# libFuzzer dictionary for the Nyx fuzz targets.
#
# Each entry is a quoted string libFuzzer can splice into mutations. We bias
# toward tokens that unlock new tree-sitter / CFG / taint paths across the
# 10 supported languages, plus the synthetic helper names registered by
# `cross_file_taint` so call-site mutations resolve against `GlobalSummaries`
# instead of bouncing off as unknown calls.
#
# Format: one entry per line, `name="..."` or `"..."`. Lines starting with
# `#` are comments. C-style escapes (`\xNN`, `\n`, `\\`, `\"`) are honored.

# ── Punctuation / structural tokens ────────────────────────────────────
"{"
"}"
"("
")"
"["
"]"
";"
","
"."
"::"
"->"
"=>"
":="
":"
"="
"=="
"!="
"<="
">="
"&&"
"||"
"+"
"-"
"*"
"/"
"%"
"<"
">"
"!"
"&"
"|"
"^"
"~"
"?"
"#"
"@"

# ── Cross-language keywords ────────────────────────────────────────────
"if"
"else"
"elif"
"while"
"for"
"do"
"return"
"break"
"continue"
"switch"
"case"
"default"
"true"
"false"
"null"
"nil"
"None"
"undefined"
"void"
"int"
"float"
"double"
"char"
"bool"
"string"
"var"
"let"
"const"
"static"
"public"
"private"
"protected"
"new"
"this"
"self"
"super"
"class"
"struct"
"enum"
"interface"
"trait"
"impl"
"module"
"package"
"import"
"from"
"use"
"as"
"function"
"def"
"fn"
"func"
"sub"
"end"
"begin"
"try"
"catch"
"except"
"finally"
"raise"
"throw"
"throws"
"async"
"await"
"yield"
"lambda"
"match"
"with"
"in"
"of"
"is"
"not"
"and"
"or"

# ── Common literals / format strings ───────────────────────────────────
"\"\""
"\"x\""
"\"%s\""
"\"%d\""
"\"%v\""
"\"{}\""
"`x`"
"'x'"
"0"
"1"
"-1"
"0x0"
"0xff"

# ── Security-flavored function names (sources, sinks, sanitizers) ──────
"exec"
"eval"
"system"
"popen"
"shell_exec"
"passthru"
"spawn"
"execSync"
"execFile"
"Runtime.getRuntime"
"Process"
"Command"
"query"
"execute"
"executeQuery"
"prepare"
"raw_query"
"mysql_query"
"mysqli_query"
"pg_query"
"sqlite_query"
"unserialize"
"pickle.loads"
"yaml.load"
"json.loads"
"readObject"
"deserialize"
"escape"
"escapeshellarg"
"escapeshellcmd"
"htmlspecialchars"
"htmlentities"
"escape_html"
"sanitize"
"strip_tags"
"prepareStatement"
"PreparedStatement"
"parseFromString"
"setAttribute"
"innerHTML"
"document.write"
"window.location"
"location.href"

# ── Sources (taint origins) ────────────────────────────────────────────
"req.body"
"req.query"
"req.params"
"request.GET"
"request.POST"
"request.args"
"request.form"
"$_GET"
"$_POST"
"$_REQUEST"
"$_COOKIE"
"params"
"argv"
"stdin"
"getenv"
"env::var"
"os.environ"
"ENV"
"Console.ReadLine"
"input"
"raw_input"
"fgets"
"scanf"
"gets"
"http.Get"
"http.Post"
"reqwest::get"
"fetch"
"axios.get"
"file_get_contents"
"readFileSync"

# ── Common injection payload markers ───────────────────────────────────
"<script>"
"</script>"
"javascript:"
"onerror="
"onload="
"' OR '1'='1"
"'; DROP TABLE"
"UNION SELECT"
"--"
"/*"
"*/"
"../"
"..\\\\"
"/etc/passwd"
"file://"
"http://169.254.169.254"
"ldap://"

# ── Synthetic helpers used by `cross_file_taint` ───────────────────────
"nyx_taint_source"
"nyx_sanitize"
"nyx_dangerous_sink"
"nyx_pass_through"

# ── Tricky parser edge cases ───────────────────────────────────────────
"\"\\xff\\xff\""
"\"\\u0000\""
"\"\\n\\r\\t\""
"\"\\xc3\\x28\""
"<?php"
"?>"
"<?xml"
"#!/bin/sh"
"\"\\\\\""