Subject: [fdt] Fwd: Fuzzing Structured Fields from ABNF

From: Carsten Bormann <[email-masked]>
Date: Thu, 9 Jul 2020 13:26:01 +0200

The answer is yes, as well as for anything else based on an FDT…

Grüße, Carsten

> Begin forwarded message:
> 
> From: Mark Nottingham <[email-masked]>
> Subject: Fuzzing Structured Fields from ABNF
> Date: 2020-07-09 at 13:15:21 CEST
> To: HTTP Working Group <[email-masked]>
> Resent-From: [email-masked]
> Archived-At: <https://www.w3.org/mid/[email-masked]>
> 
> Kate, one of my colleagues, pointed out that one of the wonderful tools she's created:
>  https://github.com/katef/kgt
> ... can be used to create input for blab from ABNF:
>  https://gitlab.com/akihe/blab
> ... which can in turn be used to create values that conform to that ABNF.
> 
> I've put up a slightly modified blab file (with a couple of small tweaks, including one to remove generated base64, since it's so rarely actual base64):
>  https://gist.github.com/mnot/06deaeadab6616929a59d687ca7dff25
> 
> This can be used to check your parser to see if it can handle the (hopefully valid) input. In the case of my parser:
>  https://pypi.org/project/http-sfv/
> 
> It looks like this:
> 
> blab -l . -e "structured-fields.sf-dictionary" | python3 -m http_sfv --dictionary --stdin
> blab -l . -e "structured-fields.sf-list" | python3 -m http_sfv --list --stdin
> blab -l . -e "structured-fields.sf-item" | python3 -m http_sfv --item --stdin
> 
> (with http_sfv installed from source; I'll release a new version that does --stdin shortly).
> 
> Just thought this might be helpful for some implementers. I'll sleep a bit better knowing that the ABNF does indeed appear to produce correct output...
> 
> Cheers,
> 
> 
> P.S. Should we do the same with http-core ABNF?
> 
> --
> Mark Nottingham   https://www.mnot.net/
> 
>