Fuzz ignore list generator harness - #7576
Conversation
WalkthroughThe PR adds a generator for embedded fuzzing ignore lists, seed data for headers and cookies, Makefile and ChangesFuzz Ignore Lists
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant Makefile
participant genignorelists
participant Wappalyzer
participant FuzzComponents
Makefile->>genignorelists: regenerate ignorelists.gen.go
genignorelists->>Wappalyzer: load fingerprints when enabled
Wappalyzer-->>genignorelists: provide header and cookie names
genignorelists-->>FuzzComponents: write default ignore sets
FuzzComponents->>FuzzComponents: skip ignored headers and cookies during iteration
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pkg/fuzz/component/cmd/genignorelists/seed_cookies.txt`:
- Around line 9-31: Update the cookie seed entries in seed_cookies.txt to retain
the exact _ga and intercom-session entries while adding the prefix patterns
_ga_* and intercom-session-* for suffixed vendor cookies. Add or update coverage
to verify both exact and suffixed forms are generated.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: b98c12eb-6d8f-4ae6-b04e-e60a2a0394c3
⛔ Files ignored due to path filters (1)
pkg/fuzz/component/ignorelists.gen.gois excluded by!**/*.gen.go
📒 Files selected for processing (9)
Makefilepkg/fuzz/component/cmd/genignorelists/main.gopkg/fuzz/component/cmd/genignorelists/seed_cookies.txtpkg/fuzz/component/cmd/genignorelists/seed_headers.txtpkg/fuzz/component/cookie.gopkg/fuzz/component/cookie_test.gopkg/fuzz/component/generate.gopkg/fuzz/component/headers.gopkg/fuzz/component/headers_test.go
| _ga | ||
| _gat | ||
| _gid | ||
| _gcl_au | ||
| _fbp | ||
| fr | ||
| __hstc | ||
| hubspotutk | ||
| __hssc | ||
| __hssrc | ||
| mp_mixpanel__c | ||
| JSESSIONID | ||
| NREUM | ||
| _pk_id | ||
| _pk_ref | ||
| _pk_ses | ||
| _pk_cvar | ||
| _pk_hsr | ||
| _hjIncludedInSample | ||
| __cfduid | ||
| cf_use_ob | ||
| cf_ob_info | ||
| intercom-session |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Add prefix seed entries for suffixed vendor cookies.
Without a trailing *, these are exact matches, so default generation misses _ga_<container-id> and intercom-session-<app-id>. Keep the exact entries and add _ga_* and intercom-session-*; add coverage for both forms. Google and Intercom document these suffixed cookie names. (developers.google.com)
Proposed seed update
_ga
+_ga_*
...
intercom-session
+intercom-session-*📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| _ga | |
| _gat | |
| _gid | |
| _gcl_au | |
| _fbp | |
| fr | |
| __hstc | |
| hubspotutk | |
| __hssc | |
| __hssrc | |
| mp_mixpanel__c | |
| JSESSIONID | |
| NREUM | |
| _pk_id | |
| _pk_ref | |
| _pk_ses | |
| _pk_cvar | |
| _pk_hsr | |
| _hjIncludedInSample | |
| __cfduid | |
| cf_use_ob | |
| cf_ob_info | |
| intercom-session | |
| _ga | |
| _ga_* | |
| _gat | |
| _gid | |
| _gcl_au | |
| _fbp | |
| fr | |
| __hstc | |
| hubspotutk | |
| __hssc | |
| __hssrc | |
| mp_mixpanel__c | |
| JSESSIONID | |
| NREUM | |
| _pk_id | |
| _pk_ref | |
| _pk_ses | |
| _pk_cvar | |
| _pk_hsr | |
| _hjIncludedInSample | |
| __cfduid | |
| cf_use_ob | |
| cf_ob_info | |
| intercom-session | |
| intercom-session-* |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pkg/fuzz/component/cmd/genignorelists/seed_cookies.txt` around lines 9 - 31,
Update the cookie seed entries in seed_cookies.txt to retain the exact _ga and
intercom-session entries while adding the prefix patterns _ga_* and
intercom-session-* for suffixed vendor cookies. Add or update coverage to verify
both exact and suffixed forms are generated.
dwisiswant0
left a comment
dwisiswant0
left a comment
There was a problem hiding this comment.
Where do the seed_*.txt files come from? We should document the actual source of truth so updating them later doesn’t become a guessing game.
Nit: [once we know that,] it might be cleaner to keep them outside the bin (so, remote) instead of embedding them - and then download on the fly and drop them into the cache dir instead. Easier to refresh without a rebuild.
2 participants
Summary
Summary by CodeRabbit
New Features
Bug Fixes
Tests