    // Due to https://github.com/matrix-org/synapse/issues/13512
    761 +    //#[serde(skip_serializing_if = "Option::is_none")]
    762 +    //pub invite_3pid: Option<Vec<Invite3pid>>,
    763 +    #[serde(skip_serializing_if = "Option::is_none")]
    764 +    pub is_direct: Option<bool>,
    765 +    #[serde(skip_serializing_if = "Option::is_none")]
    766 +    pub name: Option<String>,
    767 +    #[serde(skip_serializing_if = "Option::is_none")]
    768 +    pub preset: Option<String>,
    769 +    #[serde(skip_serializing_if = "Option::is_none")]
    770 +    pub room_alias_name: Option<String>,
    771 +    #[serde(skip_serializing_if = "Option::is_none")]
    772 +    pub room_version: Option<String>,
    773 +    #[serde(skip_serializing_if = "Option::is_none")]
    774 +    pub topic: Option<String>,
    775 +    #[serde(skip_serializing_if = "Option::is_none")]
    776 +    pub visibility: Option<String>,
    777 +}
    778 +
    779 +#[derive(Clone, Serialize, Deserialize, Debug, DefaultMutator, Default)]
    780 +pub struct Invite3pid {
    781 +    pub address: String,
    782 +    pub id_access_token: String,
    783 +    pub id_server: String,
    784 +    pub medium: String,
    785 +}