Skip to main content
The Palyra fuzzing harness provides a suite of automated testing targets designed to identify memory safety issues, panics, and logic vulnerabilities in critical parsing and data-processing routines. The harness is located in the fuzz/ directory and utilizes libfuzzer-sys to perform coverage-guided fuzzing against various system components.

​
Overview of Fuzz Targets

Palyra implements nine distinct fuzz targets, each targeting a specific entry point where untrusted or complex data enters the system.
Target NameTarget ComponentDescription
config_path_parserpalyra-commonValidates TOML configuration path resolution and migration logic.
a2ui_json_parserpalyra-a2uiFuzzes the JSON-to-UI patch protocol and Canvas rendering instructions.
webhook_payload_parserpalyra-connectorsTests inbound webhook parsing for Discord, Slack, and Telegram.
workspace_patch_parserpalyra-commonValidates the safety of apply_workspace_patch against malicious diffs.
process_runner_input_parserpalyra-commonFuzzes the ProcessRunnerToolInput JSON deserializer.
auth_profile_registry_parserpalyra-authTests the registry that manages identity and profile persistence.
redaction_routinespalyra-commonEnsures sensitive data markers (tokens/keys) are correctly identified and scrubbed.
channel_payload_validationpalyra-connectorsValidates internal message routing between the daemon and connectors.
webhook_replay_verifierpalyra-connectorsTests the cryptographic signature verification for replayed webhook events.
Sources: fuzz/Cargo.toml#18-80, fuzz/fuzz_targets/workspace_patch_parser.rs#5-8

​
Implementation Details

Fuzz targets are implemented as standalone binaries using the fuzz_target! macro. They typically ingest a raw byte slice (&[u8]) and attempt to exercise a specific library function.

​
Example: Process Runner Input Fuzzing

The process_runner_input_parser target exercises the parse_process_runner_tool_input function crates/palyra-common/src/process_runner_input.rs#26-31. It enforces a maximum input size of 32 KB to prevent excessive memory consumption during the campaign. 
// fuzz/fuzz_targets/process_runner_input_parser.rs
fuzz_target!(|data: &[u8]| {
    if data.len() > MAX_FUZZ_INPUT_BYTES {
        return;
    }
    let _ = parse_process_runner_tool_input(data);
});
Sources: fuzz/fuzz_targets/process_runner_input_parser.rs#1-14, crates/palyra-common/src/process_runner_input.rs#7-17

​
Example: Workspace Patch Fuzzing

The workspace_patch_parser target tests the multi-step process of applying diffs to a filesystem. It uses a OnceLock to create a sandboxed temporary directory for operations fuzz/fuzz_targets/workspace_patch_parser.rs#12-19. The fuzzer passes a WorkspacePatchRequest with dry_run: true to test the logic without side effects while respecting WorkspacePatchLimits fuzz/fuzz_targets/workspace_patch_parser.rs#29-40. Data Flow: Natural Language to Code Entity Space The following diagram illustrates how the fuzzing harness bridges the gap between raw input and the internal palyra-common logic. “Fuzzing Data Flow: Workspace Patching” Sources: fuzz/fuzz_targets/workspace_patch_parser.rs#21-41, crates/palyra-common/src/workspace_patch.rs#1-50

​
Redaction Routine Fuzzing

The redaction_routines target is critical for security, as it ensures that palyra-daemon logs do not leak credentials. It targets palyra-common/src/redaction.rs, specifically testing: Entity Mapping: Redaction Logic “Entity Mapping: Redaction Routine Components” Sources: crates/palyra-common/src/redaction.rs#5-22, crates/palyra-common/src/redaction.rs#49-60, crates/palyra-common/src/redaction.rs#132-158

​
Running Fuzzing Campaigns

​
Prerequisites

Fuzzing requires the Nightly Rust toolchain and the cargo-fuzz sub-command. 
rustup toolchain install nightly
cargo install cargo-fuzz

​
Executing a Target

To run a specific campaign (e.g., the workspace patch parser):
  1. Navigate to the root of the repository.
  2. Run the following command:
cargo +nightly fuzz run workspace_patch_parser

​
Managing Artifacts

When a fuzzer finds a crash, it saves the input to fuzz/artifacts/<target_name>/. These files can be used to reproduce the failure by passing them back to the target: 
cargo +nightly fuzz run workspace_patch_parser fuzz/artifacts/workspace_patch_parser/crash-<hash>
Sources: fuzz/Cargo.toml#1-16, fuzz/Cargo.lock#1-100