[nth-bailey]

Closes #11.

Overview

Integrates continuous structure-aware libFuzzer fuzzing, custom XML grammar token dictionary, dynamic configuration exploration, regression test seed corpus, automated nightly AddressSanitizer/UndefinedBehaviorSanitizer CI workflow, and prepared Google OSS-Fuzz integration manifests.

Key Highlights

• XML Syntax Dictionary (fuzz/xml.dict):
  • Populated with syntax delimiters (<, >, />, <![CDATA[, ]]>, <!--, -->).
  • DTD & entity keywords (SYSTEM, PUBLIC, NDATA, EMPTY, ANY, #PCDATA, CDATA, ATTLIST).
  • Namespace declarations and predefined entity tokens.
  • Attack tokens and exponential expansion bomb patterns (file:///, http://, &lol;, %xxe;).
• Structure-Aware Fuzz Target with Dynamic Limits (fuzz/fuzz_targets/fuzz_parser.rs):
  • Dynamically extracts ParseOptions parameters using arbitrary::Unstructured.
  • Explores random combinations of depth limits (1..512), entity sizes, attribute limits (1..1024), name sizes (1..2048), comment sizes, and DTD permission flags.
• Seed Corpus (fuzz/seeds/):
  • Reusable seed inputs including well-formed elements, entity declarations, CDATA blocks, namespaces, and regression test cases.
• Nightly Sanitizer CI Workflow (.github/workflows/fuzz.yml):
  • Scheduled nightly at 02:00 UTC (and manual workflow_dispatch).
  • Executes cargo +nightly fuzz run fuzz_parser with AddressSanitizer (ASan) and the XML dictionary.
  • Automatically uploads crash and timeout artifacts on failure.
• Google OSS-Fuzz Manifests (oss-fuzz/):
  • Created oss-fuzz/project.yaml, oss-fuzz/Dockerfile, oss-fuzz/build.sh, and oss-fuzz/README.md ready for upstream submission to Google OSS-Fuzz.
• Documentation & Invariants:
  • Documented in README.md.
  • Pre-commit and pre-push hooks cleanly passed; Python test coverage remains strictly at 100.00%.