class Crowbar::Mutators::Security

Overview

Parser boundary validation mutator. Tests parser resilience against boundary anomalies, format specifiers, path normalization, null-byte termination, delimiter escapes, and numeric extremes. Inspired by Radamsa's 'ab' ("bad ascii") mutator, framed for input validation QA.

Defined in:

crowbar/mutators/security.cr

Constant Summary

VECTORS = ["%s", "%d", "%x", "%p", "%n", "%s%s%s%s%s", "%08x", "%#010x", "%9999999s", "%.1024d", "%2$s", "%1$n", "../", "..\\", "../../../etc/passwd", "..\\..\\..\\Windows\\System32", "....//", "....\\\\", "/...", "\\...", "/./", "\\.\\", "\u0000", "\u0000\u0000\u0000\u0000", "test\u0000.bin", "%00", "\\0", "\\x00", "\"", "'", "`", "\\", "/", ";", "|", "&", "&&", "||", "--", "/*", "*/", "-->", "<script>", "\r\n\r\n", "-1", "0", "1", "2147483647", "-2147483648", "4294967295", "9223372036854775807", "-9223372036854775808", "18446744073709551615", "NaN", "Infinity", "-Infinity", "1e309", "-1e309", "%20", "%2e%2e%2f", "%u0000", "%c0%ae%c0%ae%c0%af", "A" * 256, "A" * 1024, "\xFF" * 64]

Curated boundary vectors for robust parser validation

Instance Method Summary

Instance methods inherited from class Crowbar::Mutator

adjust_score(delta : Int32) adjust_score, aliases : Array(String) aliases, description : String description, effective_weight : Float64 effective_weight, mutate(context : Context, buffer : Buffer, target_range : Tuple(Int32, Int32) | Nil = nil) : Tuple(Bool, Int32) mutate, name : String name, score : Int32 score, score=(score : Int32) score=, weight : Float64 weight, weight=(weight : Float64) weight=

Constructor methods inherited from class Crowbar::Mutator

new(weight : Float64 = 1.0) new

Instance Method Detail

def aliases : Array(String) #
Description copied from class Crowbar::Mutator

Optional short aliases or alternative identifiers (e.g. ["fuse", "ft", "fn"])


def description : String #

def mutate(context : Context, buffer : Buffer, target_range : Tuple(Int32, Int32) | Nil = nil) : Tuple(Bool, Int32) #

def name : String #