feat: initial goget release — modern IPv6-first download utility

internal/hsts/fuzz_test.go

@@ -0,0 +1,52 @@
+//go:build linux || freebsd
+// +build linux freebsd
+
+package hsts
+
+import (
+	"encoding/json"
+	"os"
+	"testing"
+)
+
+// FuzzHSTSParseHeader tests HSTS header parsing with fuzzed input.
+func FuzzHSTSParseHeader(f *testing.F) {
+	f.Add("max-age=31536000")
+	f.Add("max-age=31536000; includeSubDomains")
+	f.Add("max-age=0")
+	f.Add("")
+	f.Add("invalid")
+	f.Add("max-age=abc")
+	f.Add("max-age=31536000; includeSubDomains; preload")
+	f.Add("MAX-AGE=31536000")
+
+	f.Fuzz(func(t *testing.T, header string) {
+		_, _ = parseHeader(header)
+	})
+}
+
+// FuzzHSTSLoadSave tests loading and saving HSTS cache with fuzzed data.
+func FuzzHSTSLoadSave(f *testing.F) {
+	f.Add([]byte(`{}`))
+	f.Add([]byte(`{"example.com":{"maxAge":31536000,"includeSubDomains":true,"expires":"2026-01-01T00:00:00Z"}}`))
+	f.Add([]byte(`{invalid`))
+
+	f.Fuzz(func(t *testing.T, data []byte) {
+		cache := &Cache{
+			entries: make(map[string]*Entry),
+			path:    t.TempDir() + "/fuzz-hsts.json",
+		}
+
+		// Try loading fuzzed JSON
+		_ = json.Unmarshal(data, &cache.entries)
+
+		// Save to file must not panic
+		tmp := t.TempDir() + "/fuzz-hsts"
+		_ = os.WriteFile(tmp, data, 0644)
+		err := cache.Load(tmp)
+		if err == nil {
+			_ = cache.Save()
+		}
+		os.Remove(tmp)
+	})
+}