Πj d Z ddlZddlmc mZ ddlZddlm Z m
Z
ddl Z ddl m
Z
ddlmZmZmZ e j de
fd Z G d d ZdS )
a
Adversarial Stress Testing & Security Fuzzing Suite for ZoneEngine (Milestone 1).
Validates:
1. Zone ID Fuzzing (Fail-Safe Closed: Unicode, Null Bytes, SQLi, Path Traversal, Empty).
2. Safe Haven Purity & Zero Hostile Leaks in Hideout and Sanctuary.
3. Spawn Validation Matrix across Diverse Types & Values.
4. Extreme Boundary Coordinate Gating in Player Hideout.
5. Immutability of ZoneDefinition Dataclasses against Direct Tampering.
6. Empirical Verification of Adversarial Edge Cases (Unhashable Types, NaN Coordinates & Type Confusion).
N)AnyList
ZoneEngine)ZoneTypeZoneDefinitionZoneEnvironmentreturnc t S )Nr LC:\Projects\FreeExile\tests\security_fuzzing\test_zone_engine_adversarial.pyenginer s <<r
c e Zd ZdZdeddfdZdeddfdZdeddfdZdeddfdZdeddfd Z deddfd
Z
deddfd Z deddfd Z deddfd
Z
dS ) TestZoneEngineAdversarialFuzzingz?Empirical adversarial fuzzing and stress testing of ZoneEngine.r r
Nc ^ ddddddddd d
d d d
dddz dddg}|D ]}|j } || }d}||u }|s!t j d|fd||f dt j v st j | rt j | ndt j | dt j v st j | rt j | ndt j | t j | dz }t j dt | d d z d |iz } t t j
| dx}x}x}}| |d \ }
} d} |
| u }|st j d|fd |
| f d t j v st j |
rt j |
nd t j | d!z }
t j d"t | d# d$z d%|
iz }t t j
| dx}} g }t | t }|}|rt | }d}||k }|}|s$d&d't j v st j t rt j t nd'd(t j v st j | rt j | nd(d)t j v st j t rt j t nd)t j | d*z }| | |rt j d+|fd,||f d-t j v st j t rt j t nd-d(t j v st j | rt j | nd(t j | t j | d.z }d/d0|iz }| | t j |d i z }d1d2|iz }t t j
| dx}x}x}x}x}}dS )3z
Fuzzes can_spawn_hostile_monsters and validate_monster_spawn with malformed,
malicious, and boundary string values. All must fail safe (return False).
z
Nzzone_player_hideout zzone_player_hideout
zzone_player_hideout
ZONE_PLAYER_HIDEOUTZone_Player_Hideoutz../../etc/passwdz..\..\windows\win.iniz ' OR '1'='1zu 💀⚔🔥ai' r i90 ) Fisz`%(py5)s
{%(py5)s = %(py2)s
{%(py2)s = %(py0)s.can_spawn_hostile_monsters
}(%(py3)s)
} is %(py8)sr zidpy0py2py3py5py8z#Security breach: malformed zone_id z allowed hostile spawning!z
>assert %(py10)spy10is_dummyz%(py0)s is %(py3)sokr r" z?Security breach: validate_monster_spawn allowed hostile mob in !
>assert %(py5)sr# z.%(py6)s
{%(py6)s = %(py2)s(%(py3)s, %(py4)s)
}
isinstancemsgstr)r! r" py4py6)>)z2%(py11)s
{%(py11)s = %(py8)s(%(py9)s)
} > %(py14)slen)r$ py9py11py14z%(py16)spy16zassert %(py19)spy19)can_spawn_hostile_monsters
@pytest_ar_call_reprcompare @py_builtinslocals_should_repr_global_name _saferepr_format_assertmsgreprAssertionError_format_explanationvalidate_monster_spawnr- r/ r3 append_format_boolop)selfr malformed_zone_idsr @py_assert1 @py_assert4 @py_assert7 @py_assert6 @py_format9 @py_format11r) r. @py_assert2 @py_format4 @py_format6 @py_assert5 @py_assert0 @py_assert10 @py_assert13 @py_assert12 @py_format7 @py_format15 @py_format17 @py_format18 @py_format20s r #test_fuzz_zone_ids_fail_safe_closedzDTestZoneEngineAdversarialFuzzing.test_fuzz_zone_ids_fail_safe_closed s{
% # % ! ! & ' , %K
%)
* & 9 9C4
44S99
U
9UB
9U
5
69
69
:
>C
\d3ii[[[
33C%3HHGB
2;
2
_RVWZR[R[^^^
9 8:c3'' 8' 8' 8CHH 8q 8HqL 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8: 8 8 8 8 8: 8 8 8 8 8 8 8 8 8 8 8 8 8c 8 8 8 8 8c 8 8 8 8 8 8 8 8 8 8 8 8 83 8 8 8 8 83 8 8 8 8 8 8' 8 8 8 8 8 8 8 8 8 8 8 8 8' 8 8 8 8 8 8 8Hq 8 8 8 8 8 8 8 8 8 8 8 8C 8 8 8 8 8C 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8H 8 8 8 8q 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 9 9r
c n ddg}|D ],}|j } || }d}||u }|st j d|fd||f dt j v st j | rt j | ndt j | dt j v st j | rt j | ndt j | t j | dz }d d
|iz } t t j | d x}x}x}}| |d \ }
} d} |
| u }|st j d|fd
|
| f dt j v st j |
rt j |
ndt j | dz }
dd|
iz }t t j | d x}} g }d} | | v }|}|sd}|| v }|}|sd}|| v }|}|st j d|fd| | f t j | dt j v st j | rt j | nddz }dd|iz }|
| |st j d|fd|| f t j | dt j v st j | rt j | ndd z }d d |iz }|
| |st j d|fd || f t j | dt j v st j | rt j | ndd z }d!d"|iz }|
| t j |d# i z }d$d%|iz }t t j | d x}x}x} x}x}x}x}}| |d& \ }} d&} || u }|st j d|fd
|| f d't j v st j | rt j | nd't j | dz }
dd|
iz }t t j | d x}} g }d(} | | v }|}|sd)}|| v }|}|sXt j d|fd| | f t j | d*t j v st j | rt j | nd*dz }dd|iz }|
| |st j d|fd|| f t j | d*t j v st j | rt j | nd*d z }d d |iz }|
| t j |d# i z } d+d,| iz } t t j | d x}x}x} x}x}}.d S )-z
Guarantees 100% safe haven purity:
Neither zone_player_hideout nor zone_boundless_sanctuary can ever spawn hostile mobs.
zone_player_hideoutzone_boundless_sanctuaryFr r r zone_idr assert %(py10)sr% Nr& r( r) r* assert %(py5)sr# u An Toàn Sanctuaryu
Nghiêm cấminz%(py3)s in %(py5)sreasonr" r# %(py7)spy7z%(py10)s in %(py12)sr% py12%(py14)sr6 )z%(py17)s in %(py19)s)py17r8 z%(py21)spy21r zassert %(py24)spy24Tok_dummyz Target Dummyu Khôi Lỗi reason_dummyassert %(py17)sro ) r9 r: r; r< r= r> r? rB rC rD rE rF ) rG r
safe_zonesr` rI rJ rK rL rM rN r) rg rO rP rQ rS @py_assert9 @py_assert11 @py_assert16 @py_assert18 @py_format8 @py_format13rX r[ @py_format22 @py_format23 @py_format25rr rs @py_format16rZ s r )test_safe_haven_purity_zero_hostile_leakszJTestZoneEngineAdversarialFuzzing.test_safe_haven_purity_zero_hostile_leaksC s
,-GH
!
X
XG4 F44W== F F=F F F F F F F F F F= F F F F F F F F F F F F6 F F F F F6 F F F F F F4 F F F F F F F F F F FW F F F F FW F F F F F F= F F F F F F F F F F F F F F F F F F F F F F F F F F F F F F F F F 66w6OOJB 2; 2 2 2 d d< d<6) d d d d d[ d[F-B d d d d dFZ dFZ^dFd d d d d d d d d d d d<6 d d d d d< d d d d d d d d d d d6 d d d d d6 d d d d d d d d d d d d d d d d d d d d d d d d d d d d d[F d d d d d[ d d d d d d d d d d dF d d d d dF d d d d d d d d d d d d d d d d d d d d d d d d d d d d dFZ^d d d d d dFZ d d d d d d d d d d d^d d d d d d^d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d &,%B%B7UY%B%Z%Z "Hl # #8t# # # # # # # # # #8t # # # # # # # # # # # #8 # # # # #8 # # # # # #t # # # # # # # # # # # # # # # # # # # # # # # # # W W> W>\1 W W W W W5G W5G<5W W W W W W W W W W W W>\ W W W W W> W W W W W W W W W W W\ W W W W W\ W W W W W W W W W W W W W W W W W W W W W W W W W W W W W5G< W W W W W5G W W W W W W W W W W W< W W W W W< W W W W W W W W W W W W W W W W W W W W W W W W W W W W W W W W W W W W W W W W W W W W W W W W W W W W W W W W W W
X
Xr
c g d}|D ]}|j } || }d}||u }|st j d|fd||f dt j v st j | rt j | ndt j | dt j v st j | rt j | ndt j | t j | dz }dd |iz } t t j | d
x}x}x}}| |d \ }
} d} |
| u }|st j d|fd
|
| f dt j v st j |
rt j |
ndt j | dz }
dd|
iz }t t j | d
x}} d
S )z@Verifies outer exploration zones allow hostile monster spawning.)zone_tang_kiem_nhaizone_ancient_sword_barrowzone_boundless_sandstormTr r r r` r ra r% NFr& r( r) r* rb r# )
r9 r: r; r< r= r> r? rB rC rD )rG r outer_zonesr` rI rJ rK rL rM rN r) _rO rP rQ s r ,test_wilderness_zones_allow_hostile_spawningzMTestZoneEngineAdversarialFuzzing.test_wilderness_zones_allow_hostile_spawningV sG fff " G4 E44W== E E=E E E E E E E E E E= E E E E E E E E E E E E6 E E E E E6 E E E E E E4 E E E E E E E E E E EW E E E E EW E E E E E E= E E E E E E E E E E E E E E E E E E E E E E E E E E E E E E E E E11'E1JJEB 2: 2 2 2 r
c d}g d}|D ]}| || \ }}d}||u }|st j d|fd||f dt j v st j | rt j | ndt j | dz } t j d t | d
d z d | iz }
t t j
|
d
x}}d
S )z
Stress-tests validate_monster_spawn across falsy types to ensure
falsy values are treated as hostile and rejected in safe zones.
r^ )FNr r r y r& Fr r( r) r* z Falsy value z( incorrectly bypassed safe haven gating!r, r# N) rD r: r; r< r= r> r? r@ rA rB rC ) rG r safe_zone falsy_inputsvalr) r rO rI rP rQ s r 'test_validate_monster_spawn_type_matrixzHTestZoneEngineAdversarialFuzzing.test_validate_monster_spawn_type_matrix^ s4
* 888 c cC11)c1JJEB b2; b b b b b b b b b2 b b b b b b b b b b b b2 b b b b b2 b b b b b b b b b b b b b b btCyy b b b b b b b b b b b b b b b b b b b b b b b b b b c cr
c : d}| |d | | }|j }d}||k }|st j d|fd||f dt j v st j | rt j | ndt j | t j | dz }dd |iz }t t j
| d
x}x}}|j }d}||k }|st j d|fd ||f dt j v st j | rt j | ndt j | t j | dz }dd |iz }t t j
| d
x}x}}d d
ddddddt d dft d dfdt d fdt d fg } | D ]\ }
} |
||
| \ } }
d}| |u }|st j d|fd| |f dt j v st j | rt j | ndt j | dz }t j d|
d| d d z d |iz }t t j
| d
x}}g }d }||
v }|}|sd }||
v }|}|sXt j d!|fd"||
f t j | d#t j v st j |
rt j |
nd#d$z }d%d |iz }| | |st j d!|fd&||
f t j | d#t j v st j |
rt j |
nd#d'z }d(d)|iz }| | t j |d* i z }d+d,|iz }t t j
| d
x}x}x}x}x}}|j }d}||k }|st j d|fd||f dt j v st j | rt j | ndt j | t j | dz }dd |iz }t t j
| d
x}x}}|j }d}||k }|st j d|fd ||f dt j v st j | rt j | ndt j | t j | dz }dd |iz }t t j
| d
x}x}}|
|d-d- \ }}d.}||u }|st j d|fd||f d/t j v st j | rt j | nd/t j | dz }d0d |iz }t t j
| d
x}}|j }d-}||k }|st j d|fd||f dt j v st j | rt j | ndt j | t j | dz }dd |iz }t t j
| d
x}x}}|j }d-}||k }|st j d|fd ||f dt j v st j | rt j | ndt j | t j | dz }dd |iz }t t j
| d
x}x}}d
S )1z
Verifies that update_player_position strictly rejects out-of-bounds coordinates
in zone_player_hideout (bounds: 800x800 -> half_w=400.0, half_h=400.0).
adversary_player_01r^ r )==)z)%(py2)s
{%(py2)s = %(py0)s.x
} == %(py5)sloc)r r! r# zassert %(py7)srj N)z)%(py2)s
{%(py2)s = %(py0)s.y
} == %(py5)s) @ )r r )t y@r )t yr )r r )r r )g mBr )g mr infFr r( validr* z Coordinate (z, z ) bypassed map boundary check!r, r# u Vượt quá ranh giớiu ranh giớird rf r. rh ri rk rl rn r6 r rt ro g y@T
valid_edgerb ) spawn_playerget_player_locationxr: r; r< r= r> r? rB rC yfloatupdate_player_positionr@ rE rF )rG r pidr rI rJ @py_assert3rQ rz extreme_coordinatesr r r r. rO rP rS rv rw r{ rX r rZ r r s r )test_extreme_coordinates_bounds_rejectionzJTestZoneEngineAdversarialFuzzing.test_extreme_coordinates_bounds_rejectionj s
$C!6777 ((--uu|ussuuu|ussu
5\\3 Ell]C
%,,
5<<-
( DAq 66sAqAAJE3 ! X5E> X X X X X X X X X5E X X X X X X X X X X X X5 X X X X X5 X X X X X XE X X X X X X X X#X!#X#Xq#X#X#X X X X X X X X X X X X X X X X X X X X X X X [ [9 [9S@ [ [ [ [ [DT [DTX[D[ [ [ [ [ [ [ [ [ [ [ [9S [ [ [ [ [9 [ [ [ [ [ [ [ [ [ [ [S [ [ [ [ [S [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [DTX[ [ [ [ [ [DT [ [ [ [ [ [ [ [ [ [ [X[ [ [ [ [ [X[ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [5 C 5C< 5C 3 3 5 C 5 C 5C< 5C 3 3 5 C 55c5%HH
A !!zT!!!!!!!!!!zT!!!!!!!!!!!!z!!!!!z!!!!!!T!!!!!!!!!!!!!!!!!!!!!!!!!u u~ u s s u u u~ u s s u r
c | d }t j t 5 t j |_ ddd dS # 1 swxY w Y dS )z
Verifies that ZoneDefinition instances are frozen dataclasses and cannot
be directly mutated at runtime to alter zone_type.
r^ N)get_zonepytestraises Exceptionr
OPEN_WORLD zone_type)rG r hideouts r 2test_zone_definition_dataclass_frozen_immutabilityzSTestZoneEngineAdversarialFuzzing.test_zone_definition_dataclass_frozen_immutability s
//"788
]9
%
% 4 4 ( 3G 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4s AAAc g i t g}|D ]J}t j t d 5 | | ddd n # 1 swxY w Y KdS )z
EMPIRICAL CHALLENGER FINDING:
Demonstrates that unhashable types (list, dict) cause TypeError in dictionary lookup
because zone_id is not guarded with isinstance(zone_id, str).
zunhashable type)matchN)setr r TypeErrorr9 )rG r unhashable_inputsbad_ids r +test_adversarial_unhashable_zone_id_anomalyzLTestZoneEngineAdversarialFuzzing.test_adversarial_unhashable_zone_id_anomaly s SUUO' : :F y0ABBB
:
:11&999
:
:
:
:
:
:
:
:
:
:
:
:
:
:
: : :s AA A c h d}| |d | |t d t d \ }}d}||u }|st j d|fd||f dt j v st j | rt j | ndt j | dz }t j d d
z d |iz }t t j | d x}}| | } t j }| j }
||
} | sd
dt j v st j t rt j t ndt j | dt j v st j | rt j | ndt j |
t j | dz } t t j | d x}x}
} t j }| j }
||
} | sddt j v st j t rt j t ndt j | dt j v st j | rt j | ndt j |
t j | dz } t t j | d x}x}
} d S )z
EMPIRICAL CHALLENGER FINDING:
Demonstrates that IEEE 754 NaN passes boundary check (abs(nan) > 400.0 is False),
highlighting the need for math.isnan / math.isfinite validation.
nan_adversaryr^ nanTr r( r) r* z.Empirical reproduction of NaN bypass conditionr, r# Nz^assert %(py7)s
{%(py7)s = %(py2)s
{%(py2)s = %(py0)s.isnan
}(%(py5)s
{%(py5)s = %(py3)s.x
})
}mathr )r r! r" r# rj z^assert %(py7)s
{%(py7)s = %(py2)s
{%(py2)s = %(py0)s.isnan
}(%(py5)s
{%(py5)s = %(py3)s.y
})
})r r r r: r; r< r= r> r? r@ rB rC r r isnanr r )
rG r r r) r rO rI rP rQ r rJ rL rz s
r 1test_adversarial_nan_coordinate_anomaly_detectionzRTestZoneEngineAdversarialFuzzing.test_adversarial_nan_coordinate_anomaly_detection s1 C!6777--c5<<u NNAKrTzKKKKKKKKKrTKKKKKKKKKKKKrKKKKKrKKKKKKTKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK((--z #% zz% t t z # # % z #% zz% t t z # # % r
c | dd \ }}d}||u }|st j d|fd||f dt j v st j | rt j | ndt j | dz }t j d d
z d |iz }t t j | d x}}d S )
z
EMPIRICAL CHALLENGER FINDING:
Demonstrates that string 'False' evaluates truthily under `if is_dummy:`.
If caller passes deserialized string 'False' instead of bool False, it permits the spawn.
r^ Falser& Tr r( r) r* z=Empirical reproduction of string 'False' truthiness conditionr, r# N)
rD r: r; r< r= r> r? r@ rB rC )rG r r) r rO rI rP rQ s r 4test_adversarial_string_false_type_confusion_anomalyzUTestZoneEngineAdversarialFuzzing.test_adversarial_string_false_type_confusion_anomaly s --.Cg-VVAZrTzZZZZZZZZZrTZZZZZZZZZZZZrZZZZZrZZZZZZTZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZr
)__name__
__module__ __qualname____doc__r r\ r r r r r r r r r r
r r r sg II%9* %9 %9 %9 %9 %9NX
Xt X X X X& : RV
cj
cT
c
c
c
c(
( t ( ( ( ( T4 4X\ 4 4 4 4 :* :QU : : : :
!
!W[
!
!
!
! [: [Z^ [ [ [ [ [ [r
r )r builtinsr< _pytest.assertion.rewrite assertionrewriter: r typingr r r server.world.zone_enginer server.world.zone_typesr r r fixturer r r r
r r s
/ / / / / / M M M M M M M M M M
f[ f[ f[ f[ f[ f[ f[ f[ f[ f[r