feat: Add FQDN matcher and obfuscator#45
Open
renatgalimov wants to merge 7 commits into
Open
Conversation
Add a new GitHub Actions workflow for fuzz testing on pull requests and pushes to the main branch. This setup includes the installation of `cargo-fuzz` and executes a short fuzzing session using Rust nightly. Additionally, update `Cargo.toml` and `Cargo.lock` to include the `clap` dependency with derive feature.
Add is_fqdn() detector and hash_to_fqdn() obfuscator that preserves label structure while replacing content with syllable-based text and a hash-derived TLD. Includes unit tests, well-known inputs, and cucumber scenarios. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…in permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Adds FQDN detection/obfuscation to the existing JSON/YAML/CSS obfuscation pipeline, with test fixtures and cucumber scenarios to validate deterministic outputs.
Changes:
- Introduce
is_fqdn()classifier andhash_to_fqdn()obfuscator, and integrate into string hashing flow. - Add unit tests + well-known input fixtures + cucumber scenarios for FQDN detection/obfuscation.
- Bump crate version and update dependencies/lockfile; add a new fuzzing workflow.
Reviewed changes
Copilot reviewed 6 out of 7 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
src/lib.rs |
Adds FQDN regex/classifier, FQDN obfuscation function, wires it into hash_strings, and extends unit tests. |
src/cucumber_tests.rs |
Extends cucumber step implementations to support fqdn detector/validator. |
tests/well_known_inputs.rs |
Adds well-known FQDN examples for detector expectations. |
tests/features/classifiers.feature |
Adds cucumber scenarios with fixed expected obfuscation outputs for FQDNs. |
Cargo.toml |
Bumps version and adds clap dependency. |
Cargo.lock |
Lockfile updates consistent with dependency/version changes. |
.github/workflows/fuzz.yml |
Adds a CI job intended to run a short cargo-fuzz run. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 580a07c8f9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
- Remove redundant contains('.') check in is_fqdn() (regex enforces it)
- Remove unnecessary string clone in hash_strings() FQDN branch
- Strengthen test to assert label count and non-TLD label lengths
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add cargo-fuzz scaffolding so the CI fuzzing workflow can run the obfuscate_json target. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Adds support for detecting and obfuscating fully-qualified domain names (FQDNs) in the pipefog obfuscation pipeline, along with fixtures/tests to validate the new classifier and stable expected outputs.
Changes:
- Introduce
is_fqdn()detection andhash_to_fqdn()obfuscation logic in the core library. - Extend unit tests, well-known input fixtures, and Cucumber scenarios to cover FQDN detection/obfuscation.
- Bump crate version and add a new GitHub Actions fuzzing workflow.
Reviewed changes
Copilot reviewed 6 out of 7 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
src/lib.rs |
Adds FQDN regex + detector, wires FQDN into string obfuscation, and implements hash_to_fqdn with accompanying unit tests. |
src/cucumber_tests.rs |
Extends cucumber step logic to obfuscate/validate fqdn classification. |
tests/well_known_inputs.rs |
Adds well-known FQDN examples for detector expectations. |
tests/features/classifiers.feature |
Adds Cucumber scenarios with literal expected obfuscated FQDN outputs. |
Cargo.toml |
Bumps version and adds clap dependency. |
Cargo.lock |
Lockfile updates reflecting the version bump and dependency graph changes (notably clap). |
.github/workflows/fuzz.yml |
Adds a fuzzing workflow that runs cargo-fuzz on PRs and main. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Replace deprecated `rand::thread_rng`/`gen_range` with `rng`/`random_range`. - Switch three `|c| c == '+' || c == '-'` closures to `['+', '-']` arrays. - Apply `manual_flatten` suggestion in `obfuscate_json_bytes`. - Correct `hash_to_fqdn` doc comment to state TLD length is not preserved. - Drop unused `clap` direct dependency. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The job was scoped to the `main` deployment environment, which doesn't expose the repository-level `CODECOV_TOKEN` secret, so uploads failed with `fail_ci_if_error`. Use the default scope so the global secret is available. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Welcome to Codecov 🎉Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests. Thanks for integrating Codecov - We've got you covered ☂️ |
Comment on lines
+551
to
+555
| /// Converts a hash into a realistic-looking FQDN preserving the label count and | ||
| /// the byte length of every non-TLD label. The final label (TLD) is replaced | ||
| /// with an entry from `COMMON_TLDS` chosen by the hash, so the TLD length is | ||
| /// NOT preserved. | ||
| pub(crate) fn hash_to_fqdn(hash: &[u8], input: &str) -> String { |
| uses: dtolnay/rust-toolchain@nightly | ||
|
|
||
| - name: Install cargo-fuzz | ||
| run: cargo install cargo-fuzz |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
is_fqdn()detector andhash_to_fqdn()obfuscator for fully qualified domain namesTest plan
is_fqdn()with positive and negative caseshash_to_fqdn()round-trip class preservation🤖 Generated with Claude Code