fuzz: add parser harnesses for raw requests & templates

[dwisiswant0]

Proposed changes

Add go-fuzz harnesses for raw request and template
parsing.

The new coverage exercises input raw request
parsing, HTTP raw request parsing across safe and
unsafe modes, and YAML/JSON template parsing with
lightweight compile-time validation. Seed corpora
cover common ingestion shapes, host reconstruction,
full URL paths, empty path automerge, relative
query paths, and raw HTTP template requests.

Part of #7312

Proof

Checklist

• Pull request is created against the dev branch
• All checks passed (lint, unit/integration/regression tests etc.) with my changes
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation (if appropriate)

Summary by CodeRabbit

• New Features

  • Added fuzzing entrypoints to exercise parsing across templates, HTTP raw handling, and input types.

• Tests

  • Added comprehensive fuzz-harness test suites validating parsing, oversize-rejection, and seed-corpus coverage.
  • Added multiple fuzz seed corpus entries covering GET/POST/PUT, JSON/form bodies, headers, and URL variations.

• Chores

  • Introduced fuzzing harnesses and infrastructure across core modules to improve input-validation testing.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 94a59530-baa0-4260-b48e-ab27e59d2d1e

📥 Commits

Reviewing files that changed from the base of the PR and between 011f63e and 59a9bd4.

📒 Files selected for processing (3)

• pkg/input/types/fuzz_harness_test.go
• pkg/protocols/http/raw/fuzz_harness_test.go
• pkg/templates/fuzz_harness.go

🚧 Files skipped from review as they are similar to previous changes (3)

• pkg/input/types/fuzz_harness_test.go
• pkg/protocols/http/raw/fuzz_harness_test.go
• pkg/templates/fuzz_harness.go

---

Walkthrough

Adds gofuzz entrypoints, harnesses, normalization helpers, corpus seeds, and harness tests to exercise parsing for input/types (HTTP requests), protocols/http/raw, and templates.

Changes

Input Types HTTP Request Fuzzing

Layer / File(s)	Summary
Fuzz entrypoint and harness constants pkg/input/types/fuzz.go, pkg/input/types/fuzz_harness.go	Defines gofuzz Fuzz, input bounds, candidate structs and selection pools.
Request candidate construction and parsing orchestration pkg/input/types/fuzz_harness.go	Builds/overrides request candidate from fuzz bytes, renders HTTP/1.1 request text, and invokes Parse/ParseRawRequest variants.
Token and value normalization utilities pkg/input/types/fuzz_harness.go	Normalization and sanitization for method, path, URL, host, headers, and body with bounded lengths.
Tests and seed corpus pkg/input/types/fuzz_harness_test.go, pkg/input/types/testdata/gofuzz-corpus/*	Seed-driven tests validating decode/parse/exercise paths and oversize-input rejection.

Raw HTTP Protocol Fuzzing

Layer / File(s)	Summary
Fuzz entrypoint and harness constants pkg/protocols/http/raw/fuzz.go, pkg/protocols/http/raw/fuzz_harness.go	Adds gofuzz Fuzz, size/shape constants, unsafe/automerge flags, and candidate types.
Raw request candidate building and multi-mode parsing pkg/protocols/http/raw/fuzz_harness.go	Constructs candidates, applies KV directives, toggles modes, and runs Parse and ParseRawRequest paths (plus alternate raw-like path).
Request detection and token normalization pkg/protocols/http/raw/fuzz_harness.go	Heuristics to detect raw-request-like bytes, directive splitting, and normalization for methods, paths, URLs, hosts, headers, and bodies.
Tests and seed corpus pkg/protocols/http/raw/fuzz_harness_test.go, pkg/protocols/http/raw/testdata/gofuzz-corpus/*	Seed-driven tests for decoding, URL parsing, parser invocation, and oversize rejection; adds multiple raw HTTP seed inputs.

Template Fuzzing

Layer / File(s)	Summary
Fuzz entrypoint and harness constants pkg/templates/fuzz.go, pkg/templates/fuzz_harness.go	Adds gofuzz Fuzz, input/value bounds, candidate pools, and a sentinel for disabled helper loading.
Fuzz template candidate construction and mutation pkg/templates/fuzz_harness.go	Derives template candidates from bytes, applies line-based KV mutations, and seeds defaults from deterministic bytes.
Template parsing and serialization pkg/templates/fuzz_harness.go	YAML/JSON parse-and-compile exercise paths, strict parse helpers, and serialization of fuzz candidates (raw vs method/path).
Executor options and template exercise helpers pkg/templates/fuzz_harness.go	Provides parsed-template exercises, executor options with helper-file loading disabled, and normalization utilities.
Tests and seed corpus pkg/templates/fuzz_harness_test.go, pkg/templates/testdata/gofuzz-corpus/*	Seed-driven tests asserting serialization/parsing/compile success, oversize rejection, and helper-file-disabled behavior.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Suggested reviewers

• Mzack9999
• dogancanbakir

"🐰 I nibble bytes and stitch a test,
fuzzed requests hop from east to west,
templates and raw paths twist and play,
seed the corpus, let parsers sway,
a tiny rabbit cheers the fuzzing way!"

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 2.94% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: adding fuzzing harnesses for parsers that handle raw requests and templates.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dwisiswant0/fuzz/add-parser-harnesses-for-raw-requests-templates

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[daviediao-code]

Reviewed this PR.

Assessment: Implementation looks solid and follows project conventions. Clean code quality.

Approved ✅