fuzz: add coverage for GetQueryParameterFromUri #35964

1. 
   laxmanacharya8 commented at 4:46 PM on August 13, 2026: contributor

   GetQueryParameterFromUri() parses the query string of a request target supplied by a remote client. It is reached from the REST interface for the count, offset, size, verbose and mempool_sequence parameters, but had no fuzz coverage.

   This adds an http_query_parameter target. Besides running the parser on arbitrary input, it round-trips a URL-encoded key/value pair back through it and checks the cases that are easy to get wrong:

   • a parameter with no =, which is an empty value rather than a missing one
   • a repeated key, where the first occurrence wins
   • a key that occurs both before and after a #, where the parser must return the value found before the # and ignore the later occurrence, since everything from the fragment separator onwards is not part of the query string

   Testing

   Built the fuzz binary and ran the new target against a temporary corpus directory, capped at 10,000 executions:

   FUZZ=http_query_parameter build_fuzz/bin/fuzz /tmp/corpus_http_query_parameter -runs=10000

2. DrahtBot added the label Fuzzing on Aug 13, 2026
3. 
   DrahtBot commented at 4:47 PM on August 13, 2026: contributor

   <!--e57a25ab6845829454e8d69fc972939a-->

   The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

   <!--006a51241073e994b41acfe9ec718e94-->

   Code Coverage & Benchmarks

   For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/35964.

   <!--021abf342d371248e50ceaed478a90ca-->

   Reviews

   See the guideline and AI policy for information on the review process.

   Type	Reviewers
   ACK	nervana21

   If your review is incorrectly listed, please copy-paste <code>&lt;!--meta-tag:bot-skip--&gt;</code> into the comment that the bot should ignore.

   <!--174a7506f384e20aa4161008e828411d-->

   Conflicts

   Reviewers, this pull request conflicts with the following ones:

   • #36135 (fuzz: test HTTPRequest state machine in http_request by frankomosh)

   If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first.

   <!--5faf32d7da4f0f540f40219e4f7537a3-->

4. in src/test/fuzz/http_request.cpp:72 in ec1f8dca31 outdated

     66 | @@ -66,3 +67,23 @@ FUZZ_TARGET(http_request)
     67 |          assert(body.empty());
     68 |      }
     69 |  }
     70 | +
     71 | +FUZZ_TARGET(http_query_parameter)
     72 | +{
   

   ---

   ---

   

   nervana21 commented at 6:26 PM on August 14, 2026:

   ec1f8dca31238b7a5c97afc88332b27f026ab588: fuzz: add coverage for GetQueryParameterFromUri

   nit: Prefer matching the style of the above and using the shortened path names.

   {
      using http_bitcoin::GetQueryParameterFromUri;
   

5. in src/test/fuzz/http_request.cpp:88 in ec1f8dca31

     83 | +    const std::string encoded_value{UrlEncode(value)};
     84 | +    const std::string query_uri{"/endpoint?" + encoded_key + "=" + encoded_value};
     85 | +    assert(http_bitcoin::GetQueryParameterFromUri(query_uri, key) == value);
     86 | +    assert(http_bitcoin::GetQueryParameterFromUri("/endpoint?" + encoded_key, key) == "");
     87 | +    assert(http_bitcoin::GetQueryParameterFromUri(query_uri + "&" + encoded_key + "=ignored", key) == value);
     88 | +    assert(http_bitcoin::GetQueryParameterFromUri(query_uri + "#?" + encoded_key + "=ignored", key) == value);
   

   ---

   ---

   

   nervana21 commented at 6:40 PM on August 14, 2026:

   ec1f8dca31238b7a5c97afc88332b27f026ab588: fuzz: add coverage for GetQueryParameterFromUri

   The PR text states that this proves we "ignore the later occurrence" after #. However, because an identical key name sits before #, the first match wins and treating # like & still passes. In order to prove that statement, I think we need a lookup whose key exists only after #.

   The ? character must precede # and the dummy name cannot match key name.

       assert(http_bitcoin::GetQueryParameterFromUri(query_uri + "#?" + encoded_key + "=ignored", key) == value);
       // First '?' must precede '#', and this name must not be key.
       const std::string dummy{key == "n" ? "m" : "n"};
       assert(!GetQueryParameterFromUri("/endpoint?" + dummy + "=1#?" + encoded_key + "=" + encoded_value, key));
   

6. 
   nervana21 commented at 6:42 PM on August 14, 2026: contributor

   Concept ACK

   Left a few minor suggestions. Please let me know what you think

7. fuzz: add coverage for GetQueryParameterFromUri

   GetQueryParameterFromUri() parses the query string of a request target
   supplied by a remote client. It is reached from the REST interface for
   the "count", "offset", "size", "verbose" and "mempool_sequence"
   parameters, but had no fuzz coverage.

   a7ecf9c83c
8. laxmanacharya8 force-pushed on Aug 15, 2026
9. laxmanacharya8 requested review from nervana21 on Aug 15, 2026
10. 
    nervana21 commented at 10:46 PM on August 15, 2026: contributor

    tACK a7ecf9c83c60622b6af9b3c992099170dd15033a

11. DrahtBot added the label CI failed on Aug 17, 2026
12. DrahtBot removed the label CI failed on Aug 17, 2026
13. laxmanacharya8 requested review from nervana21 on Aug 22, 2026

Review Requested
nervana21