A secure web server must be capable of receiving mass amount of malicious input without misbehaving or performing illegal actions, such as stepping outside of a memory block or otherwise spilling the beans.

Continuous fuzzing under various sanitizers is done as part of the Google OSS-Fuzz project:

UndefinedBehaviorSanitizer
AddressSanitizer
MemorySanitizer

Currently the following parts are individually fuzzed:

WebSocket handshake generator
WebSocket message parser
WebSocket extensions parser & negotiator
WebSocket permessage-deflate compression/inflation helper
Http parser
Http method/url router
Pub/sub "topic tree"

While entire (mocked) examples are fuzzed:

HelloWorld
EchoServer
BroadcastingEchoServer

Fuzzing at the syscall level is done using libEpollFuzzer for:

EchoServer

No defects or issues are left unfixed, covered up or otherwise neglected. In fact we cannot cover up security issues as OSS-Fuzz automatically and publicly reports security issues as they happen.

Here is the list of public issues (issues are kept private for 90 days or until fixed): https://bugs.chromium.org/p/oss-fuzz/issues/list?q=label%3AProj-uwebsockets&can=1

Currently we are at 99.5% function coverage, ~90% line coverage and OSS-Fuzz is reporting zero issues in our codebase whatsoever. The goal is to approach 100% total coverage.

Security rewards

Google have sent us thousands of USD for the integration with OSS-Fuzz - we continue working on bettering the testing with every new release.