feat: fuzz the parsing surface with FsCheck properties and SharpFuzz - #392
Merged
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+56
to
+58
| catch (NumberParseException) | ||
| { | ||
| } |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #392 +/- ##
==========================================
+ Coverage 76.84% 76.89% +0.04%
==========================================
Files 39 39
Lines 4548 4548
Branches 1129 1129
==========================================
+ Hits 3495 3497 +2
+ Misses 796 795 -1
+ Partials 257 256 -1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
📊 Benchmark Results
PR branch
PR base
|
This was referenced Aug 28, 2026
Closed
Open
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds both halves of the fuzzing work from the OpenSSF Scorecard review: property-based tests that
satisfy Scorecard's
Fuzzingcheck, and a real coverage-guided fuzz target for the untrusted-inputsurface named in
SECURITY.md.FsCheck properties
csharp/PhoneNumbers.Test/TestPhoneNumberProperties.csgeneralisesTestPublicApiRobustnessfrom acurated list of hostile strings to generated ones, so the space between the hand-picked cases is
covered and a failure shrinks to a minimal input.
Scorecard detects .NET fuzzing by matching
using FsCheck;/using FsCheck.Xunit;in a.csfile,so this moves that check from 0 to 10. The imports are load-bearing and the file says so, to stop a
later tidy-up silently dropping the score.
Only the
[Property]attribute with primitive parameters is used, with the mapping to phone numbersdone in plain C#. That is stable across FsCheck 2 and 3 and sidesteps the 3.x
FsCheck.Fluentreshuffle. Candidate numbers are built by mutating one digit of a region's example number: wholly
random digits are almost never valid, which would turn the validity-guarded properties into no-ops.
Seven properties assert only that a call fails in a documented way. Three assert real invariants —
E.164 round-trip, valid-implies-possible, and
IsNumberMatchsymmetry — so a failure there is agenuine bug rather than a hostile-input gap.
SharpFuzz target
csharp/PhoneNumbers.Fuzz/is a libFuzzer target driven through the libfuzzer-dotnet bridge, runweekly and on demand by
.github/workflows/fuzz.yml.region-specific parsing and formatting branches.
PhoneNumbers.dllis instrumented; coverage of the harnuld juststeer the fuzzer away from the library.
runners are arm64.
libFuzzer, so
dotnet fuzz-out/PhoneNumbers.Fuzz.dll <crash>The project is deliberately outside
PhoneNumbers.sln: SharpFute IL, andevery PR restores the solution in
--locked-mode.