From 8c5fd6aa08cdae5daa3a2d6693b2ca1e0dbf1dff Mon Sep 17 00:00:00 2001
From: Arthur Chan <arthur.chan@adalogics.com>
Date: Fri, 13 Nov 2026 09:47:26 +0800
Subject: [PATCH] OSS-Fuzz: Improve url_parser_fuzzer with more cases (#2664)

Add cases for relative location resolution, dot segment removal, URI encoding and decoding, and filename sanitization.
---
 test/fuzzing/url_parser_fuzzer.cc | 44 ++++++++++++++++++++++++++++++-
 1 file changed, 43 insertions(+), 1 deletion(-)

diff --git a/test/fuzzing/url_parser_fuzzer.cc b/test/fuzzing/url_parser_fuzzer.cc
index 083b1097..94c654ee 100644
--- a/test/fuzzing/url_parser_fuzzer.cc
+++ b/test/fuzzing/url_parser_fuzzer.cc
@@ -13,7 +13,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
   size_t payload_size = size - 1;
   std::string input(payload, payload_size);
 
-  switch (selector % 6) {
+  switch (selector % 13) {
   case 0: {
     // parse_query_text
     httplib::Params params;
@@ -46,6 +46,48 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
     httplib::detail::is_valid_path(input);
     break;
   }
+  case 6: {
+    // parse_url
+    httplib::detail::UrlComponents uc;
+    httplib::detail::parse_url(input, uc);
+    break;
+  }
+  case 7: {
+    // remove_dot_segments
+    httplib::detail::remove_dot_segments(input);
+    break;
+  }
+  case 8: {
+    // resolve_relative_location, with the input as "<location>\n<base>"
+    auto nl = input.find('\n');
+    auto location = input.substr(0, nl);
+    auto base = nl == std::string::npos ? std::string("/index.html")
+                                        : input.substr(nl + 1);
+    httplib::detail::resolve_relative_location(location, base);
+    break;
+  }
+  case 9: {
+    // encode_path
+    httplib::detail::encode_path(input);
+    break;
+  }
+  case 10: {
+    // encode_uri_component, encode_uri
+    httplib::encode_uri_component(input);
+    httplib::encode_uri(input);
+    break;
+  }
+  case 11: {
+    // decode_uri_component, decode_uri
+    httplib::decode_uri_component(input);
+    httplib::decode_uri(input);
+    break;
+  }
+  case 12: {
+    // sanitize_filename
+    httplib::sanitize_filename(input);
+    break;
+  }
   }
 
   return 0;