fuzz: add coverage for GetQueryParameterFromUri #35964

pull laxmanacharya8 wants to merge 1 commits into bitcoin:master from laxmanacharya8:fuzz-query-parameter changing 1 files +27 −0

laxmanacharya8 commented at 4:46 PM on August 13, 2026: none
GetQueryParameterFromUri() parses the query string of a request target supplied by a remote client. It is reached from the REST interface for the count, offset, size, verbose and mempool_sequence parameters, but had no fuzz coverage.

This adds an http_query_parameter target. Besides running the parser on arbitrary input, it round-trips a URL-encoded key/value pair back through it and checks the cases that are easy to get wrong:
- a parameter with no =, which is an empty value rather than a missing one
- a repeated key, where the first occurrence wins
- a key that occurs both before and after a #, where the parser must return the value found before the # and ignore the later occurrence, since everything from the fragment separator onwards is not part of the query string
Testing

Built the fuzz binary and ran the new target against a temporary corpus directory, capped at 10,000 executions:
```
FUZZ=http_query_parameter build_fuzz/bin/fuzz /tmp/corpus_http_query_parameter -runs=10000
```
DrahtBot added the label Fuzzing on Aug 13, 2026
DrahtBot commented at 4:47 PM on August 13, 2026: contributor



The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.



Code Coverage & Benchmarks

For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/35964.



Reviews

See the guideline and AI policy for information on the review process.

Type Reviewers

ACK nervana21

If your review is incorrectly listed, please copy-paste <code></code> into the comment that the bot should ignore.
in src/test/fuzz/http_request.cpp:72 in ec1f8dca31 outdated
```
  66 | @@ -66,3 +67,23 @@ FUZZ_TARGET(http_request)
  67 |          assert(body.empty());
  68 |      }
  69 |  }
  70 | +
  71 | +FUZZ_TARGET(http_query_parameter)
  72 | +{
```
nervana21 commented at 6:26 PM on August 14, 2026:

ec1f8dca31238b7a5c97afc88332b27f026ab588: fuzz: add coverage for GetQueryParameterFromUri

nit: Prefer matching the style of the above and using the shortened path names.

{ using http_bitcoin::GetQueryParameterFromUri;

Type	Reviewers
ACK	nervana21

in src/test/fuzz/http_request.cpp:88 in ec1f8dca31

  83 | +    const std::string encoded_value{UrlEncode(value)};
  84 | +    const std::string query_uri{"/endpoint?" + encoded_key + "=" + encoded_value};
  85 | +    assert(http_bitcoin::GetQueryParameterFromUri(query_uri, key) == value);
  86 | +    assert(http_bitcoin::GetQueryParameterFromUri("/endpoint?" + encoded_key, key) == "");
  87 | +    assert(http_bitcoin::GetQueryParameterFromUri(query_uri + "&" + encoded_key + "=ignored", key) == value);
  88 | +    assert(http_bitcoin::GetQueryParameterFromUri(query_uri + "#?" + encoded_key + "=ignored", key) == value);

nervana21 commented at 6:40 PM on August 14, 2026:

ec1f8dca31238b7a5c97afc88332b27f026ab588: fuzz: add coverage for GetQueryParameterFromUri

The PR text states that this proves we "ignore the later occurrence" after #. However, because an identical key name sits before #, the first match wins and treating # like & still passes. In order to prove that statement, I think we need a lookup whose key exists only after #.

The ? character must precede # and the dummy name cannot match key name.

    assert(http_bitcoin::GetQueryParameterFromUri(query_uri + "#?" + encoded_key + "=ignored", key) == value);
    // First '?' must precede '#', and this name must not be key.
    const std::string dummy{key == "n" ? "m" : "n"};
    assert(!GetQueryParameterFromUri("/endpoint?" + dummy + "=1#?" + encoded_key + "=" + encoded_value, key));

nervana21 commented at 6:42 PM on August 14, 2026: contributor

Concept ACK

Left a few minor suggestions. Please let me know what you think

fuzz: add coverage for GetQueryParameterFromUri

GetQueryParameterFromUri() parses the query string of a request target
supplied by a remote client. It is reached from the REST interface for
the "count", "offset", "size", "verbose" and "mempool_sequence"
parameters, but had no fuzz coverage.

a7ecf9c83c

laxmanacharya8 force-pushed on Aug 15, 2026
laxmanacharya8 requested review from nervana21 on Aug 15, 2026
nervana21 commented at 10:46 PM on August 15, 2026: contributor

tACK a7ecf9c83c60622b6af9b3c992099170dd15033a
DrahtBot added the label CI failed on Aug 17, 2026
DrahtBot removed the label CI failed on Aug 17, 2026

Contributors

Labels

fuzz: add coverage for GetQueryParameterFromUri #35964

Testing

Code Coverage & Benchmarks

Reviews