content/browser/appcache/appcache_fuzzer.proto

// Copyright 2018 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

syntax = "proto2";

package content.fuzzing.proto;

message Session {
  repeated Command commands = 1;
}

// Based on content::AppCacheBackend interface
// See content/common/appcache_interfaces.h
message Command {
  oneof command {
    RegisterHost register_host = 1;
    UnregisterHost unregister_host = 2;
    SelectCache select_cache = 3;
    SetSpawningHostId set_spawning_host_id = 4;
    SelectCacheForSharedWorker select_cache_for_shared_worker = 5;
    MarkAsForeignEntry mark_as_foreign_entry = 6;
    GetStatus get_status = 7;
    StartUpdate start_update = 8;
    SwapCache swap_cache = 9;
    GetResourceList get_resource_list = 10;
    DoRequest do_request = 11;
    RunUntilIdle run_until_idle = 12;
  }
}

// We only need a few hosts to encapsulate all the logic
enum HostId {
  HOST_N2 = -2;
  HOST_N1 = -1;
  HOST_0 = 0;
  HOST_1 = 1;
  HOST_2 = 2;
}

// Caches are created more quickly so we want more of them
enum CacheId {
  CACHE_N1 = -1;
  CACHE_0 = 0;
  CACHE_1 = 1;
  CACHE_2 = 2;
  CACHE_3 = 3;
  CACHE_4 = 4;
  CACHE_5 = 5;
  CACHE_6 = 6;
  CACHE_7 = 7;
  CACHE_8 = 8;
  CACHE_9 = 9;
}

message RegisterHost {
  required HostId host_id = 1;
}

message UnregisterHost {
  required HostId host_id = 1;
}

message SelectCache {
  required HostId host_id = 1;
  required HostId from_id = 2;
  required Url document_url = 3;
  required Url opt_manifest_url = 4;
}

enum HttpCode {
  RESPONSE_100 = 100;
  RESPONSE_200 = 200;
  RESPONSE_206 = 206;
  RESPONSE_301 = 301;
  RESPONSE_302 = 302;
  RESPONSE_303 = 303;
  RESPONSE_304 = 304;
  RESPONSE_307 = 307;
  RESPONSE_308 = 308;
  RESPONSE_401 = 401;
  RESPONSE_403 = 403;
  RESPONSE_404 = 404;
  RESPONSE_500 = 500;
  RESPONSE_501 = 501;
}

message DoRequest {
  required HttpCode http_code = 1;
  required bool do_not_cache = 2;
  required ManifestResponse manifest_response = 3;
  required Url url = 4;
}

message ManifestResponse {
  repeated Url urls = 1;
}

// Make sure to test logic when fetching more than the max concurrent allowed.
enum UrlTestCaseIndex {
  EMPTY = 0;
  PATH_1 = 1;
  PATH_2 = 2;
  PATH_3 = 3;
  PATH_4 = 4;
  PATH_5 = 5;
}

// In order to efficiently fuzz the appcache logic, we don't want
// to worry about all the possible url parsing. For this reason,
// we generate either an empty GURL or one of up to 5 paths,
// http://localhost/[1-5]. We can update this if in the future
// more coverage can be achieved.
// We represent this with a UrlTestCaseIndex enum. The 0 value is
// a special case representing an empty string or GURL().
// If not empty, we just append the int value of the UrlTestCaseIndex
// enum to "http://localhost/". Using an enum in this way makes
// mutations more efficient.
message Url {
  required UrlTestCaseIndex url_test_case_idx = 1;
}

message RunUntilIdle {}

message SetSpawningHostId {
  required HostId host_id = 1;
  required HostId spawning_host_id = 2;
}

message SelectCacheForSharedWorker {
  required HostId host_id = 1;
  required CacheId cache_document_was_loaded_from = 2;
}

message MarkAsForeignEntry {
  required HostId host_id = 1;
  required Url document_url = 2;
  required CacheId cache_document_was_loaded_from = 3;
}

message GetStatus {
  required HostId host_id = 1;
}

message StartUpdate {
  required HostId host_id = 1;
}

message SwapCache {
  required HostId host_id = 1;
}

message GetResourceList {
  required HostId host_id = 1;
}